Obsidian Watch Group
Every brief triaged immediately. Urgent cases reach me within hours.

Your devices are talking to someone.
I find out who, and put it on the record.

I build a defensible written record of what your devices do, who they talk to, and what changes when nobody is looking. Hardware, firmware, network, and the investigative work that holds up in court.

send a briefsee the services

Your devices aren't doing what you think.

Phone-home telemetry you didn't authorize. OTA pushes that disable hardware you paid for. Cloud sessions that survive your refusal. Supply-chain backdoors quietly shipped in firmware. Cleartext transmission of data the spec sheet promised was encrypted. Your hardware ships with behaviors the box never mentions. I put it on the bench, document what it actually does, and write it up for the record.

Track record

Real damage to real ecosystems.

Independent investigations that have broken multi billion dollar supply chains, rerouted vendor practice across whole product categories, and put surveillance ecosystems on the public record.

$B

Supply chains placed under public scrutiny across automotive, additive manufacturing, and fintech

3.4M

Documents read line by line, every flagged item annotated

40

Country scope across active investigations, including embargoed disclosure channels

FBI · HSI
DOJ · DOD

Findings submitted through federal law enforcement and national security channels. Also FinCEN, DFPI, NHTSA, Google VRP.

CWE breadth

19distinct CWE categories

Coverage

Nineteen distinct Common Weakness Enumeration categories surfaced inside major brand product ecosystems across the practice's active investigations. Spans OTA update control and integrity, signing key exposure, cleartext transmission, hardcoded credentials, authentication bypass, and supply chain compromise. Vendor-side CVE assignment pending coordinated disclosure.

Major brand ecosystems

Infrastructure

100%owned compute & bench

In-house labs

All bench instruments and compute infrastructure operated in-house. Analysis workloads run on our own clusters in our own racks. No rented cloud for case material, no shared lab benches, no third-party custodians of evidence. Owned hardware end-to-end, from probe tip to disk.

Owned end-to-end

These are not theoretical exercises. The investigations behind this practice have caused vendor public statements, regulator referrals, embargoed federal disclosure tracks, and material change in how multi billion dollar product categories handle owner consent and data sovereignty.

Practice areas

Four ways I work.

01service

Hardware Security & Recovery

Hardware audits, recovery, and bench-level rework for small and medium businesses.

Hardware that needs eyes on the bench. I audit devices before your IT team rolls them out, recover hardware bricked by vendor OTA pushes or component failure, rework boards nobody else will touch, extract firmware so you can prove what the device actually does, and document chip-level findings with photographs and bus captures. Useful when procurement needs a device verified, when a board failure or vendor brick is costing you money, or when something on your network is doing things its packaging never mentioned. Reports are written for the audience that has to act on them.

  • ▸Pre-rollout device audits for IT and procurement
  • ▸Recovery of devices bricked by OTA pushes or vendor updates
  • ▸Board-level repair and rework: BGA, fine-pitch, no-lift fixes
  • ▸Firmware extraction, recovery, and modification
  • ▸Bus capture: UART, SPI, I2C, USB, CAN
  • ▸Post-incident hardware forensics
  • ▸Vendor-claim verification: does it do what they say it does
  • ▸Written report and reproducible findings
02service

Software & Network Security

Know what your software, IoT, and network are actually doing.

Software and connected devices already running your operation. I instrument your network, capture every outbound flow, and tell you which endpoints your devices reach, who owns each one, what jurisdiction the data lands in, and what changes when you decline a terms-of-service update. Useful for IT directors evaluating new gear, healthcare practices that need to know about HIPAA-touching telemetry, manufacturers with connected products of their own, and any business tired of finding out about new tracking after the fact.

  • ▸Network audit of IoT, point-of-sale, and connected appliances
  • ▸In-house and third-party app code review
  • ▸Endpoint identification, corporate attribution, jurisdiction mapping
  • ▸TLS payload inspection within legal scope
  • ▸Compliance pre-check: HIPAA, PCI, sector-specific
  • ▸Behavior testing under refused consent and declined updates
  • ▸Written report for IT, counsel, or insurance
03service

Business Security & IT Management

Contract security and IT operations for independent businesses.

Contract engagement covering the operational security and IT decisions that keep an independent business running. Scope includes network and endpoint security, point-of-sale and connected-device auditing, storage and cloud architecture that does not touch AWS, Azure, or the other major hyperscalers when sovereignty or trust requires it, backup design and disaster-recovery testing, vendor coordination, account inventory and recovery, and telemetry control. Engagements are structured either as a defined project closing in a written runbook, or as an ongoing contract with monthly reporting to ownership. Scope, deliverables, and pricing are set at the contract, not the hour.

  • ▸Network and endpoint security operations
  • ▸Point-of-sale, IoT, and connected-system audits
  • ▸Private storage and cloud architecture (off AWS, Azure, hyperscaler)
  • ▸Backup design and disaster-recovery testing
  • ▸Vendor coordination and account inventory
  • ▸Telemetry control and privacy enforcement
  • ▸Incident response with defined response standards
  • ▸Documentation: project runbook or ongoing monthly reporting
  • ▸Contract scope and pricing, not hourly
04service

Investigations

Get the answer in writing, sourced to the record.

Long-form investigative work for situations that need a defensible answer. I take vendor due diligence before you sign a contract, supply chain investigation when something does not add up, post-incident reconstruction for insurance and litigation, and competitive intelligence for procurement. Every claim in the report is sourced to its underlying citation. The structure is built for whoever has to act on the work: your insurance carrier, your lawyer, a regulator, your board, or the press if it gets there.

  • ▸Vendor due diligence and counterparty review
  • ▸Supply chain investigation
  • ▸Post-incident reconstruction for insurance or litigation
  • ▸Competitive intelligence for procurement decisions
  • ▸Public-record, court, and regulatory record analysis
  • ▸Bench evidence where a physical device is in play
  • ▸Available under counsel for attorney work-product privilege

Scope & integrity

The four services above are the most common shapes the work takes, not the limit. Engagements that fall between or beyond what is listed are welcome. The practice is integrity based: cases that fail the screen for evidence, ethics, or independence are declined in writing without exception. No exception for fee size, client name, or pressure.

Where I serve

Based in Tennessee, serving small and medium businesses across the state: Nashville, Knoxville, Memphis, Chattanooga, the Tri-Cities, Murfreesboro, Clarksville, and everywhere in between. Remote engagements anywhere in the United States. Bench work and on-site engagements brought to your location on request.

Engagement model

How the work runs.

Three steps from brief to report. No retainers. No surprises.

Triaged on arrival · urgent ASAP · 48h standard

01

Brief

You describe what you have, what you need, and what good looks like. I respond with whether the work is in scope, what it will cost, and how long it will take.

02

Bench

I do the work. Photographs, captures, decompiled artifacts, and a running log are committed to a private repository you can audit at any point.

03

Record

You receive a written report cited to the evidence, a separate executive summary, and a reproducibility appendix. If you engaged through counsel, the work product carries privilege.

Equipment we trust · In-house labs

Bench tools that earn their place.

Special credit to Saleae, Halehound, and Valley Tech for backing independent researchers and keeping this kind of work going.

Everything below runs in our own in-house labs. Owned cluster, owned bench, owned evidence chain.

SaleaeLogic Pro 16DellCluster nodesWellerWXsmart 2010RigolDHO924SAmScopeSM-4NTP 3.5-90xBus Pirate / Dangerous PrototypesBus PirateHalehound™Halehound™Valley Tech Custom SolutionsValley TechJBC ToolsJTSE-1QBXGecuT76 hardened

Communities · Membership

Member of DEFCON615 — Nashville, TN.

WiGLE.net wireless survey contributor statistics

Built in-house

Shielded RF enclosure.

Some bench infrastructure is built rather than bought. The shielded RF enclosure used for phone-home isolation testing is a 36-inch cube TIG-welded from half-inch steel plate, with copper waveguide-below-cutoff feedthroughs for power penetration and a hand-access port sized for in-chamber work. Built to the spec the work required when the off-the-shelf version was not the right shape.

Bench captures and protocol analysis run on a Saleae Logic Pro 16. Compute and analysis workloads run on an in-house Dell cluster. Active bus probing via Bus Pirate. High-density chip programming on a network-locked XGecu T76. Precision soldering on Weller, hot air and BGA work on JBC. Signal validation on Rigol. Component-level inspection under AmScope optics. Custom rigging built on Halehound. Custom PCBs and bench-ready builds from Valley Tech. Real tools, real evidence.

Why bench-grade matters
Jay and Brittany Puckett, Obsidian Watch Group

From our home to yours

Real people. Real bench. Real work.

Jay learned C on an original IBM PC. Intel 8088, monochrome display, a compiler that shipped on 5.25-inch floppies. He was in his early teens. The fifteen years after that went about where you would expect. x86 assembly. TCP/IP back when dialup was still normal. Reverse engineering DOS TSRs, then moving to UNIX because that was where the interesting security problems were. He was pulling tcpdump captures before Ethereal existed and debugging kernels back when Windows blue screens paid the rent.

By 2006 the work was forensics. Imaging drives, holding chain of custody, building evidence that had to survive contact with people who were going to act on it.

He founded Patriot Scientific in Tennessee to do security work for independent medical practices, small businesses, and the clients other shops turned away. Patriot Electronics in Atlanta ran the hardware side. During the state opioid crisis, Patriot Scientific built the forensic evidence chain that tied a regional pain-management operation together in a federal case. Jay collected it, maintained it, and sat for deposition by prosecutors. It ended in a plea before trial.

Microsoft accepted him into BizSpark in 2014. He sold both companies together and rebuilt the practice as Obsidian Watch Group.

There is a version of this business that is mostly paperwork. You fill out the form, sign off that the documentation is compliant, and know that it is not. There is another version where you push a policy, record it as a control, and never go back to see whether it did anything. Jay had no interest in either. The clients pushed that way too. Doctors did not want the accurate answer, they wanted the cheap one that sounded reassuring, and somebody will always sell that.

So practices coming over from an MSP got rebuilt from the floor up. Infrastructure, policy, operating procedure, best practice, all of it pulled out and written again from scratch. That was never an upcharge. It was his condition, on his time and his dollar. Leaving MSP remnants in place means leaving somebody else's assumptions running underneath your work, and there is no honest way to call that your best. Paperwork only ever proves paperwork. Whether it is a policy nobody follows or a device doing something its vendor never disclosed, the only way to know is to go and look, then say what you found. Even when that is not what anyone wanted to hear.

The name was picked for what the material does. Obsidian is not especially hard. It has almost no crystalline structure, no internal grain for a fracture to follow, and that is exactly why it takes an edge finer than surgical steel. Hone a practice the same way and it cuts straight to the problem and lifts it out. Get it sharp enough and no attacker wants to be the one who tries.

Tennessee-based, family-run since 2014.

We treat your business the way we'd treat our own. Independent, owned end-to-end, no investor pressure, no cloud custodian holding your evidence.

Every brief triaged on arrival

Got a device or a question that needs a real look?

Briefs go to investigations@obsidianwatchgroup.com. Every one is triaged the moment it lands. Urgent cases reach me within hours. Standard cases get a human reply within 48 hours, even if the answer is no. Encrypted intake available on request.

send a brief