AI Guardrails
A request filter against prompt-injection & data-leakage, a written AI-use policy, a red-team test report, and ongoing monitoring with monthly reporting.
How we work
A repeatable method that ends in evidence.
Every service runs through the same four stages. You always know what you'll get: a documented, standards-mapped result you can hand to an auditor, a customer, or your board.
01
Scope & inventory
We agree the boundary in writing, then inventory what matters — AI assistants and their data flows, systems in scope, or your cryptographic footprint. No open-ended fishing.
02
Assess against standards
We test against recognized frameworks (OWASP LLM Top 10, ISO 27001/42001, SOC 2, MITRE ATT&CK, NIST PQC) and record findings with severity and rationale — not opinions.
03
Remediate & harden
We fix what we can, and give you a prioritized, plain-language plan for the rest — each item tied to the standard it satisfies and the risk it retires.
04
Evidence & attestation
You receive an evidence pack: what was checked, what was found, what was fixed, and what's mapped to which control — the artifact that survives a questionnaire or an audit.
What each service produces
Compliance & Data Protection
A gap assessment, the policies and evidence files auditors ask for, and audit/questionnaire preparation — GDPR, SOC 2, ISO 27001.
Security Monitoring & Alerting
Log sources connected, detections mapped to MITRE ATT&CK, tuned alerting, and response runbooks your team can actually follow.
Post-Quantum Readiness
A cryptographic inventory (CBOM), an exposure/"harvest-now-decrypt-later" scoring, and a migration plan to NIST lattice-based standards — delivered by our specialist post-quantum partner, AegisLattice.
What a readiness report looks like
Our deliverables follow a consistent, auditor-friendly shape — so the value is legible at a glance and defensible on inspection:
- Executive summary — overall posture, letter grade, and the three things that matter most.
- Scope & method — exactly what was assessed and against which standards.
- Findings — each with severity, evidence, affected asset, and the control it maps to.
- Remediation plan — prioritized, effort-tagged, and tied to the risk each item retires.
- Standards crosswalk — how the work lines up to ISO / SOC 2 / GDPR / OWASP / NIST.
- Attestation — a dated, scoped statement of what was done, suitable to share with a third party.
ISO/IEC 27001ISO/IEC 42001SOC 2GDPRNIS2OWASP LLM Top 10MITRE ATT&CKNIST FIPS 203/204/205
This describes our method and the shape of our deliverables. It is a readiness indicator and does not constitute certification, a security audit, or legal advice. Client work and our internal tooling remain confidential.
Get your free readiness scan →