Our approach
Map. Attack. Harden. Watch.
A simple loop that fits how software is built today: in small releases, increasingly written by AI, running on models and prompts that keep changing.
- 01
Map
Inventory your AI systems, AI-built apps, code, cloud and exposed services. We record the data each one touches, the tools it can call and where the trust boundaries sit.
- 02
Attack
Test your real deployment with the techniques adversaries use today, including AI-assisted discovery that works at machine speed. Every finding is verified by a person.
- 03
Harden
Fix issues with your engineers and leave behind guardrails, policies and patterns that keep the next release secure, whether it was written by a person or an AI.
- 04
Watch
Monitor prompts, agent actions and vulnerabilities in production, and retest as models, code and regulations change.
AI on both sides
We use AI to find problems. People decide what is real.
Attackers now work at machine speed, so defence has to as well. We use AI where it helps and keep experienced people in charge of every conclusion.
- Machine-speed discovery
- AI helps us review large codebases, chain findings into attack paths and triage thousands of results quickly.
- Human verification
- A security specialist confirms every finding before it reaches you. No unverified scanner output, no AI guesswork in reports.
- Your data stays yours
- We agree how code and data are handled before we start, use approved models only, and never let your data train anyone’s model.
Open-source first
Strong security without a large licence bill.
Mature open-source tools cover much of what most companies need. We deploy and tune them for you, so your budget goes on fixing issues rather than on licences.
When we recommend upgrading
- You need vendor support with contractual response times
- Scale or performance outgrows what the open-source tool handles well
- Auditors or customers require a specific certified product
- Consolidating many tools into one platform saves more than it costs
When an upgrade makes sense, our Security Tool Advisory tests the commercial options in your environment. We take no referral fees from vendors.
Examples from our toolset
| Area | Open-source tools |
|---|---|
| Code analysis |
|
| Secrets |
|
| Dependencies and SBOM |
|
| Containers and IaC |
|
| Web and API testing |
|
| Cloud posture |
|
| Vulnerability management |
|
| LLM and agent testing |
|
| Model scanning |
|
| Detection and runtime |
|
Tool names are the property of their respective projects. We choose tools per engagement; this list is illustrative.
Ways to work with us
Start small, or run it continuously.
Fixed-scope review
A defined assessment with a fixed price and timeline, such as an AI-built app launch review or an AI red team of one system.
Project
A larger engagement with clear milestones: an AI code assurance pipeline, a compliance programme or a tool selection.
Continuous
A monthly service for vulnerability management, AI runtime monitoring and ongoing retesting.
Advisory
Senior guidance on demand for security leaders, founders and boards making AI and tooling decisions.
How we handle your data
Confidential by default.
- Mutual NDA before you share anything sensitive.
- Least-privilege, time-limited access that you can revoke at any time.
- Code and findings are encrypted in transit and at rest, and deleted at the end of the engagement unless you ask us to keep them.
- Findings are shared only with the people you name.
Shipping AI this quarter? Make sure it holds up.
Tell us what you are building. We will come back with a short, honest view of where the risk is and what it would take to test it.