AI threat modeling
Map agents, tools, data flows and trust boundaries; identify abuse cases specific to your architecture.
Practice
AI & Agentic Security
Governance and assurance for LLM applications and agentic systems, from threat model to production controls.
Agentic AI changes the attack surface. Prompt injection, poisoned context passed between agents, over-privileged tool access and runaway planner loops are not hypothetical; they show up in the first serious review of almost every system we look at.
Our practice brings a security-engineering discipline to AI deployments: inventory what each agent can do and whom it trusts, model how that can be abused, test it, and put controls and monitoring in place before go-live. The work draws on our own published research into agentic supply-chain risk, memory-transit attacks and automated red-teaming.
We work with product teams who want to ship, not to be told no. The output is a prioritized set of fixes and a control framework your auditors will recognize.
Offerings
How we can help
Agent capability inventory
An agentic bill of materials: what each agent can call, read and write, and the trust it inherits.
Red-team assessment
Structured adversarial testing for prompt injection, context poisoning, privilege escalation and loop exhaustion.
Governance framework
Policies, controls and review gates aligned to NIST AI RMF, ISO/IEC 42001 and OWASP LLM Top 10.
Safe-deployment review
A pre-production gate: guardrails, monitoring, kill switches and incident playbooks.
Enablement
Training for engineering and security teams on building and reviewing agentic systems.
How an engagement runs
Scoped, built, handed over.
- 1
Scope
Inventory the systems, agents, tools and data in play; agree the assessment boundary.
- 2
Model & test
Threat modeling workshops, then hands-on testing against the agreed scope.
- 3
Report
Findings ranked by exploitability and impact, each with a concrete remediation.
- 4
Harden & monitor
Implement controls with your team; define what gets logged and who gets paged.
Platforms
Tools we work in
NIST AI RMFISO/IEC 42001OWASP LLM Top 10MITRE ATLASAzure OpenAIAWS BedrockUiPath AgentsCopilot Studio
Questions
Before you call
Is this only for companies building their own AI?
No. Most assessments are for organizations adopting vendor AI features, Copilots and agent platforms that touch sensitive data.
How long is a typical assessment?
A focused assessment of one system runs three to five weeks. Program-level governance work is scoped separately.
Do you produce evidence for auditors or customers?
Yes. Reports are written to be shared with auditors, enterprise customers and insurers.
Tell us what you're trying to get done.
A practice lead replies within one business day. No sales deck, no discovery questionnaire.