Jan Masters, founder
In 2018 I joined a security firm that was ahead of its time. The testing was still down to the consultant, but everything around it ran through one portal. Scheduling, scoping, service prerequisites, report writing and PDF generation all lived there, staff and clients worked from the same system, and the usual timesinks were either removed or softened by it. Three years later I moved to a firm with a different kind of reputation, long established and earned through research and word of mouth. It had systems of its own, but they mostly finessed the traditional consultant-led model. A word processor, spreadsheets, a generator for the report baseline, and then everything else done by hand. I met friction points I never knew existed, because the portal had been quietly absorbing them.
The second firm was not the exception. Most of the industry runs on a consultant-led model, and it is a heavy one. Sales, schedulers and project managers carry a great deal of it and deserve more credit than they get, yet the consultant still ends up holding several systems and a lot of admin around a job that is already demanding and tightly time-boxed. Every slip snowballs into the next engagement. When I asked clients about their side of it, they were fighting the same uphill battle from the other direction.
Where I'm from
I started in 2015 on an IT apprenticeship, then spent two years as a network admin in a small but efficient team at a multinational. The IT manager there doubled as the local security officer and had earned the nickname Dr No. I became his right hand, and the more advanced and weighty projects came my way. That turned out to be the best preparation I could have had. When I moved into security in 2018 I was propelled into the deep end like a helldiver, and the admin years strapped rockets to my feet in the eyes of my manager and scheduler. I could get to grips with an environment fast, and I was trusted in front of clients early.
The years since have covered delivery, technical sales, leading teams and projects, and building service lines from nothing. At the second firm I was mentored in vulnerability research and public disclosure, and had my five minutes of fame within the first month when a disclosure about Peloton went round the news. Mostly, though, I have been the dependable workhorse, the one who gets put in front of the client and left to it, and who fixes the friction around the work so the work can happen. I still lead a penetration testing department by day.
What kept repeating
Four things, on every engagement, at every firm, and for every client I spoke to.
The work is true for one day. A test is a photograph. By the time the report is read the estate has moved, and nothing carries forward to the next one except a PDF somebody has to reopen.
The overhead snowballs. Consultant-led work is time-intensive by nature, and the admin eats the time, effort and spoons that should go to providing client value and a good report. Scoping, quoting, QA'ing work, actioning QA feedback, delivering reports, collating output, managing current and future projects with their comms, prerequisites, queries and updates, and helping sales and account managers with whatever lands in their inbox. Each one is small. Together they decide whether you ship on time.
The quality depends on who turns up. Methodology, for the most part, lives in the consultant's head, and their experience and knowledge drive the majority of it. Written methodologies do exist, but are they ever truly all-encompassing and current?
Nobody believed it could be done. Many told me this work could not be automated or streamlined, at least not until AI arrived. I disagree. The work needs consistency, accountability and depth, and all three can be achieved programmatically. It did not need a model boiling the ocean to do what little Timmy has been doing since his first bash script.
Nothing on the market answered the first three, and the fourth explained why. Scanners answer none of them. Reporting tools start when the testing ends. The platforms that come closest live in someone else's cloud, which for security work is a strange place to keep the most sensitive thing you own. So I set out to build the first of its kind, with a level of customisation, depth and breadth that nothing else offered, and to build it properly rather than quickly.
What it cost
I started building in the first quarter of 2024, during a stretch of jury service that gave me more free hours than I'd had in years. The first version was the tool orchestration and scheduling engine. A year later I started the portal side, with scoping, proposals, reporting and the client record. For a while they were two separate products that happened to share a stack and a set of principles. Merging the best of both into one platform was a later, slower decision, and the right one.
It has been entirely self-built and self-funded. Early mornings, late nights, and a great deal of my partner's time that was really ours. The name took as long as anything. It changed several times because the business could not follow the crowd, with no shortcut to market and no minimum viable version shipped to see what sticks. For a platform that will hold other people's findings it had to be intentional, secure and maintainable before it was anything else. A breakline is where the terrain fundamentally changes. That is what it is for.
What I'm trying to do
Improve the experience for the people doing the work and the people paying for it, so modern security challenges get met with something better than a yearly snapshot and a stack of tools that don't talk to each other. Flip the model. Fix the point-in-time problem, remove the manual overhead, and make consistency a property of the process rather than of whoever is free that week.
Dispatch is one self-hosted platform that carries an engagement from scope to signed report and keeps the estate alive in between. The same toolkit whether you deliver to clients or run your own programme.
What it is not
It is not a bounty scanner, it is not AI pentesting, and it is not an imitation of anything else. It runs on your infrastructure, which means the operations are yours too, and I would rather say that plainly than pretend otherwise. It will not replace a specialist for complex application testing, red teaming, or the independent assurance you cannot give yourself. It earns its keep on the routine majority of the work, which is where most of the time and most of the inconsistency live.
The ask
Look at it with a fresh perspective. Then either watch one of the episodes and see a real piece of work go through it, or write to me at info@breaklinesecurity.com and tell me where I've got it wrong. I'd value either.
Jan