Breaking Circuits LLC builds defense-grade security infrastructure for a hostile internet — post-quantum encryption, behavioral-intent firewalls, and agentic AI cores, built on bare metal in Pulaski, Virginia.
// no cloud dependency · redundancy as doctrine · live-fire tested
Our stack runs on our own hardware — no cloud control plane between us and the fight. The feed tiles below are an illustrative simulation of the operations view; the track record further down is the real thing.
The QVP is our flagship stack — encryption that survives the quantum era, a firewall that judges intent instead of signatures, and an agentic core that reasons at the edge.
A five-layer inline encryptor that drops quantum-resistant cryptography into existing traffic — no forklift upgrades, no rip-and-replace.
A zero-trust inspection layer for LLM traffic and agentic systems. It doesn't just match signatures — it judges what the traffic is trying to do.
An autonomous defense-reasoning core built on an efficient BitNet b1.58 architecture — running on edge-class GPUs, not a datacenter.
Every engagement runs the same four-stage lifecycle — the one we executed live against the Shai-Hulud supply-chain worm in May 2026. Keep scrolling; the stages advance as you do.
Continuous monitoring and threat intel flag the anomaly before it executes. In the Shai-Hulud case, the worm sample was in our hands the day it shipped — detection is a posture, not a product.
Isolate the blast radius: sever command-and-control, freeze the compromised path, keep the rest of the network live. When Team PCP's C2 was traced through exposed infrastructure, their control channel became our evidence.
Full reverse engineering — ~6 hours on the worm — producing 12 YARA rules, 63+ account attribution, and a bypass for the malware's own deadman switch. Eradication means the actor's tooling stops working everywhere, not just here.
Complete public disclosure in under 24 hours, remediation guidance for every affected maintainer, and coordinated reporting — CVE-2026-45321, CVSS 9.6 Critical. Recovery isn't done until the whole ecosystem is harder to hit.
We don't sell theory. Our infrastructure and methods were forged in live incident response — against real threat actors, on real timelines.
Founder Lee Peckinpaugh enters cybersecurity the hard way — surviving a sustained 2.5-month targeted attack with no training and no help, self-training up to 16 hours a day until he beat it. His own forensic work identified the exploit used against him — and its creator. That experience shaped everything we build: redundancy, verification, and defense from the victim's perspective.
When threat actor crew Team PCP released the Shai-Hulud npm supply-chain worm on May 12, we published a complete disclosure the next day: ~6-hour reverse engineering, 12 YARA rules, 63+ account attribution, and a deadman-switch bypass. Assigned CVE-2026-45321, CVSS 9.6 Critical.
Works with local law enforcement — sharing threat intelligence and supporting coordinated disclosure efforts.
Approved into Anthropic's Cyber Verification Program approximately 15 minutes after applying — recognition of legitimate, verifiable security-research work.
Currently pursuing federal funding and partnership tracks for the QVP and our fraud-disruption work — including NSF SBIR, DHS SVIP, NIJ, and Air Force programs. SAM.gov UEI/CAGE registration complete.
Alongside defense infrastructure, we're building a public scam takedown and reporting platform — launching very soon. It's already proven in the field:
A live "task scam" operation was detected and fully disabled within two hours of detection. The kill shot went through the scammers' own third-party chat provider: our abuse report got the chat instance shut down, and with no way to work their victims, the operation went dark. Full reporting followed within 72 hours.
A second task-scam operation — a ten-month investigation wrapped in October 2026 — with multi-millions laundered and obfuscated through crypto wallets, fully traced end to end. Currently awaiting feedback.
Three rules run everything we build and ship.
One system is a single point of failure. We run parallel checks on everything that matters: check your facts, then check again. Coverage first, always.
Our infrastructure is self-hosted on our own hardware in Virginia. No cloud dependency means no third party can pull the plug on our defenses — or yours.
Founder's ethos, in his words: "I put that X on me so others don't have to." We build for the people on the receiving end of attacks — because we've been there.
During a brutal 2024 cyber attack, our founder tore down his own laptop motherboard ten times in a week — down to six minutes a teardown, no damage — learning the hardware inside and out to stay ahead of his attacker.
The lesson stuck: circuit boards are tougher than people think. "No broken circuits" became Breaking Circuits — and the name carries three meanings:
Hardware tougher than it looks. Attackers' circuits, broken. And technology's beautiful imperfection — the reason this field exists at all.
Lee Peckinpaugh founded Breaking Circuits after entering cybersecurity in March 2024 and compressing years of learning into months of live-fire experience — including his own digital forensics work that identified the exploit used against him and its creator.
Since then: a published CVE disclosure, law enforcement threat-intel coordination, five HackerOne submissions, eight-plus white papers, and roughly 7,280 documented engineering hours across 292 public repositories — at extreme capital efficiency, running on about $200 of total AI spend since 2024.
Breaking Circuits LLC is the defense-infrastructure arm. Our sister effort in consumer fraud disruption — a scam takedown and reporting platform launching very soon — is already field-proven, including a documented two-hour detection-to-disruption takedown of a live task-scam operation.
Partnerships, pilot deployments, threat-intel sharing, or press — we read everything. Prefer email? Write us directly, or dig through the open-source work on GitHub.
PULASKI, VIRGINIA · BARE METAL · NO CLOUD