01
Pre-Compromise Focus
Detection after the fact is damage control. We instrument for visibility before incidents occur, because finding the adversary during their reconnaissance phase is the only win that matters.
Who We Are
Built for defenders who need true north
NorthQuinn was founded on the reality that most organizations are compromised long before they know it. We exist to change that equation.
Incorporated · Delaware, 2026
Our Mission
The adversary is already inside most networks
Across Mandiant’s 2025 investigations, attackers went undetected for a median of 14 days, and a median hides the long tail of intrusions built to stay quiet far longer. By the time most organizations detect a breach, the attacker has mapped the environment, established persistence, and exfiltrated what they came for. NorthQuinn was built to break that pattern.
We combine autonomous threat detection technology with deep operational expertise to give defenders the visibility they have always needed but rarely had. Our flagship platform, AVERY, was designed from first principles around the assumption that advanced actors are already present, and that the goal is finding them before they find what they are looking for.
APT
Focused Threat Detection
13+
Years in Security & Infrastructure
Open
Source Defensive Stack
Zero
Vendor Lock-In
What We Stand For
The principles that drive every engagement
02
Signal Over Volume
Alert fatigue kills SOC effectiveness. Every detection capability we build is engineered to surface actionable intelligence, not generate noise your team has to filter through at 2 AM.
03
Operational Transparency
We explain every detection, every tuning decision, and every recommendation in plain language. Your security program should not be a black box, even when the technology inside it is sophisticated.
04
Architecture That Holds
Security stacks built on shortcuts fail under pressure. We build for adversarial conditions from day one, every integration, every rule, every deployment decision made with real attack scenarios in mind.
05
Intelligence-Driven Defense
TTPs change. Threat actors adapt. A static ruleset is a liability. We operationalize live threat intelligence so your defenses evolve with the threat landscape, not six months behind it.
06
Principal Accountability
NorthQuinn is principal-led. Every engagement is owned at the highest level of the firm, with direct accountability to the client from start to finish.
Leadership
The operator behind every engagement
Founder & CEO
Angel Gonzalez Gines
Founded by Angel Gonzalez Gines, Founder & CEO.
Angel Gonzalez Gines is the founder and CEO of NorthQuinn and the architect of AVERY, a behavioral threat intelligence platform for federal, IC, and defense teams. He brings over thirteen years of experience across cybersecurity, IT infrastructure, and financial services, operating across enterprise and government environments in the United States before founding NorthQuinn.
His technical background spans the full defensive stack, from network monitoring and endpoint detection to threat intelligence integration and SOC architecture. AVERY, the autonomous detection platform he designed, reflects years of thinking about what pre-compromise visibility actually requires at the architecture level.
APT Detection
Network Forensics
SOC Architecture
Threat Intelligence
Autonomous Detection
vCISO
Our Story
From observation to architecture
NorthQuinn did not start with a pitch deck. It started with a pattern recognition problem, watching organizations get compromised by actors who had been inside their networks for months, operating undetected because the detection capabilities those organizations had were never designed for the adversary they were actually facing.
AVERY started as an architecture document in 2024, built around a set of non-negotiables: pre-compromise focus, intelligence integration, and high-fidelity detection over alert volume. Everything since then has been building toward the platform those principles required.
2024
AVERY Architecture Document
The original architecture document establishes the philosophical and technical foundation: intelligence platform, pre-compromise focus, adversary-centric design. Non-negotiables locked before any stack decisions.
2025
Stack Selection and Platform Build
The defensive stack is finalized around modern open-source tooling. AVERY's detection architecture is locked and initial instrumentation begins. Components move from design to active build.
2026
NorthQuinn Inc. Incorporated
NorthQuinn is formally incorporated as a Delaware C Corporation, with the legal structure in place to serve government, IC, and enterprise clients. Public open-source tooling launches on GitHub.
Now
AVERY in Active Development
The detection engine and enrichment pipeline are in active development. NorthQuinn is accepting its first strategic partnerships and client engagements.
Research
Published methods, working tools, stated limits
NorthQuinn publishes the research behind its detection approach, the open-source tools that implement parts of it, and the measured limits of both. Every paper goes through responsible disclosure before release and says plainly where its method does not work.
- NQ-DER-2026-001. Beacon detection without a SIEM: multi-signal correlation as a basis for low-false-positive command-and-control identification. PDF
- NQ-MTF-2026-001. Reconstructing telephony faults from the Android radio log under an adversarial input model. PDF
- Open-source tooling. Released with tests and documentation that states what each tool does not do.
Build With Us
We’re looking for the first people to build AVERY with
NorthQuinn is an early-stage company with a working thesis, published research, and a platform in development. We’re looking for a small number of experienced people who want to own a hard part of it from the beginning.
The problems worth your time
- Detecting patient command-and-control and credential misuse from behavior alone, without writing rules for each environment.
- Keeping false positives bounded as the number of signals grows, and proving it on data we didn’t generate.
- Knowing which side of a conversation is the monitored network, and scoring accordingly.
- Covert channels that hide inside protocols every network must allow, starting with DNS.
- Evaluating detection honestly: public labeled datasets, held-out validation, and stated limits.
Who we hope to hear from
- Detection engineers and threat hunters who have worked with network or host telemetry at scale.
- Data and research engineers comfortable with time series, baselining, and evaluation design.
- Software and platform engineers who want to build a data pipeline that is secure by design.
- Operators with experience serving federal, intelligence-community, or defense organizations.
What matters more than titles: you have shipped something that worked under real conditions, you would rather measure than assert, and you are comfortable with ambiguity.
What joining this early means
The work is real and so are the unknowns. Responsibilities are broad, structure is light, and much of what exists will be shaped by the first people who join. Roles, commitment, and terms are worked out directly with the people who fit, not through a job listing.
How to start the conversation
Write to info@northquinn.com or use the contact form and choose “Founding Team.” Tell us what you have built, which problem above you would want to own, and link to work we can look at: code, writing, or research.
Researchers interested in collaborating on these questions can choose “Research Collaboration.”
Ready to find true north?
Whether you need a platform demonstration, an incident response, or a full SOC buildout, it starts with a conversation.
Get In Touch