Security of AIAssurance Programme

Not just a model.Everything it can reach.

Discover, validate, chain and enforce across browser, desktop, IDE, CLI, MCP servers, cloud identities and enterprise data. One risk model.

Why It's Hard

Guardrails Are Not An Assurance Program

Your SAST, DLP, CSPM and AI gateway each see a fragment. Nobody sees the whole path from prompt to production.

The Attack Surface Is Not The Model

  • Prompt injection arrives via documents and retrieval
  • Tools invoked with unanticipated arguments
  • Excessive agency turns assistants into incidents
  • Auth bypass turns low-privilege into high-privilege

Testing In Isolation Misses The Chain

  • A benchmark model is not your agent's real surface
  • Prompts and tool schemas drift after design review
  • Poisoned context persists past the session
  • Guardrails themselves are targets

Coverage Is Fragmented

  • OWASP LLM Top 10 partial across tools
  • MITRE ATLAS coverage patchy
  • No mapping from finding to control
  • Reports arrive after the incident

Your Assurance Team's Time Is Expensive

Adversarial testing is high value when it produces controls, not when it produces PDFs. Agent workflows keep discovery, validation and chaining continuous so assurance is a program, not an engagement.

Eight Assurance Domains

Eight domains. One risk model.

Agent software + supply chain

Map agent frameworks, models, SDKs, MCP servers, prompt and tool schemas, dependencies, secrets, SBOMs and provenance.

Explore the domain

Shadow AI + workforce use

Inventory browser, desktop, IDE and CLI AI usage by user, team, tenant, model, business purpose, data touched and outbound destination.

Explore the domain

Cloud + AI platform posture

Review AWS and Azure AI Foundry identities, IAM, secrets, network paths, model endpoints, logs, storage, deployment permissions, sandboxes.

Explore the domain

AI red teaming

Test direct and indirect prompt injection, sensitive disclosure, jailbreaks, tool misuse, excessive agency, authorization bypass, destructive operations and control bypass.

Attack-path chaining

Connect Git to CI/CD, registries, cloud identities, agent runtimes, MCP tools, SaaS and data. Rank toxic combinations by exploitability, reachability, privilege and blast radius.

Data, RAG + integrations

Secure connectors, vector stores, embeddings, ACL mapping, tenant boundaries, retrieval pipelines, data classification, poisoning resistance and lineage.

Governance, compliance + evidence

Build the AI inventory, risk register, policies, approvals, control mappings, ownership, exceptions and evidence aligned to ISO 42001, NIST AI RMF and OWASP GenAI guidance.

Explore the domain

Runtime control across every domain

Monitor browser, desktop, coding-agent, MCP and cloud actions. Before impact, hold the action and evaluate, then prove the outcome.

Explore the domain
How It Works

Scope, probe, escalate, prove.

01

Scope

The agent's real surface is mapped first, its prompts, tools, retrieval sources, identities and the systems it can act on, so tests target what it can actually reach.

02

Probe

Direct prompts, poisoned documents, tainted retrieval results and hostile tool responses are used to attempt injection, disclosure and jailbreaks against that surface.

03

Escalate

A successful probe is pushed further, from a disclosure to a tool call, from a tool call to a privilege, from a privilege to a destructive action, to find where autonomy stops being safe.

04

Prove

Every finding ships with the payload, transcript and reproduction steps, alongside the control that should have caught it, so the fix is specific, not a request for better guardrails.

Red-Team Coverage

What Every Engagement Tests

Adversarial testing against your own agents, mapped to OWASP LLM Top 10 and Agentic guidance so results line up with the framework your auditors already recognise.

Indirect Prompt Injection

Payloads arriving in documents, web pages, tickets and retrieval results, the path that survives input filtering because nobody typed it.

Tool Misuse & Excessive Agency

Tools invoked with arguments the designer never anticipated, and the actions taken beyond the request that turn a helpful assistant into an incident.

Authorization Bypass

Whether the agent's identity is more privileged than the user driving it, so a low-privilege request runs with high-privilege credentials.

Control Bypass & Poisoned Context

The guardrails themselves are targeted, and tainted context is used to influence later, apparently unrelated conversations past the session.

Not Another Framework.The Failure Your Agent Has Today.

Assurance is not a checklist. Red-teaming your own agents against direct and indirect injection, tool misuse, excessive agency and destructive operations produces reproducible findings mapped to the controls that should have stopped them.

See the 30-day POC

What The Assessment Produces

Break the path, not the finding count.

Mapped

AI asset, dependency and attack-path graph.

Ranked

Toxic combinations scored by reachability.

Proven

A 30/60/90 roadmap with named owners.

See how the pieces actually connect.

A 60-minute design workshop maps what AI is present, what it can reach, and whether the harmful action can be stopped before data leaves.