The practice
Model and LLM assessments, application and cloud testing, and red-team readiness — delivered by operators who finish the chain. We do not sell a platform.
Direct and indirect prompt injection, multi-turn and encoded jailbreaks, system-prompt extraction, guardrail bypass, PII and tenant regurgitation, model extraction, and denial-of-wallet. Typical duration: 2–3 weeks for a single production assistant.
Function-calling, MCP servers, plugins, multi-agent orchestration, goal hijacking, and excessive agency. Aligned to the OWASP Top 10 for Agentic Applications.
Indirect injection via documents, email and tickets; corpus and embedding poisoning; connector over-permission; cross-tenant retrieval.
The surrounding web and API estate: authentication, object-level authorisation, business logic, and output handling where model text is executed or stored.
GPU clusters, model registries, vector databases, inference gateways, secrets, isolation patterns, and trust boundaries.
Fine-tune and training-data poisoning, CI/CD gate tampering, model provenance, dependency risk, secrets in notebooks and weights.
Multistep adversary emulation against the model pipeline. Purple-team variants work live with your detection staff. Tabletop drills for AI incidents.
Model and tool deployment, data flows, human-in-the-loop, vendor risk, and control coverage against NIST AI RMF, ISO/IEC 42001, and EU AI Act evidence.
A named operator retains scope over your models and agents, retesting after releases, keeping an attack library current.
System prompts, tool schemas, retrieval filters, output parsers, and the glue that turns a completion into an action.
How engagements are sized
One assistant or agent. OWASP LLM baseline and a written verdict on whether you can ship.
Full-stack assessment: model, RAG or tools, application, and cloud perimeter. Retest window included.
AI red team plus purple team. Lifecycle and human layers in scope. Board brief and detection-gap register.
