Consultation · Bandung, Indonesia · Remote worldwide

I build AI automation that survives contact with real data

Most AI projects die about three months in, when the demo meets real volume, messy inputs and edge cases nobody scoped. I spent three years writing embedded operating systems for national ID smartcards, then five years at Pusan National University taking a master’s in hardware security and a PhD in AI and cybersecurity. Preventing that failure is the part I am actually good at.

Book a 30-minute call See the call agenda first

Free · 30 minutes · written fixed-price scope within 24 hours · English or Bahasa Indonesia

3 yrsCustom and embedded OS for national ID smartcards at IDEMIA, 2016–2019

PhDAI and cybersecurity, Pusan National University, 2020–2025

5 papersPeer-reviewed security research, including Sensors and IEEE SecDev

1 personYou talk to the engineer who writes the code

What I take on

Internal agents and retrieval over your own documents

Answering questions from your contracts, tickets, manuals or research, with citations back to the source instead of confident guesses.

Screening and document pipelines

Sorting CVs, invoices, forms or reports at volume. This is what Talens AI already does, so you are not paying me to learn it.

Self-hosted model deployment

Open models on your own GPU or your own cloud tenancy using Docker and vLLM. Your data never leaves your infrastructure and you are not paying per seat forever.

Integrations between systems that refuse to talk

The spreadsheet, the CRM, the legacy tool with no real API. I have written enough low-level code that “there is no API” is not the end of the conversation.

Security review of AI, IoT and embedded systems

Finding where your model, firmware or device leaks more than you think it does.

How I work

Every build has the same shape: ingest, process, output, with instrumentation on all three. Logs, error alerts, retries and deduplication are part of the job rather than an upsell, because a pipeline you cannot debug at 2am is not finished.

Fixed price, agreed before I start. No hourly billing and no overages.

Thirty days of bug fixes included after go-live, then an optional monthly plan if you want ongoing tweaks and monitoring.

Plain-language documentation so you can make small changes without me.

Probably not a fit if

You want a chatbot widget bolted onto a marketing site.
You need it live next week.
You cannot share a sample of the real data, even redacted. I cannot scope honestly against a description.
You want someone to resell you off-the-shelf software with a markup on top.

What happens on the call

Thirty minutes. Here is the whole agenda, so you know exactly what you are walking into.

First five minutesWhat made you book, and what you want to be true in six months.
The next fifteenI map your process end to end and look for where time and money leak out of it. I will ask what the bottleneck costs you right now, in hours per week or rupiah per month. A rough estimate is fine, and bringing one makes the call far more useful.
The last tenIf I can help, I describe the system I would build in plain language and give you a price band there and then. If I cannot help, I will say so on the call and point you toward something better.

Within 24 hours you get a written fixed-price scope with milestones. No slide deck, no follow-up sequence, no drip emails.

Who you would be working with

I am Derry Pratama. Before the PhD I was at IDEMIA for three years as a custom and embedded operating system developer. My research covers AI security, language models, RISC-V memory safety, IoT and cryptography, and since August 2025 I have been leading AI research at SmartM2M.

Practically, that means this is not an agency with juniors doing the work behind a senior name. You can read what I write on the DerryLab blog and see what I have shipped on the projects page.

Work you can check

None of this is client work hidden behind an NDA, so you can go and read it yourself instead of trusting a testimonial. That is why it is the proof I lead with.

SmartX — on-premise AI penetration testing platform

Since August 2025 I have led AI research at SmartM2M, building an LLM agent that runs security testing end to end on the customer’s own hardware. Supervised fine-tuning, retrieval and reinforcement learning, nothing leaving the building. I lead the engineering team on it, which is where most of my thinking about running models in-house comes from.

CIPHER — a small model that beats models ten times its size

A penetration testing language model fine-tuned on a structured corpus of write-ups I built specifically for the task. It outperforms models roughly ten times larger on Insane-difficulty HackTheBox machines. Published in Sensors in 2024 with the code public. Paper · Code. The transferable lesson: a well-targeted small model on your own hardware usually beats renting a giant one.

FARR and ASPIRE — evaluation instead of vibes

FARR compresses an entire vulnerable environment into dense, reusable data across more than ninety-six evaluation combinations. ASPIRE is the automated evaluation framework built on top of it, cutting evaluation time by up to roughly ninety-four percent. This is the machinery I use to show an automation actually works before it is allowed near your real data.

Taking over a DJI drone in mid-flight

I reverse engineered the Wi-Fi control protocol and achieved full control hijacking with a passive man-in-the-middle attack, on a drone that was airborne at the time. Presented at IEEE SecDev 2024, with a public demo and code. Relevant if you are putting AI anywhere near a connected device.

Cryptography inside OpenSSL, wolfSSL, mbedTLS and GnuTLS

During my master’s I integrated custom ARIA, LEA and HMAC hardware modules into all four libraries, built 4K encrypted video streaming for UAV links, and wrote MECHA, a multithreaded hardware crypto API that runs 82.8 percent faster than the context-switching design it replaced.

RISC-V memory safety under one percent overhead

COMET, a configurable tagged-memory extension implemented by modifying LLVM and GCC, at 0.4 percent overhead. RIMI, instruction-level memory isolation for embedded systems, at 0.88 percent, published at IEEE TrustCom. Years of counting single-digit percentages is why I care what your pipeline costs to run, not just whether it demos well.

Three years shipping secure operating systems at IDEMIA

Jakarta, 2016 to 2019. Custom operating systems for smartcards and national identity authentication, personalisation security and tamper resistance, on millions of issued identity tokens, coordinating with R&D in France. In that job there was no version of shipping something that mostly works.

EFFIRO and EBARO — competition robotics

Lead robotics engineer for the EEPIS team at ITS Surabaya, 2011 to 2015. I wrote the navigation and flame-finding algorithm behind EFFIRO, a three-time champion at the Trinity College international firefighting robot contest, and built EBARO, a balancing robot that climbs inclines carrying more than its own weight.

Products of mine that are live right now

Talens AI for document and CV screening at volume, Shaikh AI for realtime voice recitation checking grounded in referenced sources, and KajianNow, a live map of study sessions across Indonesia. These are my own products rather than client work, which is exactly why I can show you the inside of them.

What I actually work with

Models and training. LLaMA, Qwen, Mistral, Gemma, GPT-OSS, Gemini and Claude. Supervised fine-tuning and DPO with TRL and Axolotl, LoRA and QLoRA, GGUF quantization, model merging and inference benchmarking.
Serving and agents. vLLM, HuggingFace TGI and SGLang for low-latency multi-user inference. LangChain and LangGraph for agents, with retrieval pipelines over your own documents.
Multimodal. Whisper for speech to text, ElevenLabs for voice, Qwen-VL and Pixtral for documents and images, ComfyUI for generation pipelines.
Backend and infrastructure. Python, C and C++, Go, JavaScript and Flutter. FastAPI, Flask and Node.js. Docker, Nginx, PostgreSQL and Supabase. Single sign-on with Authentik or Keycloak when access control matters.
Hardware and embedded. STM32, ESP32, RISC-V, ROS, OpenCV and HackRF, plus CAN bus and ECU firmware on the automotive side.

Full CV, code and publication list: github.com/ibndias · Google Scholar

Questions people ask

Will our data leave our infrastructure?

Not if you do not want it to. Self-hosting open models on your own hardware or cloud tenancy is a normal request, and one I have already done for my own products.

Do you have client case studies?

Not published yet, and I would rather say that than invent numbers. What I can point you at is work you can verify without taking my word for it: peer-reviewed research with the code published next to it, and my own systems running in production. It is all listed under Work you can check above, and I will walk you through the architecture of any of it on the call.

Do you work with clients outside Indonesia?

Yes. I am based in Bandung on GMT+7 and most work is remote. Early in your morning or late in mine is usually workable.

Fixed price or hourly?

Fixed price, quoted before anything starts, with no overages. You will know the number before you commit.

Can you work with our existing stack?

Usually. Tell me what you run and I will give you an honest answer on the call rather than after an invoice.

What if I only have questions and no project yet?

Book anyway. Thirty minutes of straight answers is worth more to both of us than a proposal for something you do not need.

What language do we talk in?

English or Bahasa Indonesia, whichever you prefer.

Book the call

Pick a time over WhatsApp, or email me and I will send some options.

Message me on WhatsApp Email derryprata@gmail.com