AI Security practice
Secure the AI you build and the AI you buy.
We red-team LLM apps, agents and MCP tool chains, govern them under ISO/IEC 42001, the NIST AI RMF and the EU AI Act, and help your company adopt AI without losing track of its data.
AI application · attack surface
Select a component
What we test: RAG store
- Indirect injection via a retrieved docLLM01 · AML.T0051
- Cross-tenant retrievalLLM08
Attack classes from the OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS.
Services
Test it, govern it, adopt it safely.
Three services from one team, so a red-team finding arrives with the control it proves and the policy that prevents it next time.
MCP & Agent Tool-Permission Review
A fixed-scope review of every MCP server and tool your agents can call: who installed it, what it can touch, and what a single injected instruction could make it do.
See what we check- Inventory of MCP servers, tools and their sources
- OAuth scopes, tokens and secrets per tool
- Tool description poisoning and tool shadowing
- Least privilege per tool and per user
- Human approval for destructive or costly calls
- Tool output treated as untrusted input
- Logging of every tool call to your SOC
Method
Our AI attack method
Five steps, published so you can check our work. Each step maps to public frameworks, and the last one turns findings into governance evidence.
Simulated environment, real workflow.
Attacks in, blocked, logged as evidence.
After the retest, the guardrails we helped deploy keep working. Every blocked attempt is logged against the control it proves, so the audit trail builds itself.
| Stage | Count |
|---|---|
| Screened | 48,200 |
| Blocked + logged | 1,318 |
| Human review | 22 |
| Clean | 46,860 |
Simulated environment, real workflow.
Test once, prove everywhere
A red-team finding is also governance evidence.
Big firms sell testing and AI governance from separate teams. We file each finding and retest against the ISO/IEC 42001, NIST AI RMF and EU AI Act controls it proves.
AI-0115-01 · Ticket text can make the agent issue refunds
Retest passed- OWASP LLM
- LLM01 Prompt injection · LLM06 Excessive agency
- ISO/IEC 42001
- A.9 Use of AI systems
- NIST AI RMF
- GOVERN 3.2 · MEASURE 2.7
- EU AI Act
- Art. 14 Human oversight · Art. 15 Cybersecurity
Example finding
Research
Notes from our AI red team.
We publish how we test, so you can judge the method before you hire us.
Article
Securing LLM applications: a threat model that fits on one page
Prompt injection is not a bug you patch once. Treat the model as an untrusted component and design the controls around what it can reach.
ReadSeries
All AI security research
Agent and MCP threat models, red-team checklists and EU AI Act readiness notes.
BrowseFAQ
Questions we hear most.
What does an AI red team actually test?
How your AI product behaves under attack: prompt injection (direct and through documents or tool output), data leakage, what an agent's tools can be made to do, poisoned retrieval sources and the model supply chain. We map every finding to the OWASP LLM Top 10 and MITRE ATLAS.
When do EU AI Act obligations apply to us?
They phase in over several years, with different dates for prohibited practices, general-purpose models and high-risk systems, and some dates have been under review. We work from the current official timeline and start with your role and risk class per system.
ISO/IEC 42001 or ISO 27001: which do we need?
ISO 27001 covers information security; ISO/IEC 42001 covers how you govern AI systems, including impact and life-cycle controls. They share a structure, so if you have 27001, 42001 builds on it rather than starting over.
Why review MCP servers separately?
Each MCP server hands an agent new powers, often with a broad token. One poisoned tool description or injected instruction can use all of them. A permission review is the fastest way to shrink that blast radius.
Do you build AI, or only secure it?
We secure it. We review the architecture, test it and govern it, and stay independent of the model and tool vendors you choose.
Find out what your agent would do for an attacker.
A 30-minute call with an AI red teamer. You leave with a scope, a timeline and a fixed quote.