Skip to content
RTFMZa male i srednje tvrtke ↗
Independent infrastructure & security engineering

Build systems your team can operate with confidence.

No vague transformation programme. Each engagement has a decision, a deliverable, and a stopping point.

Send a short brief See how engagements work
repositories under security automation
1,000+
years operating Linux in production
20+
open-source blueprints, gaps included
11
Why this practice exists

Most teams do not lack tools. They lack working integration and useful context.

Asset data lives in Terraform. Runtime truth lives in metrics, logs, traces, and packets. Findings arrive from five scanners with five ideas of urgency. Identity and certificates become urgent only after they fail. RTFM closes that gap without handing you another black box.

01

Outcomes before components

Start with “what breaks if I change this?”, “what is being exploited?”, or “why is the service slow?” The container list comes second.

02

Opinionated, not opaque

Every component, config, dashboard, and trade-off stays visible. A system you cannot understand is just a smaller vendor lock-in problem.

03

You keep operating it

Documentation and knowledge transfer are part of the work, not an upsell. The goal is a team that no longer needs the engagement.

Three ways to engage

Defined work. Visible output.

011–2 weeks

Architecture & risk review

For teams deciding what to build, replace, harden, or stop pretending is temporary.

You leave with

A written decision record, architecture diagrams, a risk register, and an implementation estimate.

022–6 weeks

Hardened deployment

For teams that want a proven blueprint adapted to their real network, identity, data, and recovery requirements.

You leave with

A running, tested deployment; source-controlled configuration; evidence of recovery; and a clean handover.

03Monthly · limited slots

Ongoing operations

For small teams that own the stack but need experienced review and operational depth without hiring another full-time role.

You get

A named operator, a monthly evidence report, an ordered improvement queue, and fewer “we should probably check that” items.

Full scope and deliverables
Evidence, not a capabilities deck

You can read the work before you hire the engineer.

RTFM publishes In a Box — self-hosted infrastructure and security blueprints, in the open, with their tests, dashboards, configuration, and stated gaps. It is the same engineering you would be buying.

SIEM in a Box Grafana dashboard showing event counters, a detection timeline, priority breakdowns, and a live security event stream.
SIEM in a BoxRuntime detections, ATT&CK mapping, and the raw event stream. 64 tests.
Assets in a Box web UI showing an infrastructure dependency graph with typed relationships between Kubernetes pods, services, secrets, and certificates.
Assets in a BoxBlast radius and drift across Terraform, Kubernetes, Ansible, and Compose.
Observability in a Box Grafana system overview with CPU, memory, and disk gauges alongside time-series charts.
Observability in a BoxMetrics, logs, traces, and profiles on a stack you can read.

Real output from the projects — not product mockups.

All the blueprints in-a-box-tools.tech ↗
Private AI

AI on infrastructure you control.

Most teams already use AI; few know where their prompts, logs and code end up. RTFM builds AI into your stack like everything else: self-hosted where the data is sensitive, inspectable, and with a clear owner.

  1. 01

    Self-hosted models

    Local language models next to your data, so logs, configuration and code never leave your network.

  2. 02

    AI-assisted detection and operations

    Summaries and triage on top of your SIEM and observability data. The In a Box SIEM blueprints already ship optional private AI analysis.

  3. 03

    Governance for AI tools

    Which tools engineers may use with which data — written down and enforced, not assumed.

If it cannot be understood when it fails at 3 AM, it is not finished.

Start with context