I am Daniel Alfocea, known for years as cr0hn

Independent technology advisor in security, architecture and AI. Twenty years in the field, including Santander (Principal Engineer, AI) and BBVA (Cybersecurity Tech Lead).

I advise companies with development teams on the architecture, security and AI decisions that are expensive to undo later. It is an ongoing relationship, without counting hours, in which I end up knowing their systems like someone on the inside.

See how the advisory works

I run one-day workshops whose last part is worked on the company's own code. The six-week programme is for those that also agree to measure themselves at the start and at the end, and to put a named owner on every action that comes out of the diagnosis.

For companies

Ongoing technical advisory

Sessions at the pace the work calls for and direct WhatsApp for whatever comes up in between. No hours counted and no lock-in. Over the months I get to know the system and why each thing was decided.

See how it works →

For teams

Training

One-day workshops and six-week programmes on secure development, secure AI development and AI productivity, on each company's own code.

See the training →

For professionals

Mentoring

Architecture, security, teams, career and using AI: how I make technology decisions when I do not have all the information.

See the mentoring →

Where the judgement comes from

I started by breaking systems.

Then I wrote tools so I would not have to break them by hand every time. Some, like GoLismero, Plecost and Dockerscan, are used by security teams all over the world. Others are used by teams that will never know my name.

Once I found the medical records of millions of people sitting open on the internet.

The owner believed it was closed. I wrote to them. They avoided a fine of the kind that hurts. They did not thank me, and that is not why I did it.

A process that took eight hours dropped to a tenth of a second.

Same machine, same code. I only looked at where the time went. It is what I always do: find where time goes, where it will break under pressure, and where someone will get in.

I gave a talk and several companies checked their systems the next day.

Some found open doors that had been there for months. I would rather that check came before anyone gets in.

I have been inside Santander, BBVA and much of Spain's IBEX 35.

Also inside companies in the US, India and the UK, always with the system running. At Santander I was Principal Engineer in the AI department while the area was being set up. The bank has 185,000 employees and OpenAI as a partner; my job was making it work on the inside. At BBVA I was Cybersecurity Tech Lead. At 42Crunch, in the UK, I was responsible for one of its API security products.

I founded Navaja Negra and OWASP Madrid.

Spain needed places to talk about security without the posture. I have presented research at RSA Conference and OWASP AppSec EU, and I am a regular speaker at RootedCON. Spain's National Cybersecurity Institute (INCIBE) has asked me to judge its competitions several times. With Alfonso Muñoz I wrote Secure MCP: A practical guide for developers, software architects and tech leads.

The long version is on About.

One email a day

Every day I send one email about one thing I saw break. When the time comes to talk, how I work is already known.

I want tomorrow's email Everything I publish