By day, I run UBIK, the training organisation of Forward Cyber: more than 2,000 people trained. I also co-founded Continus.io, a DevSecOps platform, in 2020, with my partner Tarik El Aouadi.
By night, I build Nakama (“comrades”, in Japanese): a one-person company where everything else is done by AI agents. It develops, runs its website, keeps watch, answers its support, prospects, invoices. It is not a demo, it is my company. And I do need to sleep.
It runs on our own engine, NakamaOS: agent roles by function, dashboards, integrations, and one rule: understand a process before putting an agent on it. Every building block runs Nakama first, before it is offered to anyone.
Security comes included, because fifteen years of offensive work taught me that an agent is an employee at risk: minimum access, review, a log, a local model for sensitive data, a human who approves.
What I sell: your version of this set-up. NakamaOS first, ready to use; then, after an audit of your processes, custom agents in your company: as SaaS, in your cloud or on premises.
The proof: NakamaCyber, a cybersecurity SaaS developed and run by these agents, on my original subject. A growing share of code is written by AI agents, and knowing how to review it has become developers’ new job: NakamaCyber measures this skill on real code, family by family of the OWASP Top 10 2025, and proves it with a report containing no personal data, mapped to PCI DSS, DORA, NIS2 and ISO 27001. Free for up to ten developers.
Everything is built in public: what I hand over to the agents each month, what worked, what broke, what I took back myself. Here, on the blog. And in the Nakama podcast, my band of cyber and AI comrades, debating without a filter.
Why few clients at a time
Nakama will remain a one-person company: no hiring, no disguised subcontracting. So I take on few clients at a time and install one after the other: that is what makes it possible to check every installation, every month.
The rule
We only install in your company what has run at Nakama for at least two months, on a version that has run there for at least two weeks. Every month, the same version is checked, the tests replayed, the configuration reviewed.