About · Kevin Kulik
I find out what’s technically wrong.
I’m Kevin Kulik, the one person behind Contegus. German businesses hand me their technical side. For US clients I have owned websites, infrastructure, and security questions since 2021, including healthcare systems. The eye behind both is the same.
I started in security, not web design.
That sounds like high security. In practice it mostly means: I notice when something is not right. Most of the day-to-day work is deliberately unspectacular, and that is how it should be.
I’ve been active in the infosec community since 2012: reverse engineering, malware analysis, and security research, including a public decryptor for the Cerber ransomware in 2016. When I found vulnerabilities, I reported them responsibly. In 2016 that meant writing to a local bank whose online banking allowed five-character PINs, with the brute-force math and concrete fixes included.
Web development became the business later. The security thinking never left, and by now most of my work has circled back to it: technical reviews, vendor implementation, and taking over builds nobody fully understands anymore.
Privacy is my default setting, not an add-on; European law leaves little choice there. I take the same discipline into US healthcare work. Different laws, same rule: don’t trust the label, check the implementation. None of it replaces legal advice, certification, or a formal HIPAA audit.
That habit is where the results come from. Working with a US telehealth provider, I found and documented a critical third-party vulnerability (CVSS 10.0) before patient data was affected, and flagged patient records a vendor had left exposed. I have held ongoing technical responsibility for the agreed systems since 2021. The dangerous findings were on systems I was asked to look at. That difference is the job. It does not mean you need a security problem to be in the right place here: most of the work is a website that runs, mail that arrives, and access that is sorted.
Some of the work is public: the healthcare platform Kindbridge, supported since 2021, the performance rescue at Wheat Free Mom, and Crystal Coast Pressure Wash, built and cared for since fall 2025. You can check these and more in the selected projects. Confidential system details and patient data do not belong in a public proof. My professional history is on LinkedIn.
You’re talking to the person who’s also technically responsible.
If access, security, or risk needs to be sorted first, I’ll say so. If a rebuild is the honest answer, I’ll say that too.
- Role
- The technical side: websites, infrastructure, security, and operations
- How I work
- A direct fit check, not a sales call
- Based in
- Germany · working with US clients since 2021
Next step
You don’t need to name the problem before we first talk.
Tell me what is unclear right now and who handled it before. I will tell you whether a brief fit check is enough or whether a scoped, paid technical investigation should come first.