A small firm with government-scale experience.
Exploits Bay Cyber Corp helps organizations adopt public cloud and AI-assisted engineering safely, with security and compliance built in from the start. We use Claude Code to build working tools and services, and we help clients build their own.
Jeff Barnes
Jeff has 30 years in enterprise IT. For nearly a decade he has secured AWS and Azure workloads for the Government of Canada. That includes the modernized Old Age Security and Employment Insurance platforms at ESDC, Shared Services Canada’s cloud services for federal departments, and the pipelines and controls that let those systems pass security assessment.
Exploits Bay grew out of that work. When CPCSC Level 1 was announced in 2026, Jeff built cpcsc-mcp so small suppliers could get to the evidence the way large departments do: from the live environment, not a spreadsheet.
The tools on this site were built with Claude Code, and so was the site itself. That hands-on experience is what we bring to clients adopting AI-assisted engineering.
His Master’s research project at Memorial University, Digital Transformation: From Digital by Design to Digital by Default (2016), proposed a framework for traditional organizations, including the Government of Canada, to adopt as-a-service platforms, APIs and automation. Read the paper (PDF, 67 pages, 1.9 MB).
He writes about the engineering behind the tools at jeffbarnes.ca.
Based in St. John’s, Newfoundland and Labrador. Working with clients across Canada, remotely or on site.
Where the experience comes from.
- 2021 – 2025
Employment and Social Development Canada
Senior Advisor, Benefits Delivery Modernization
- Security engineer for the programme’s technology platform, supporting the Azure rollouts of Old Age Security (R1.1 and R2) and the Employment Insurance Benefits Estimator, and contributing to Employment Insurance on AWS
- Vulnerability management, threat modelling and security monitoring
- DevSecOps pipelines with code scanning and remediation; OpenShift and Kubernetes; network security
- Applied the risk management framework to meet the required standards; deployed and supported Azure OpenAI applications
- 2012 – 2021
Shared Services Canada
Senior Advisor and Acting Director, Cloud Product Management and Services
- Helped Government of Canada departments with cloud strategy, migration and implementation
- Founded the directorate’s Cloud Centre of Excellence
- Supported container platforms such as OpenShift, plus networking, telecommunications and application virtualization
- Earlier
Fisheries and Oceans Canada
Networking and security
Why “Exploits Bay”?
It’s a play on words. In security, an exploit is the code or technique that takes advantage of a vulnerability, which is exactly what we help clients find and close. The Bay of Exploits is also home: a bay on Newfoundland’s northeast coast, where Jeff grew up.
The mark is Gebo, one of the oldest Norse runes. Its name means “gift”, and it is read as partnership, connection and balance: two parties giving equally. That’s how we like to work with clients. It’s also a nod to Newfoundland’s history: about a thousand years ago, Norse sailors landed at L’Anse aux Meadows on the island’s Great Northern Peninsula, the only confirmed Norse site in North America.
Four commitments.
Outcomes, not slide decks
Each engagement ends in something you can use: a signed self-assessment, a working pipeline, a documented landing zone.
Read-only by default
Our assessment tooling reads your configuration and never changes it. We ask for the least access that will get the job done.
Say what software can’t prove
Manual controls are marked manual. A partial pass rate is never presented as a clean one.
Small by design
We take on a limited number of engagements at a time, so the person you talk to is the person who does the work.
Let’s talk about your environment.
Tell us what you’re up against: a contract clause, an audit finding, or an AI rollout that has made security nervous. We’ll tell you honestly whether we can help.