CISOs and security leaders
Trust / AI security
AI application and agent security
Threat-model and harden AI systems across prompts, tools, retrieval, identity, data, models, infrastructure, and human approvals.
Treat model behavior as one part of a security boundary—not the boundary itself.
When to call
These are useful signals that the next decision needs more than another tool, vendor demonstration, backlog item, or workshop.
- The model can act with a shared or over-privileged credential
- Untrusted content can influence tool selection or arguments
- Approval exists in the interface but can be bypassed in the backend
- Sensitive data may enter prompts, traces, retrieval, or provider logs
- The team relies on a system prompt as the primary control
The outcomes
- A system-specific threat model covering data and action paths
- Per-user identity, scoped authorization, and server-side enforcement
- Isolation between untrusted content, model reasoning, and execution
- Tool validation, approval, rate, spend, and blast-radius controls
- Security tests, monitoring, incident response, and safe shutdown
What leaves the engagement
The exact artifact set is scoped to the decision, but the intended result is working behavior, visible evidence, and an owner—not a report that cannot be operated.
- Architecture and data-flow threat model
- Agent, retrieval, and MCP attack-path review
- Identity, permission, secret, and tool-control implementation
- Prompt-injection and tool-abuse test suite
- Logging, detection, response, and kill-switch design
- Remediation evidence and residual-risk register
How the work proceeds
- Follow authority and data. We map every place content enters, context is assembled, a decision is made, a credential is used, and an external side effect occurs.
- Enforce outside the model. Authentication, authorization, schemas, business rules, approvals, resource limits, and transaction constraints are implemented in trusted code.
- Assume hostile context. Retrieved documents, web pages, messages, files, and tool output are handled as untrusted inputs that can attempt to redirect the agent.
- Test and contain. We test misuse and failure, monitor material actions, minimize standing privilege, and give operators a verified way to pause or roll back the system.
Limits that stay explicit
Serious implementation work includes the conditions under which its claims do not hold.
- Prompt injection is not solved by a stronger system prompt alone.
- Security tests reduce uncertainty but do not prove the absence of vulnerabilities.
- Authorized penetration testing requires explicit scope and rules of engagement.
- Provider and open-source dependencies require continuing vulnerability and configuration review.
Questions teams ask
Can you test an agent for prompt injection?
Yes, within an authorized scope. The work includes architecture, permissions, data paths, tools, and side effects because prompt-only testing misses the controls that determine actual impact.
Is MCP secure by default?
MCP provides a protocol and authorization mechanisms, not an automatic trust boundary. Server provenance, token audience, per-user authorization, tool semantics, consent, isolation, and logging still require careful implementation.
AI security / first decision
Bring the real constraint.
Tell us the current state, the outcome that matters, and what has already been tried. The first conversation is for fit and truth—not a promise made before the system is understood.
Please do not send secrets, credentials, regulated data, or confidential customer material through an initial inquiry.