Identify the system and the question
Describe the issue your team needs to resolve: an agent with too much access, an untested architecture claim or a component that differs from the documentation. Identify who needs the answer and when.
Approach
How we assess, build and test.
Every engagement starts with a technical question and ends with work your team can use: a tested implementation, documented findings or verified fixes. The proposal sets out the access, methods, deliverables and limits before work begins.
Discuss a projectScoping
From the initial discussion to handover.
A high-level summary is enough to begin. Detailed records, code, credentials and production access require an agreed handling and authorization process.
Confirm access and handling
List the systems, accounts, devices or samples involved and the records available for comparison. Confirm ownership, authorized access, data handling and stop conditions. For devices, agree transport, opening, powered tests and any destructive sampling.
Set the tests and acceptance criteria
For an implementation, define the behavior the workflow must support. For an assessment, choose the permitted tests and methods. For remediation, identify the affected version and the checks that would show the issue is fixed.
Deliver the work and review the findings
Walk the receiving team through the changes or findings, test results and unresolved questions. Include the records needed to operate the workflow, reproduce a check or assign the next fix.
What you receive
Deliverables by type of work
The proposal identifies which outputs apply to your project, who receives them and how acceptance is checked.
AI implementation
The agreed workflow, the controls around it and the information your team needs to operate it. Scope and acceptance criteria determine what is delivered.
Read the implementation scope- The agreed workflow and its code or configuration changes.
- A record of data flows, permissions, controls and operating assumptions.
- Evaluation and test results against the agreed acceptance criteria.
- Deployment or operating notes, known limitations and a handover session.
Assessment
Findings that identify affected controls, observed behavior and recommended changes, with a summary for the people approving or implementing the next step.
Explore assessment options- Executive Go/No-Go memo or decision summary
- Technical findings register
- Architecture and trust-boundary review
- Abuse-case matrix
- Permission or retrieval-boundary matrix where applicable
- Prioritized remediation roadmap
- Sanitized transcripts, traces, screenshots or configuration excerpts where useful
AI security remediation
Changes tied to defined findings, with verification of the agreed criteria. Dependencies and unresolved issues remain visible in the handover.
Read the remediation scope- Agreed changes to code, configuration or operating procedures.
- Verification results tied to the scoped issues and acceptance criteria.
- A record of unresolved items, assumptions and residual risks.
- Handover notes and a discussion of any further work needed.
Device and firmware assessment
A report connecting the technical question to the inspected parts, files, measurements and references. The methods used determine which records the report includes.
Read the device assessment methods- Inspection notes, photographs and the measurements or files produced by the agreed methods.
- A description of the access, references and methods used.
- Technical findings tied to the defined question.
- Limitations, unresolved questions and recommended next steps.
Assessment methods
Methods for each service track
AI Security
Trace how a model reaches data and tools. Test relevant prompt-injection paths, retrieval permissions, tool authority and approval controls against the workflow’s expected behavior.
Explore AI SecurityCybersecurity
Review architecture, identity, data flows and operating controls against the question in scope. Compare technical claims with supplied records and permitted checks; identify gaps that affect the decision.
Explore CybersecurityDevice & Firmware Assessments
Record the device’s condition, then examine the agreed assemblies, components, firmware or materials. Use suitable references and lab methods, keeping the setup, measurements and limits alongside each finding.
Explore Device & Firmware AssessmentsFor software controls, we record both actions that should succeed and actions that should be denied. Each result identifies the version, configuration and environment tested, including unavailable access or incomplete checks.
A model upgrade, integration change or new permission can invalidate an earlier result. The report identifies changes that should trigger another review.
See a sample assessment packageReview relationships
Independence and conflicts
We disclose relevant implementation, remediation and advisory relationships before accepting a review. When we built or changed the system, our checks are verification or retesting.
An independent assessment requires a reviewer separate from the work being assessed. If we implemented the controls, another reviewer must provide that independent conclusion.
Read the independent control review scopeNext step
Discuss an assessment or engineering project.
Tell us what needs to be built, checked or changed, and what the result must help your team do.