The contracts that would change your company are gated by a security review you can't pass yet. We get you through it, and keep you through it.
Klavan builds your security program, runs it, and maintains it, so you pass the review, win the deal, and stay ready for the next one. SOC 2, ISO 27001, CMMC, and more. The people who build your proof break into systems for a living. Security before compliance.
MISSION-READY SECURITY
Security before compliance. You focus on winning. We handle the complexity.
SHELL
HOUNDS
A Division of Klavan Security · Under Shadow Tactics
A high-speed, black-box research lab for cyber and physical security R&D. Think DARPA meets underground skunkworks. Ex-military, ex-intelligence operatives and natural-born hackers. Our penetration testing directly powers the Mission Ready SOC 2 Success Path™ and is available as standalone engagements. We don't sell fear. We build credibility that closes deals, and we monetize zero-days.
MISSION READY SUCCESS
PATHS TO THE SUMMITS
Done right. No cheat codes.
- ✓Everything in BaseCamp Guide
- ✓Runs on the BaseCamp platform
- ✓Security questionnaires handled for you
- ✓Quarterly strategy sessions
- ✓Audit liaison + priority response
- ✓SHELLHOUNDS Startup Pentest included
- ✓Type I · fixed 6-month engagement
- ✓Type II · fixed 12-month engagement
- ✓GRC setup & management
- ✓CPA firm coordination
- ✓Readiness done right, without the in-house build
- ✓Everything in Rope Team
- ✓Dedicated advisor + risk register
- ✓Multi-framework readiness
- ✓Priority response SLOs
- ✓Scales with your headcount and frameworks
COMPANIES WE'VE
HELPED HARDEN
Real teams. Real engagements. Across sectors and stages.
14 PRACTITIONERS.
THREE CORE LEADS.
This is not a team that learned security from a certification course.
20+ years in offensive security. Shellhounds red team under Shadow Tactics. I build what attackers fear.
A natural-born hacker and cypher punk. The kind of mind that finds the gap everyone else missed.
Ex-military, Five Eyes signals intelligence. Operated where the stakes were real.
Behind us are 11 more practitioners. Ex-military. Ex-intelligence. Offensive security backgrounds. This is not a team that learned security from a certification course.
WE'RE A
STARTUP TOO.
WE KNOW
YOUR PAIN.
Klavan Security is an indie, self-made firm. No VC. No enterprise backstory. We built this from the ground up, the same way you're building yours.
We know what it feels like when a buyer asks about security and you have nothing to send. We know what it's like to lose a deal over a questionnaire you couldn't answer. We know the pressure of a contract that requires SOC 2 and a runway that can't absorb a $200K consultant bill.
That's exactly why we built BaseCamp. Not for enterprises that can throw money at the problem. For founders and scale-ups who need to move fast, close deals, and not get buried in compliance theater.
"Startups and scale-ups, we know you. Because we are you."
SPEAKING
ENGAGEMENTS
OUR PARTNERS
The community we operate in and contribute to.
See exactly how Klavan Security handles security, compliance, and data protection. Real controls. Verified posture. Not aspirational. Documented and live.
LET'S TALK
SECURITY.
No pressure. No pitch deck. A direct conversation about your situation, your risks, and whether Klavan is the right fit. If we're not, we'll tell you that too.
Tell us what you're working on. No pressure, no pitch, just a direct conversation about your situation. If we're not the right fit, we'll say so.
Questions, answered
Frequently asked questions
Security before compliance. Built by operators. Here is how it works.
Who is Klavan Security?
Klavan Security is an Ottawa-based cybersecurity company that builds platforms helping startups become enterprise-ready. Its flagship product, BaseCamp, is a guided security and compliance platform for SOC 2, ISO 27001, and CMMC. The team is made up of ex-military and ex-intelligence operators, and the company follows a security-before-compliance approach: building real security foundations first and pursuing certification second.
What is BaseCamp?
BaseCamp is Klavan Security's flagship platform. It is a guided 12-month security and compliance cycle that combines software with human Guides. It builds readiness for SOC 2 Type II, ISO 27001, CMMC, NIST 800-171, HIPAA, and FedRAMP, and includes a live Trust Center from month one. Unlike self-serve compliance software, the BaseCamp platform comes with people who do the work with you.
How much does SOC 2 cost for a startup?
Going it alone with a traditional consultant often costs tens of thousands of dollars. BaseCamp starts at $297 per month for the self-guided Scout tier and $597 per month for the Guide tier, which includes a dedicated human Guide. Larger teams use the HighCamp tiers, HighCamp Rope Team at $2,800 per month for teams of 2 to 10, and HighCamp Expedition at $4,200 per month for teams of 10 to 50, both of which include SOC 2 Type I and Type II audit fees and an annual penetration test. BaseCamp is a 12-month cycle and includes a live Trust Center from month one.
What is BaseCamp Recon?
BaseCamp Recon is Klavan's human-led penetration testing service, run by its in-house SHELLHOUNDS team. It tests web applications, APIs, and cloud infrastructure, including AI-generated and vibe-coded apps, and delivers a plain-English report in 5 business days. It starts at $499. The testing is always human-led, never automated scanner output.
Do I need a penetration test for SOC 2?
A penetration test is commonly expected for SOC 2 and is frequently requested during enterprise security reviews. Klavan provides this through BaseCamp Recon, starting at $499 with a report in 5 business days.
What is the difference between Klavan and a compliance platform like Vanta or Drata?
Vanta and Drata are software you operate yourself. Klavan builds a platform, BaseCamp, that comes with human Guides who are ex-military and ex-intelligence operators. Klavan drives the GRC tooling, coordinates with auditors, and runs the security program with you, rather than handing you a dashboard and leaving you to figure it out. The platform comes with the people.
What does "security before compliance" mean?
It means building genuine security controls first, then proving them through certification. Many firms reverse this and chase a checklist, which produces a certificate without real security underneath. Klavan builds the security posture first so the compliance result holds up under an actual security review.
Who is BaseCamp for?
BaseCamp Scout and Guide are built for bootstrapped, pre-seed startups with teams of roughly 1 to 5 people who have not raised funding. Funded startups and larger teams, up to about 50 people, use the HighCamp tiers. Common sectors include fintech, healthtech, cleantech, SaaS, AI, agritech, and critical infrastructure.
What is a Trust Center?
A Trust Center is a public page that shows a company's security posture, controls, and compliance status to prospects and customers. In BaseCamp, the Trust Center goes live in month one, so a startup can show credibility to buyers before certification is complete. It is proof the security program is working, not the product itself.
Does Klavan help with frameworks other than SOC 2?
Yes. BaseCamp supports SOC 2 Type II, ISO 27001, CMMC, NIST 800-171, HIPAA, and FedRAMP readiness. The same underlying security program maps to multiple frameworks, so a company does not start over for each one.
Where is Klavan Security located?
Klavan Security is based in Ottawa, Ontario, Canada, and serves startups across Canada and the United States.