About
Independent. Veteran-owned. North Carolina. Built so organizations know whether their security actually works.
The name
Resolve — not theater
The name draws from the resolve of John Paul Jones and the early American naval tradition: when the adversary is larger, preparation, discipline, ingenuity, and refusal to surrender the initiative matter more than appearances. The black flag represents resolve.
That history matters because many clients live in the same strategic reality. A small manufacturer, municipality, engineering firm, nonprofit, or local business will never outspend the largest technology companies or the adversaries targeting them. They do not need to. They need to understand their environment, use what they have intelligently, close the gaps that matter, and be prepared to respond when something goes wrong.
Who we are
Independent by design
We are not a managed-service company disguised as a security assessment firm. We are not a software reseller looking for a reason to sell another license. We are not interested in producing a hundred-page report that proves how much cybersecurity vocabulary we know.
Black Flag exists to understand the environment, find what matters, prove what can be proved, explain the risk clearly, and help the client become stronger. Founded around September 2026 as a North Carolina single-member L.L.C. Alan Lawley does the work himself — owner-led on every engagement.
Founder
Alan Lawley
Retired U.S. Navy Chief Information Systems Technician (ITC) and Information Systems Security Manager (ISSM), with a 20-year career in network operations, cyber defense, and incident response — followed by DoD SkillBridge and consulting at the Missouri Cybersecurity Center of Excellence (MCCoE).
The firm grew out of operational cybersecurity rather than a sales organization: leading people, building and defending networks, developing security operations, investigating incidents, writing procedures and playbooks, training personnel, and making security work under real constraints.
Experience
Selected proof — not a certification brochure
Certifications are not listed on this site by design. These are the operational highlights that lead.
- ONE-Net Site ISSM, NAS Sigonella Security for an installation serving 7,000+ U.S. and NATO personnel. Also led 24/7 SOC watch teams on station.
- ISSM for ~1,920 endpoints aboard USS America Shipboard security manager; led cyber teams of up to 55 personnel. Enterprise support for 6,000+ users across three installations during the Navy career.
- Directed response to 145 cybersecurity incidents Zero confirmed data compromise. Authored 20+ threat-hunting / IR playbooks and 33 cybersecurity policies and procedures.
- Built a Tier 2 SOC from the ground up Coverage for roughly 1,000 endpoints at the Missouri Cybersecurity Center of Excellence; mentored 48 cybersecurity apprentices.
- Completed six RMF accreditation packages Including authorization work for classified enterprise networks under NIST SP 800-53.
- Assessments for municipal, educational, and critical-infrastructure organizations Delivered through MCCoE, aligned to NIST CSF and related frameworks.
How we hold ourselves
Understand before prescribing
Verify before concluding. Explain before alarming. Fix what matters. Validate the fix. Bring in specialized expertise when the mission requires it — including a qualified third party for independent adversarial validation after Black Flag has materially designed or remediated defenses, rather than grading our own homework.
Based in Morrisville, NC (Research Triangle). Service area: Research Triangle, the Southeast, and multi-state — on-site and remote.
Ready for a straight conversation?
Reach out with context on your organization and what you are trying to accomplish.