Skip to content
Mirawyn

Secure your AI

AI Supply Chain Security

Assurance for the models, datasets, libraries and AI vendors your products depend on.

Why it matters

Open-weight models, fine-tuning datasets and AI APIs arrive with risks of their own: unsafe serialisation formats, poisoned data, unclear licensing and vendors with access to sensitive prompts.

Mapped to

  • OWASP Top 10 for LLM Applications
  • NIST AI RMF
  • SLSA

What we cover

  • Model provenance and integrity checks
  • Unsafe model formats and loading paths (for example, pickle-based files)
  • Training and fine-tuning data poisoning risk
  • AI bill of materials (AI-BOM) for models, datasets and dependencies
  • Third-party AI vendor and API security assessments
  • Data retention and training-use terms for AI providers

How an engagement runs

  1. 01

    Inventory

    Find every model, dataset, AI library and AI vendor in use.

  2. 02

    Assess

    Evaluate provenance, integrity, licensing and vendor controls.

  3. 03

    Control

    Define approved sources, scanning and onboarding gates.

  4. 04

    Monitor

    Track changes to models and vendors over time.

What you receive

Clear outputs your engineers, leadership and auditors can each use.

  • AI bill of materials for your products
  • Vendor and model risk assessments
  • Approved-source and model intake policy
  • Pipeline controls for scanning and verifying artefacts

Open-source first

We start with proven open-source tools to keep costs down, and recommend commercial options only when they add real value. How we choose

  • ModelScan
  • Syft
  • Grype
  • OSV-Scanner
  • Sigstore

Related services

AI Red Teaming

We attack your LLM apps, copilots and agents the way a real adversary would, then hand you reproducible findings.

Learn more

LLM Application Security

Architecture and code review for RAG apps, chatbots and copilots, so security is designed in rather than bolted on.

Learn more

Agent and MCP Security

Least privilege, sandboxing and human checkpoints for AI agents and the tools and MCP servers they connect to.

Learn more

Ready to talk about AI Supply Chain Security?

Tell us what you are building. We will come back with a short, honest view of where the risk is and what it would take to test it.

Talk to us See all services