The input is the attack
Natural language is both payload and instruction. A support ticket, a PDF or a web page can carry commands the model will follow.
Prompt injection defence
AI Security & Governance
AI security that holds up in production
Audits, red teaming, hardened architectures and governance for teams shipping LLM features, agents and RAG systems. Built by engineers who ship AI themselves.
- UK company, founded 2006
- Senior people, small teams
- Fixed scopes where possible
Why this is different
Classic application security assumes a parser. LLM apps do not have one.
A web app separates code from data by design. An LLM app mixes instructions, user text, retrieved documents and tool results into one prompt, then lets the model decide what to do next.
The model has hands
Agents call APIs, send email, query databases and write files. A hijacked model with broad tools is an insider with no judgement.
AI red teamingThe data moves
RAG copies documents into indexes, prompts copy records to providers, logs copy everything. Each copy needs the same access control as the original.
Secure RAG architecture
Framework coverage
Mapped to the OWASP Top 10 for LLM Applications
We use the OWASP Top 10 for LLM Applications as the shared vocabulary for scoping, testing and reporting. Every category below has an owner in our service catalogue.
| OWASP LLM category | What it looks like in practice | How we address it |
|---|---|---|
| Prompt injection | A user message or a retrieved document overrides your instructions and redirects the model. | Prompt injection defence, LLM security audit |
| Sensitive information disclosure | Customer data, secrets or system prompts appear in answers, logs or provider traffic. | AI data privacy, Secure RAG |
| Supply chain | Tampered weights, unvetted adapters, malicious packages or plugins reach production. | Model supply chain security |
| Data and model poisoning | Planted documents or training data steer answers or embed hidden instructions. | Secure RAG, Supply chain security |
| Improper output handling | Model output is rendered as HTML, executed as code or passed to SQL without validation. | LLM security audit |
| Excessive agency | The model has more tools, permissions or autonomy than the task needs. | Privilege separation, Red teaming |
| System prompt leakage | Business rules, credentials or filters in the system prompt are extracted and bypassed. | Audit, Red teaming |
| Vector and embedding weaknesses | Cross-tenant retrieval, missing document ACLs, embedding inversion. | Secure RAG architecture |
| Misinformation | Confident wrong answers reach customers or decisions without a check. | AI governance, Evals |
| Unbounded consumption | Runaway agents, token floods and denial-of-wallet bills. | Audit, LLMOps monitoring |
Services
What we offer
Pick the engagement that matches where you are: a live system to test, an architecture to harden, or a regulator to satisfy.
Assess
LLM security audit
Threat model, static review, dynamic probing and a severity-rated report in two to four weeks.
Scope an audit AssessAI red teaming
Goal-driven attack campaigns against your deployed assistant or agent, with reproducible evidence.
See how a campaign runs Free toolAI security checklist
A 30-point self-audit across inputs, tools, data, outputs, operations and governance. Saves in your browser.
Start the checklist HardenPrompt injection defence
Defence in depth for assistants, agents and RAG: privilege separation, allow-lists, output validation, monitoring.
Harden your app HardenSecure RAG architecture
Document-level ACLs, tenant isolation, retrieval filtering and citation enforcement for knowledge bases.
Design a secure pipeline HardenModel supply chain security
Provenance, weight integrity, dependency and plugin review, and an SBOM for your AI stack.
Secure the supply chain GovernAI governance
A policy stack, clear roles, a model inventory and evidence that controls actually run.
Set up governance GovernEU AI Act readiness
Classify your systems by risk tier, map provider and deployer obligations, and close the gaps in order.
Check your readiness GovernISO 42001
Gap assessment and implementation support for an AI management system that builds on ISO 27001.
Plan for ISO 42001 GovernAI data privacy
Data flow mapping, PII redaction and pseudonymisation, retention rules and DPIA support for AI features.
Protect personal data
How we engage
From first call to evidence you can show a regulator
Scope
A one-hour call to map your AI systems, data classes and the decisions they touch. You get a written scope and a fixed price.
Assess
Audit or red-team campaign against the real system, in a staging environment that mirrors production.
Fix with you
We pair with your engineers on the highest-severity items first. Design changes come with reference code.
Prove
Retest, regression suite and monitoring so the fixes stay fixed as prompts and models change.
Govern
Model inventory, policies and evidence folders aligned to the EU AI Act and ISO 42001.
Who this is for
Teams with something to lose
- Product teams with an assistant, copilot or agent in front of customers.
- Platform teams running RAG over confidential or multi-tenant data.
- Regulated businesses in fintech, healthcare, legal and the public sector.
- CTOs who need a defensible answer to "is our AI safe?" before the board asks.
- Vendors whose customers now send AI security questionnaires with every renewal.
Building agents?
Our AI agents practice designs guarded runtimes from day one, so security is not a retrofit.
AI agents & automationProcessing documents?
Invoices, contracts and claims are the classic indirect-injection channel. See how we handle them.
Document processingReading first?
Our long-form guide walks through the checks we run before any LLM feature goes live.
LLM security checklist guide
FAQ
Frequently asked questions
Where should we start if we have an LLM feature in production and no security review?
Start with the LLM security audit. It takes two to four weeks, covers the OWASP Top 10 for LLM Applications and ends with a prioritised fix list. If you want a quick signal first, run the free 30-point checklist.
Do you only work with Anthropic Claude, or with other models too?
We work with Claude, OpenAI, Google Gemini and open-weight models such as Llama and Mistral. The controls we design (privilege separation, tool allow-lists, output validation, monitoring) are provider-independent.
Can you fix the findings as well as report them?
Yes. Most clients ask us to pair with their engineers on remediation after an audit or red-team campaign. We also build hardened components, for example a secure RAG pipeline or a guarded agent runtime.
Is AI governance only relevant to large enterprises?
No. Any organisation deploying AI that affects customers, staff or regulated decisions benefits from a model inventory, a short policy set and evidence of controls. The EU AI Act and ISO 42001 apply regardless of size; we scale the paperwork to your risk.
How do you price AI security work?
Audits and red-team campaigns are fixed-price once scoped. Governance and readiness programmes run as short phases with a clear deliverable each. Ask for a scoping call and we will reply within one business day.