Approach
Implementation, assessment and remediation need different outputs. Each engagement starts with the system, the question and the access available. We agree the scope, methods and handover before kickoff.
Discuss a projectScoping
A high-level summary is enough to begin. Detailed records, code, credentials and production access require an agreed handling and authorization process.
Start with the workflow or decision: putting a prototype into use, expanding an agent’s access, addressing findings, preparing for a customer review or assessing a technical claim. Agree what the work needs to establish and who will act on the result.
Identify the users, models, memory, retrieval sources, tools, APIs, credentials, approval gates, logs and environments in scope. Confirm authorized actions, data handling, constraints and stop conditions before testing or making changes.
Implementation needs acceptance criteria for the intended workflow. Assessment needs permitted test cases and methods. Remediation needs the affected versions, the changes to make and the checks that would establish whether each issue was addressed.
Explain what was implemented or observed, the checks performed and what remains unresolved. Record assumptions, untested paths, operating constraints and next steps so the receiving team can use the work.
What you receive
These are the outputs we scope with you. The agreement identifies which apply, who will receive them and how acceptance is checked.
The agreed workflow, the controls around it and the information your team needs to operate it. Scope and acceptance criteria determine what is delivered.
Read the implementation scopeA written assessment for the people making and implementing the decision. Findings distinguish observed behavior from assumptions and identify affected controls, recommended changes and remaining questions.
Explore assessment optionsChanges tied to defined findings, with verification of the agreed criteria. Dependencies and unresolved issues remain visible in the handover.
Read the remediation scopeAssessment methods
An AI-security assessment may examine prompt injection, indirect instruction paths, unsafe tool use, retrieval leakage, excessive permissions and weak output handling. The test plan follows the system boundary and permitted actions.
We record expected and observed behavior, including allowed and denied cases where relevant. A result is tied to the version, configuration, environment and access tested. Unavailable systems and unperformed checks remain explicit.
A report separates confirmed findings, assumptions, untested paths and recommended changes. A passing check supports the conditions tested; a changed model, integration or permission may require another review.
See an illustrative assessment packageReview relationships
We disclose relevant implementation and remediation relationships. When TKOResearch built or changed the system, our later checks are verification or retesting. They are not an independent assessment of our own work.
Independent engagements start with a conflict review and an agreed relationship to the system. If independence is required for work we implemented, a separate reviewer is needed.
Read the independent control review scopeNext step
Tell us what needs to be built, checked or changed, and what the result must help your team do.
