Our first plan didn’t work.
Neither did our second.
The third one worked...
right up until the month we were ready to launch.

 It started in a controls shop in Japan

​​

In 2020, four U.S. Air Force HVAC technicians, Raziel Toro, Frankie Galambos, Isaiah Green-Cardwell and Aaron Ferraro, ended up in the same shop at Misawa Air Base, Japan. Our squadron’s Industrial Controls Shop wasn’t glamorous. We kept the systems that heat, cool and power a base running, and we kept them secure. Nobody notices that kind of work until something breaks.

​​​​​​​​​​​​​​​​​​

During the long pandemic months of 2021, our conversations kept drifting to cybersecurity. The more we learned, the more we saw where the industry was falling short, and the more we wanted to help fix it. One of those “what if we started our own thing?” talks stuck.

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​​

​​

​​

Life got in the way, but the idea didn’t go anywhere

​​

By 2023, all four of us had left the military and scattered to different parts of the world to start civilian life. The idea stayed with us. In March 2025, we stopped talking about it and started building it.

​

​

​

Then came the detours

​

​

Our first plan was government contracting. After months of brainstorming and real money invested, we had to face the numbers: the startup capital was far more than a four-person company could carry. We scrapped it.

​

So we changed direction and set out to become a C3PAO, an authorized assessor for the Cybersecurity Maturity Model Certification (CMMC). It’s a demanding path, and for over a year it had our full attention.

​

In July 2026, while we were deep in our final preparations, the Pentagon paused the requirement for third-party CMMC Level 2 assessments. In September, the same month we passed our DIBCAC assessment, the pause was made official. Defense contractors could now self-assess at Level 2 instead of hiring a C3PAO.

​

Just like that, the work that C3PAOs, Lead CCAs and CCAs had trained for was sidelined. That included the service we had built the company around.

​

​

​

Back to where it all began

​​

We gave ourselves a moment to be frustrated. Then we got back to work.

​

When we asked ourselves what we really wanted to do, the answer was the same one we’d had in that shop in Misawa: protect the systems people depend on. We meant real, hands-on security, not just checking compliance boxes. That’s what Aether Security does today. We offer consulting for FedRAMP, privacy and data protection, and cloud environments like GCC High and AWS. We also provide Risk Management Framework (RMF) support, vulnerability management, and implementation support to put it all into practice. We’ve been through a DIBCAC assessment ourselves, so we know exactly what assessors look for, and we stay with you until the controls actually work.​​​

 

 

 

​Why this matters to you

​

We could tell you we’re resilient, but you’ve just read the proof. Three plans, two dead ends and one sudden policy change later, the four of us are still at the same table.

​

Here’s what that means for you:

​

• We’ll tell you the truth, even when it’s not what you want to hear. We’ve had to hear plenty of it ourselves.

• We adapt. Threats change and rules change. We’ve been through both.

• We’re in it for the long haul. We didn’t stick together through all of this to cut corners now.

• We think like operators. We came up keeping real systems running, so we focus on what actually happens when something fails.

​

We didn’t build Aether Security because it was easy. We built it because we love this work and because we get to do it together.
 

​​

​

Let’s talk about how we can help protect what you’ve built.

​

​

​

— Raziel, Frankie, Isaiah & Aaron

     Founders