Skip to main content
How Can We Help?Contact

AI Security & Cyber Risk

AI opened doors your security program was never asked to watch. We find them, rank them and close them.

Models, data, agents, tools and vendors, brought inside the security program you already run.

Talk through your AI exposure See how we rank it

The people who scope it are the senior people who do the assessment.

What security covers, and what AI addsIllustrative

AreaTraditional focusAI exposure to check
ModelsApplications and infrastructurePrompt injection, model misuse
DataClassification and protectionSensitive data in prompts, logs and retrieval
Identity and accessLeast privilege for peopleAgents and tools holding standing credentials
VendorsReview and contractData-use, retention and training terms for models
DetectionSystems and users monitoredNo signal for model or agent behavior
Nothing here means your controls failed. They were written before these existed.

The attack surface

One AI system. Eight places it can be reached.

A request crosses eight boundaries between the person who asks and the action that follows. Each is somewhere an AI system can be attacked, or can leak. We check all eight.

An AI system, boundary by boundaryWhat we check

  1. UserShadow AIWhat is running, sanctioned or not
  2. PromptPrompt injection, direct and indirectInputs, documents and web content tested
  3. ModelModel and vendor supply chainOrigin, terms and updates checked
  4. Retrieval and dataRetrieval that reaches too muchWhat each user and agent can retrieve
  5. Memory and logsSensitive data retainedRedaction and retention limits
  6. Tools and MCPExcessive agencyTool permissions held to the task
  7. IdentityStanding credentials, exposed secretsScoped, expiring access for agents
  8. External actionUnsafe output, irreversible actionsOutput validated, approval at your threshold
Your existing program already guards the systems on either side. These are the boundaries in between.

What we do

Six lines of work, one security program.

  • AI discovery and risk assessment

    An inventory of the AI you are actually running, sanctioned or not, with every exposure ranked by consequence.

  • Adversarial testing and red-teaming

    Direct and indirect prompt injection, data leakage, unsafe output handling and misuse, tested against live assistants and agents, then retested after each fix and each model change.

  • Data, retrieval and privacy protection

    What may enter a prompt, what retrieval can reach, what is logged and retained, and the loss-prevention and encryption that enforce it.

  • Identity, tools and agent permissions

    Scoped, expiring credentials for anything that acts on its own, tool and MCP permissions held to the task, secrets kept out of prompts and code, and an owner for every agent.

  • Model and vendor supply chain

    Where each model, dataset and dependency came from, and the data-use, retention, training, residency and subprocessor terms behind every third-party model.

  • Governance, monitoring and response

    Controls, owners and evidence aligned to recognized frameworks, a secure AI development lifecycle, runtime monitoring, and incident runbooks written for AI.

Why it gets missed

AI arrived faster than the review did.

  1. Adopted before it was reviewed

    Assistants and copilots switched on by teams, outside the usual intake.

  2. New ways to fail

    A model can be talked into things. Your questionnaire never asked about that.

  3. Software that acts

    An agent with credentials is a new kind of user, and nobody owns its access.

How we are different

Find it. Rank it by consequence. Close it.

A list of findings is not a security posture. Every exposure gets a severity, an owner and a closure path, in the order that reduces the most risk first.

  1. Find

    Inventory what is running, sanctioned or not, and test it.

  2. Rank

    Order by what happens if it goes wrong, not by how it was found.

  3. Close

    A named owner and a fix for each, then a retest.

Exposure registerIllustrative

ExposureSeverityOwnerClosure path
Customer assistant open to indirect prompt injectionOWASP: Prompt injectionSevereHead of digitalInput and retrieval controls, then adversarial retest
Vendor model with unclear data-use and retention termsOWASP: Supply chainSevereProcurementData-use, retention and training addendum
Agent holding standing credentialsOWASP: Excessive agencyMaterialIdentity leadScoped, expiring access
Personal data kept in prompt logsOWASP: Sensitive information disclosureMaterialData protectionRedaction and a retention limit
Copilot rollout never reviewedNIST AI RMF: GovernContainedIT securityReview, then standard intake
Each finding is tied to its OWASP GenAI risk and, where one applies, its MITRE ATLAS technique. Severity is a business-consequence rating. Severe: harm to customers, regulated data or money is plausible now. Material: a real exposure that needs a planned fix. Contained: limited reach, closed through your normal process. Each maps onto your own critical, high, medium and low scale.

Find, rank and close follows our Data IQ™ methodology: diagnosis first, then the work, then handover to the people who own it.

Engineering proof · Data protection

The security engineering underneath AI security.

  • 98%of events validated on the first attempt
  • 42%fewer manual “is this real?” checks
  • <5 saverage verification

Government · A US state government

Tamper-evident verification of pandemic health events.

Approved issuers only, proofs rather than records stored, and every write time-stamped and auditable. This is data-protection engineering: access control, data minimization and an audit trail. AI security is built on the same three.

Read the case study

What you hold at the end of an engagement:

  • An AI inventory: every assistant, agent and model in use, with its owner
  • A ranked exposure register: severity, owner and closure path for each
  • An agent and tool access matrix: what each one can read, change and send
  • Adversarial test findings: what was tried, what worked, and the retest
  • A control mapping: each control tied to the frameworks you report against

Agent access matrixIllustrative

AgentCustomer recordsBillingEmailOwner
Customer assistantReadNoneNoneHead of digital
Collections agentReadWrite, with approvalSend, with approvalFinance operations
IT helpdesk agentNoneNoneSendIT service desk
Every agent has an owner, the narrowest access that does the job, and credentials that expire.

Not sure what you are running? Thirty minutes will tell you where to look first.

Ask where you are exposed

Standards

The frameworks your auditors and your engineers already use.

Governance and management

  • NIST AI RMF and its Generative AI Profile, for how AI risk is governed, mapped, measured and managed
  • NIST Cybersecurity Framework 2.0 for placing AI risk inside enterprise cyber risk
  • ISO/IEC 27001 for the controls and the management system around them
  • SOC 2 readiness where customers ask for it

Application and adversarial security

  • OWASP GenAI Security Project: the Top 10 for LLM Applications and the Top 10 for Agentic Applications, as the test checklist, with every finding tied to its entry
  • MITRE ATLAS for the tactics and techniques adversaries use against AI systems, with findings tied to the matching technique
  • Your own policies as the starting point, extended rather than replaced

We build the controls and the evidence. We do not certify, and we do not offer legal advice.

Want a first read? A free 15-question screen across five areas, about six minutes, no email required.

How to engage

Discover, secure, assure. Start with what you are actually running.

Discover · Need to know your exposure?

Cyber Risk Sprint

The AI you are running, inventoried and scored against NIST AI RMF and ISO/IEC 27001. Two to four weeks. Fixed scope. Fixed fee agreed in writing first.

  • An inventory of the AI estate
  • Every exposure ranked by consequence
  • A closure path for each
  • Handed to your existing program
Sprint details

Secure · The main engagement

AI Security Program

The exposures closed, and AI brought inside the program you already run.

Starts with
A ranked exposure register, from the Sprint or built first
Proceeds when
Each exposure has an owner and a closure path
Ends with
Controls in place, retested, handed to your program
  • Controls for models, data, agent access and vendors
  • Adversarial testing of live assistants and agents
  • Monitoring and incident runbooks for AI
  • Evidence structured for auditor and customer review
  • A team that can run and extend it without us
Scope an AI security program

Assure · Need it to stay secure as AI changes?

AI security assurance

After the program: security that keeps pace as models, prompts, tools and vendors change.

  • Retesting triggered by each material change
  • Agent and tool access reviews
  • Intake for new models and vendors
  • Monitoring tuned to model and agent behavior
Ask about ongoing assurance

Also: AI for cyber defense. Too many alerts, too few analysts? We apply machine learning to your own security telemetry: detection models, alerts ranked with the reason shown, and threat-hunting support. A different question from securing AI, answered by the same team.

Ask about threat analytics

How we work. Every engagement follows our Data IQ™ methodology, from diagnosis through implementation and handover. See how we work

Before you commit

Questions we get every week.

Does this replace our security team or our existing tools?

No. Your program stays as it is. We add what it was never asked to cover, and hand each finding to the owner who would normally close it.

How is AI red-teaming different from a penetration test?

A penetration test looks for ways into a system. AI red-teaming looks for ways to make a model misbehave once you are legitimately talking to it: leaking data, ignoring its instructions, or taking an action it should not. You usually need both.

We do not use much AI yet. Is this premature?

Usually the opposite. Most organizations are running more AI than their security team has reviewed, because it arrives inside tools people already had. The inventory is often the most useful finding.

Which frameworks do you work to?

NIST AI RMF, the NIST Cybersecurity Framework and ISO/IEC 27001 for governance, the OWASP GenAI Security Project and MITRE ATLAS for testing, SOC 2 readiness where customers require it, and your own policies as the starting point. Sector obligations are mapped in where they apply to you.

Do you run a security operations center or do penetration testing?

No. We do not run a security operations center or a managed detection service, and we are not a general penetration-testing firm. We secure AI and the data around it, and work alongside the teams and firms that do the rest.

Do you certify us?

No. We build the controls and assemble the evidence an auditor will ask for. Certification is done by an accredited body, and we do not offer legal advice.

How do you handle agents that act on their own?

As a new kind of user. Each one gets an owner, the narrowest access that lets it do its job, credentials that expire, and a log of what it did. Irreversible or high-consequence actions require a human approval, at a threshold you set.

The people who scope it are the people who do it

Tell us what AI you are running. We’ll tell you where to look first.

Thirty minutes with the senior people who would do the assessment. If your program already covers it, we’ll say so.

Schedule an exposure review

Go deeper.

Security is one part of deciding whether AI can proceed.

Running AI your security review never saw? Thirty minutes with the people who would assess it.

Book an exposure review