Services

Three formats, designed to follow one another or to stand alone. Every engagement starts with a written scope and ends with a debrief.

2 days

AI-agent diagnostic

A clear picture: which agents, which access, which risks come first, and where to start.

Who it is for: IT leadership, CISOs and product teams that deploy, or are about to deploy, one or more AI agents.
Problem addressed: You do not know precisely what your agents can do, which data they reach, or which abuse scenarios are realistic in your context.
What we do: We map the agents, their tools, data, memory, skills, automations and permissions. We then connect every capability to the business decisions it can influence and to the guardrails already in place.
Deliverables: Diagnostic report, capability-and-rights map, ranked risk scenarios, prioritised action plan.
Typical duration: 2 days
How we work: Interviews with your teams and a read-through of the architecture, remotely or on site. No intrusive testing at this stage.

Request a review

5 days · Flagship

AI-agent audit and red teaming

We attack your agents the way an adversary would, within an authorised scope, and show you what gives way.

Who it is for: Organisations with an agent in production or pre-production: internal assistant, support agent, document automation, agent connected to business tools.
Problem addressed: Can your agent be hijacked? Can it be made to leak data, abuse its tools, bypass its instructions or chain dangerous actions?
What we do: Direct and indirect injection tests through web pages, e-mails, documents or knowledge bases; abuse of memory, skills, automations, tools and permissions. We also test action chains and possible exfiltration paths. Every successful scenario is reproduced, documented and rated by business impact.
Deliverables: Audit report with reproduced scenarios and evidence, severity rating, concrete recommendations ranked by effort, oral debrief with your teams.
Typical duration: 5 days
How we work: Scope and written authorisation defined before any test. Remote or on-site work. Contractual confidentiality.

Request a review

10 days or more

Hardening, custom harnesses and support

We turn your business rules into verifiable controls, then make them hold in production.

Who it is for: Teams that must fix audit findings, design a safe agent from the start, or keep a security level over time.
Problem addressed: The recommendations exist, but teams lack the time, the method or the perspective to turn them into controls that actually work.
What we do: Design and, within scope, development of harnesses outside the model: rights by business role, action policies, thresholds, human approvals, data compartmentalisation and audit logging. Fix review and regression testing are included.
Deliverables: Target architecture, business-policy matrix, documented controls or harnesses, replayable test sets, training and support for the agreed period.
Typical duration: 10 days or more
How we work: Iterative support, remote or on site, working directly with your technical teams.

Request a review

Method

Our tests and recommendations rely on public frameworks, used as method grids rather than labels. We issue no certification and claim no compliance with these frameworks.

OWASP Top 10 for LLM Applications
OWASP Agentic Security Initiative
MITRE ATLAS
EU AI Act
NIS2 Directive

Framework

Confidentiality A non-disclosure agreement is signed before any engagement. Your data stays within the agreed scope.
Scope and authorisation Tests cover only the systems you designate, under written authorisation. Nothing outside is touched.
Written report Every engagement produces a written report that belongs to you, with findings, evidence and recommendations.
Debrief An oral debrief with your teams closes every engagement.

Frequently asked questions

What scope can you test?

Any agent or assistant that reads external content or acts inside your tools: internal assistants, support agents, document automations, memory, skills, MCP or API integrations. The scope is defined together, in writing, before the engagement.

Is our data protected?

Yes. A non-disclosure agreement is signed beforehand, tests run on the environments you designate, and we keep only what the report requires.

How long does an engagement last?

Two days for a diagnostic, five for an audit, ten or more for hardening. These durations are indicative and adjusted to the scope.

Do you work remotely?

Yes, in France and internationally, in French and in English. On-site presence is possible when the context calls for it.

What happens after the audit?

You receive a report and a debrief. You can fix things internally, or entrust us with hardening and support to put the controls in place and verify them.

Request a security review

Describe the agent, its access and the business decision it can influence. We reply within two business days.

Request a review