We help businesses work out which security rules apply to them, assess where they stand and fix what matters first. The work is led by Lennart Lopin, a CISSP who also holds ISC2's cloud security (CCSP) and secure software lifecycle (CSSLP) certifications.
It starts with a free 30-minute call. We agree the scope with you before any work begins.
Sarasota Consulting's security work is led by its founder, Lennart Lopin. Here are his credentials and his security work outside Sarasota Consulting.
Lennart Lopin
On October 28, 2026, in the Denver area, Lennart presented "Claude Code as Server-Side Security Infrastructure: From Proactive Hardening to Post-Breach Forensics." The session covered using an AI coding agent on Linux servers as active defensive tooling across the security lifecycle.
He wrote No Human in the Loop: Cybersecurity in the Autonomous AI Age, now in its second edition. It is the background to the AI security work further down this page.
He co-founded Byte Federal, a Bitcoin ATM and financial services company, in 2016 and is its CTO. He has run its security programs, including ISO 27001 and GLBA work. That ISO 27001 certification belongs to Byte Federal, not to Sarasota Consulting.
He founded Decima Systems, an AI-driven security-validation service: a standing AI adversary that investigates weaknesses an attacker could exploit, verifies each finding with a person reviewing it, helps engineers fix them, then retests.
decima.systemsSecurity work usually starts because someone asks for it: a regulator, an insurer or a customer. Here is who each rule applies to, what it asks for and what we do about it.
GLBA · 16 CFR Part 314
HHS
Department of Defense
Audited by a CPA firm
Section 768.401, Florida Statutes
Applications and renewals
These are plain-English summaries, not legal advice. Your attorney can tell you exactly which rules apply to your business.
Take the ones you need. Every engagement is scoped with you before work starts.
A part-time chief information security officer for a business that doesn't need a full-time one. We set priorities, run the security program and report to the owner or board. We can also serve as, or support, your FTC Safeguards Qualified Individual.
A HIPAA risk analysis, the written risk assessment the FTC Safeguards Rule requires, or a general security risk assessment against the NIST Cybersecurity Framework (CSF).
CMMC Level 1 and Level 2 readiness, SOC 2 readiness, and written information security programs and policies. We get you ready for the assessor or auditor.
Penetration testing of your web applications, APIs and AI agents, as a one-off test or on a schedule up to continuous. Automated red teaming runs on Decima Systems, the AI-driven validation service Lennart founded, with a person verifying every finding. Blue-team hardening and a purple loop close the gaps: find, fix, retest.
Penetration testing & red teaming →Safe AI adoption, an AI acceptable-use policy for your staff, and securing AI agents, including the automation we build.
An incident response plan, a tabletop exercise that walks your team through it, and help with cyber insurance questionnaires.
STEP 01
Tell us what started the question: a rule, an insurer, a customer's questionnaire or a worry. We'll tell you plainly whether we can help.
STEP 02
We agree the scope with you before any work starts, then assess where you stand against the rule or standard that applies to you.
STEP 03
What to fix, in order of priority, written so your staff or IT company can work through it.
STEP 04
Some businesses want a security lead every month. Others need an assessment once a year. You decide.
We work alongside your IT company, not instead of it. They keep running your systems; we set the security priorities and check that the fixes hold.
Businesses are putting AI tools in front of staff and customers, and some let AI agents act on their systems. That raises practical questions: what staff may paste into a chatbot, what an agent is allowed to touch, and who checks what it did.
AI security is the subject of Lennart's book, No Human in the Loop, and of his ISC2 Security Congress session on using an AI coding agent as defensive tooling on Linux servers. We apply the same thinking to the AI automation we build for clients.
We can help you with
Sarasota Consulting was founded by Lennart Lopin and has been based in Sarasota since 2012. We work in person across Sarasota and Manatee counties, and remotely with businesses anywhere.
In person across
No. We prepare you: we assess where you stand, help close the gaps and write the documents. Third-party CMMC certification, when it is required, is performed by an authorized C3PAO, and SOC 2 audits by a CPA firm. We tell you what we found and what's left to do.
Yes. The rule allows the Qualified Individual to work for a service provider, so we can take the role or support someone on your staff who holds it. Either way, your business keeps responsibility for meeting the rule.
A part-time chief information security officer. You get someone to set security priorities, run the program and report to the owner or board, without a full-time hire.
No. We work alongside them. Your IT company keeps running your systems day to day. We set security priorities, assess, write the plan and retest the fixes.
It depends on the scope, so we scope first. Start with the free 30-minute call. We agree the scope with you before any work starts.
After the free call we send you a written scope. Work starts when you approve it, on a date that suits you.
Yes. We work in person across Sarasota and Manatee counties, and remotely with businesses anywhere.
Tell us which rule, insurer or customer is asking. We'll tell you what we'd look at first and whether we're the right fit.