Hi, I'm

Radim Tichý

Cybersecurity, offensive testing, infrastructure and AI.

Most of the time I find the weak spots before an attacker does. I test applications, networks and Active Directory, design the defense and build infrastructure that holds. Lately mostly AI security, especially models running locally inside a company.

Get in touch
01

About

I work in cybersecurity, both hands-on and strategically. For years I've run and defended a datacenter, scanned for vulnerabilities, driven their remediation and kept the environment aligned with ISO 27001. As an Information Security Specialist at BESECURED and Security Administrator and Datacenter Manager at KVADOS, I move from the server room all the way to policy. I'm also a member of the KVADOS CSIRT team, so incident response is something I know first-hand.

The offensive side is what I enjoy most. Penetration testing and red teaming, where I look at a system through an attacker's eyes and find the way in before someone else does. I then turn the findings into a clear report and concrete steps that actually reduce the risk.

I'm equally at home in secure infrastructure design and governance. I deal with NIS2, continuity and availability, and more and more with AI security: how companies adopt AI, how to connect locally hosted models with cloud frontier models, and how to keep oversight and compliance over the whole solution.

Certifications and education

Certifications
MikroTik MTCNA, MTCRE, MTCTCE
Courses & training
CEH · CHFI · Certified Penetration Testing Professional · Microsoft Azure (AZ-104, AZ-900) · Tenable Nessus (6 courses) · Securing Windows Server 2016
Education
MSc — Artificial Intelligence, Machine and Deep Learning · LL.M. — Business and Law
02

Where I'm useful

I fit where security needs to be seen from both sides. Find the weaknesses, then design how to close them.

  • Penetration testing and red teaming. I probe applications, networks and Active Directory, show the real attacker path and write up what to do about it.
  • Secure infrastructure design. Network segmentation, server hardening, MikroTik, Windows Server, Hyper-V and Azure. I build environments that are hard to attack.
  • Vulnerability management. Regular scans, triage of findings, patch management and verification that remediation actually worked.
  • ISO 27001 and NIS2. Audits, policies, risk management, availability and continuity. I help get security right on paper too.
  • AI security. I map how AI is already used in the company, decide what should run locally and where the cloud makes sense, and keep an eye on the security and compliance of the whole solution.
  • Datacenter operations. For years I've kept a server room running, from hardware through backups to monitoring. I know what security looks like in daily operations.
03

How I work

Offense

I like to test by getting my hands on a system from the terminal. Recon, scanning, hitting the weak spot, verifying. Most of the work is done by nmap, nuclei, Burp Suite, Metasploit and a few of my own scripts. I keep Kali close, both under WSL2 and on a dedicated machine.

rt@kali:~/engagements
rt@kali:~/engagements 
rt@kali ~ % nmap -sV -sC 10.10.14.8
Starting Nmap 7.95 ( https://nmap.org )
Nmap scan report for 10.10.14.8
PORT     STATE SERVICE       VERSION
22/tcp   open  ssh           OpenSSH 9.6
80/tcp   open  http          nginx 1.24.0
445/tcp  open  microsoft-ds  Samba 4.19
3389/tcp open  ms-wbt-server Microsoft Terminal Services
Service detection performed. 4 hosts up.
rt@kali ~ %
pentest
  • nmap
  • nuclei
  • burp suite
  • metasploit
  • wireshark
  • bloodhound
  • hashcat
  • wsl2
  • kali

Governance, compliance and AI

The other half of the work is less visible but just as important. Vulnerability scans, findings mapped to ISO 27001 and NIS2, risk management. And increasingly locally hosted models, their link to the cloud and oversight of where the data flows.

rt@lab:~/ai-security
~/ai-security/audit/iso27001.md 
ID    FINDING                      ISO A.      NIS2   STATUS
F-01  weak TLS configuration       A.8.24      yes    open
F-02  no MFA on remote VPN access  A.8.5       yes    open
F-03  patch SLA exceeded on DC01   A.8.8       yes    remediated
F-04  insufficient audit logging   A.8.15      yes    open
F-05  no formal risk register      A.5.9       -      remediated

5 of 27 findings · mapped to ISO 27001 Annex A + NIS2
rt@lab ~ %
gov
  • iso 27001
  • nis2
  • risk management
  • hyper-v
  • windows server
  • azure
  • mikrotik
  • docker
  • ollama
  • open webui
  • mcp
04

Projects

Web application penetration test

Black-box and grey-box testing of a custom customer portal. From mapping and authentication to IDOR, injection and application logic flaws, with a report ranked by risk.

OWASP · Burp Suite · nuclei

Internal network penetration test

A view from inside the LAN. Recon, traffic sniffing, Active Directory attacks and lateral movement up to domain admin.

nmap · BloodHound · Metasploit

Red team simulation

A targeted-attacker scenario. Phishing as the entry point, quiet movement through the environment and a check of what detection and the team actually catch.

OSINT · C2 · MITRE ATT&CK

ISO 27001 / NIS2 audit and readiness

Gap analysis, risk management, policies and a statement of applicability. So the audit passes and security makes sense outside the IT department too.

ISO 27001 · NIS2 · risk management

Vulnerability management program

Setting up regular scanning, triage and remediation. Turning a one-off check into a continuous process with measurable progress.

Tenable Nessus · patch management

Secure local AI stack

Design and operation of models running inside the company, their connection to cloud models and oversight of data, access and compliance.

Ollama · Open WebUI · MCP · Docker

05

Contact

Consider this my business card. Looking at a penetration test, more secure infrastructure, ISO 27001 or NIS2, or thinking about how to adopt AI safely? Drop me a line, I'm happy to talk.

Email me LinkedIn