Defaults are a liability.
Hardened build images and Azure DevOps tooling for teams that get audited. Every release ships with the scan, the SBOM, and the signature.
ADO agent + GitHub runner
One image: Azure DevOps agent + GitHub Actions runner
Ubuntu 24.04
Weighted CIS L1 score
Windows Server 2025
Weighted CIS L1 score
The products.
Primed Hardened Runners
Drop-in build agents for Azure DevOps and GitHub Actions, hardened to the CIS Level 1 server profile and shipped with the evidence.
- Ubuntu 24.04 — released and signed
- Windows Server 2025 — in validation: 84.8% vs 37.6% stock (CIS WS2022 v3.0.0 L1 list as proxy)
- Ships with: signed evidence bundle, SPDX SBOM, raw scan output, deviation register
- 24 Tier-1 tools, version-pinned, checksum-verified
Primed Toolkit
Governance Azure DevOps doesn't ship. Branch-policy compliance across every project, mapped to the control it supports.
- Org-wide branch-policy audit — free
- CIS Supply Chain · NIST 800-171 · CMMC 2.0 L2 · SOC 2
- Service connections, DORA, pipeline stats — Pro
- Runs on ADO's own APIs, in your tenant
Custom tools.
Need DevOps tooling, automation, or a pipeline that doesn't exist yet? We build it the way we build products: written spec, fixed price, evidence attached.
hello@primed-systems.com →Every release passes the same gate.
Pinned toolchain → scan → misses published with reasons → a human signs → bundle signed keylessly and logged to Rekor. There is no unsigned path. AI writes the first draft of most of it; the gate doesn't care who wrote the code.
Who we are.
Eric Lobpries — Marine AAV commander, twenty years a firefighter-paramedic, over a decade running Azure and AWS.
Everything ships into your tenant — image, evidence, and verification against the public Rekor log, not against us. If Primed disappeared tomorrow, nothing you run would stop working.
Ownership
Veteran-owned small business
Partner
Member, Microsoft AI Cloud Partner Program
Data posture
Your tenant, your cloud, your keys
Engagement
Products and custom builds, by written spec
Get notified.
One email when a listing goes live. No cookies, no tracking, no sequence.
The runner image is shared straight to your Azure subscription; the Toolkit installs privately to your Azure DevOps organization. Marketplace listings follow.