From a first gap assessment to a fully run security function.
We work across the whole security lifecycle, with deep focus on AI and agentic systems. Engagements are scoped to what you actually need, and we tell you plainly what to do first.
AI Security Gap Assessment
A board-ready read of where you stand on AI and agentic security, with a sequenced roadmap. Built so a non-expert can complete it.
What it is
A self-serve assessment that maps your AI posture across seven control domains, computes a risk tier and an AI-security maturity level, and produces a downloadable gap assessment and roadmap. Every finding is grounded in vetted security research and public frameworks: OWASP, MITRE ATLAS, NIST AI RMF and ISO/IEC 42001.
What you get
- A live gap heatmap and a risk tier
- A five-phase roadmap with objectives and exit criteria
- Board-ready PDF and Word, tailored to your market
vCISO / Fractional CISO
A senior security leader on a fractional basis, owning your security program without a full-time hire.
What it is
We act as your Chief Information Security Officer: setting strategy, running governance, owning the risk register, reporting to the board, and running security day to day, while the big calls stay yours. Right-sized for organizations that need senior security expertise but not a full-time executive.
What you get
- A security strategy and roadmap you can execute
- Board and executive reporting on cyber and AI risk
- Vendor, architecture and incident calls teed up, with the decision yours
- A practical path through your compliance obligations
AI Security Reviews & Red Teaming
Adversarial testing of your LLM and agentic features, plus the architecture review behind them.
What it is
We attack your AI the way a real adversary would: prompt injection from untrusted content, jailbreaks, tool and connector misuse, agent-memory leakage, and multi-agent cascades. We pair the testing with an architecture review, because several of the hardest issues are design choices, not bugs you can patch.
What you get
- A red-team report mapped to OWASP ASI and MITRE ATLAS
- Findings ranked by real-world exploitability
- Architecture recommendations for the gaps no tool closes
Penetration Testing
Hands-on testing of applications, APIs, cloud and networks, reported for both engineers and the board.
What it is
Manual, exploit-driven testing, not a scanner with a logo on the cover. We chain findings the way an attacker would, prove impact safely, and prioritise by what could actually be exploited in your environment, including secure code review and API security testing where it counts.
What you get
- Application, API, cloud and network testing
- A clear, reproducible report with proof and fixes
- A re-test to confirm the fixes landed
Incident Response
Help when something has gone wrong, and the work to make sure it does not happen the same way twice.
What it is
We help you contain an active incident, investigate what happened, recover safely, and communicate clearly to the people who need to know. Afterwards we turn the lessons into concrete controls, so the same path is closed.
What you get
- Containment, investigation and recovery support
- A clear timeline and root-cause analysis
- A post-incident plan that hardens the gaps exploited
Security Due Diligence for M&A
Know exactly what's in the deal, what it will cost to fix, and what belongs in the terms.
What it is
Pre- and post-deal security and AI-strategy diligence for private equity and acquirers. We assess the target's real security posture and its AI strategy, translate the risk into dollars and timelines for the investment thesis, and stay on after close as the security partner if you want us to.
What you get
- A diligence report scoped to the deal timeline
- Risk quantified, with a remediation cost and plan
- A 100-day post-close security plan
SOC 2 & Compliance Readiness
Get audit-ready without the controls you do not need.
What it is
We map your obligations, build the controls and evidence that matter, and shepherd you through the audit, for SOC 2, ISO 27001, and ISO/IEC 42001 for AI management systems. The goal is a clean report and a security program you would have wanted anyway, not a paperwork exercise.
What you get
- A gap analysis against your target framework
- Controls, policies and evidence built with your team
- Audit support through to the report
Security Advisory & Assurance
An expert sounding board, plus independent assurance you can show a board, a customer or a regulator.
What it is
For teams that mostly need senior judgment on the decisions that matter: an architecture choice, a vendor question, a risk acceptance, a board narrative. We also provide independent assurance reviews, an outside expert confirming your posture is what you say it is.
What you get
- Direct access to senior security expertise
- Independent assurance reviews and second opinions
- Clear write-ups for boards and customers
Agentic-AI Vendor Selection & PoC Evaluation
An evidence-based way to choose between agentic-AI security platforms, and prove it in a sandbox before you buy.
What it is
Choosing an agentic-AI security platform is hard because the leading products are not substitutes, they secure different layers of the attack surface. We bring a capability framework and a proof-of-concept method, modeled on a rigorous POC structure, that separates how well a vendor does something from whether that thing is even its job.
The candidates are not the same shape
We assess against a benchmark baseline and score by layer, so a gap in a capability a vendor never claimed counts as scope, not failure:
| Layer | Example platform | What it secures |
|---|---|---|
| Endpoint | Palo Alto Prisma AIRS (+ Koi) | Coding agents, IDE plugins and local MCP servers on developer machines. |
| SaaS / identity | Obsidian Security | AI-agent defense across SaaS apps and copilots; least-privilege for non-human identities. |
| Control plane | Onyx Security | A runtime control plane over agent reasoning and tool actions. |
| Posture baseline | Qualys TotalAI | AI asset discovery, model scanning and compliance, the floor a challenger should match. |
How we run it
- A capability framework across discovery, posture, identity, runtime, detection, compliance and operations
- A sandbox-scoped proof-of-concept with green / amber / red exit criteria
- A scored, defensible recommendation tied to the blind spot you need to close
One caveat we're explicit about: a desk assessment reflects each vendor's stated and publicly documented positioning. Block rates, latency and false-positive burden are only confirmed in an evaluator-controlled sandbox, which is exactly what the proof-of-concept is for. We are independent and not resellers.
Not sure where to start?
Run the free assessment to see your gaps, or tell us what you are trying to do and we will point you to the right engagement.