Threat modelling
Systematic review of inputs, tools, data flows and trust boundaries specific to AI systems.
Before it reaches customers
AI Security, Governance & Responsible AI
Threat modelling, prompt-injection defences, access control and guardrails for AI systems.
What this is
AI systems fail in ways conventional application security does not cover: instructions arriving inside data, sensitive context leaking into output, agents reachable through the content they read. We threat-model the system, harden the boundaries, and put evaluation and monitoring around the behaviours that matter.
The problem
What this service addresses
If more than one of these is familiar, there is usually a case worth scoping.
- An assistant reads untrusted content, and nobody has assessed what instructions that content could carry.
- Retrieval ignores permissions, so the model can surface records a user cannot access.
- An agent holds broad API credentials because scoping them properly was deferred.
- In a multi-tenant product there is no proof that one customer data cannot reach another.
- Security review is asking questions about the AI system that nobody can answer.
Scope
What we deliver
Every item below is a deliverable you receive, not an activity we perform.
- Threat model covering the AI-specific attack surface, with ranked findings
- Prompt-injection defences on every untrusted input path
- Permission-aware retrieval verified by test, not assumed
- Least-privilege tool and credential scoping for agents
- Tenant isolation review and remediation for multi-tenant systems
- Guardrails for output filtering, refusal behaviour and abuse handling
- Adversarial evaluation suite run continuously, not once
- Monitoring, incident runbook and governance documentation
Capabilities
What the system does
Prompt injection defence
Untrusted content isolated from instructions, tool calls validated independently of model output.
Sensitive data leakage prevention
Context minimisation, field redaction and output scanning before responses leave the system.
Access control and tenant isolation
Permission enforcement inside retrieval and tool execution, tested with adversarial cases.
Model and dependency security
Supply-chain review of models, libraries and third-party AI services.
Evaluation and guardrails
Adversarial test suites, refusal behaviour, rate limiting and abuse detection.
Monitoring, incident handling and governance
Detection, response runbooks and the documentation your reviewers ask for.
Applied
Where it is used
Each of these is a bounded job with a measurable result, which is how we prefer to scope a first build.
01
Pre-launch security review
Assesses an AI system before it becomes customer-facing and fixes what matters.
02
Agent credential hardening
Reduces an agent from broad access to least privilege, with tests proving the limits hold.
03
Multi-tenant SaaS isolation
Verifies and enforces that tenant data cannot cross boundaries through retrieval or caching.
04
Enterprise security questionnaires
Produces the evidence and documentation procurement reviews require.
05
Untrusted content handling
Hardens systems that read email, web pages, documents or user submissions.
Architecture
How it is put together
An indicative architecture. The final design follows your systems, data boundary and constraints.
-
01
Trust boundaries
Explicit classification of every input as trusted instruction or untrusted data.
-
02
Input handling
Untrusted content isolated, structurally delimited and never treated as instruction.
-
03
Retrieval layer
Permission filtering applied during retrieval, with tenant scoping on indexes and caches.
-
04
Tool layer
Typed tools, validated arguments, scoped credentials and approval gates on consequential actions.
-
05
Output layer
Schema validation, sensitive-content scanning and refusal handling before responses leave.
-
06
Detection and response
Adversarial evaluation in CI, anomaly alerting, audit logging and an incident runbook.
Security & governance
Controls we build in
Access, privacy and oversight are part of the build rather than a later hardening phase.
- Untrusted input never treated as instruction; tool calls validated independently of model output.
- Least privilege by default for every credential an AI system holds.
- Permission and tenant isolation verified by adversarial test, not by design assertion.
- Context minimisation: a model receives only the data the task requires.
- Audit logging of inputs, outputs, tool calls and refusals, retained for investigation.
- Human approval retained on irreversible and financially consequential actions.
- Documented incident response with named owners and a kill switch.
Delivery
Our approach
How we run the engagement
Discovery
Process walkthroughs, data review, constraints and a written scope you sign off before build.
Architecture
Data model, integration boundaries, hosting and the security model, agreed up front.
Proof of concept
A narrow build on your real data against an agreed quality bar, so the go-ahead is evidence-based.
Development
Two-week increments, each ending in a working deployment and a review.
Testing
Automated coverage on critical paths, evaluation sets for AI behaviour, acceptance testing with your users.
Deployment
Staged rollout into your infrastructure with monitoring and a tested rollback path.
Monitoring & support
Quality, cost and latency tracking after launch, with handover documentation or an ongoing retainer.
Proven work
Products we have built and sold
We are product builders as well as a services team. These are our own commercial platforms, not client references.
Digital sales & support agent
SIZH Virtual Agent
A virtual digital agent for sales, support and reception — trained on your business, live on WhatsApp, web, voice and email.
View product Mobility platformRideOn
A ride-hailing and fleet management platform, now with agentic dispatch, driver support and demand intelligence.
View product Multivendor marketplaceUniBooker
A configurable multivendor service-booking marketplace with agentic onboarding, matching and support.
View product
Questions
AI Security, Governance & Responsible AI — FAQs
The questions we are asked most often about this service.
What is prompt injection, in practice?
Instructions hidden in data the model reads, such as a document, a web page or an email, that attempt to redirect its behaviour. It matters most when the model has tools, because redirected behaviour becomes real action. The defence is structural: never let untrusted content carry instruction authority, and validate tool calls independently.
Can prompt injection be fully solved?
No, and we will not claim otherwise. It is mitigated by limiting what the model can do rather than by trying to filter every malicious phrase. Scoped credentials, approval gates and validated tool calls mean a successful injection still cannot cause serious harm.
Do you perform penetration testing?
We perform AI-specific security review, threat modelling, adversarial evaluation and hardening. We are not a certified penetration-testing provider, and where a formal, credentialed penetration test or audit is required we will say so and work alongside a specialist.
Can you help with compliance frameworks?
We can produce the technical documentation, controls evidence and architecture descriptions that assessments require. Formal certification and audit opinions come from accredited bodies, not from us.
How do you test isolation?
With adversarial cases in the evaluation suite that deliberately attempt cross-tenant and cross-permission access, run on every change rather than once at launch.
Related
All AI First services
Services that pair with this
Agentic AI & AI Agents
Agents that pursue a goal, call your tools and complete multi-step work under explicit guardrails.
Read moreMLOps & AI Deployment
Versioning, evaluation pipelines, deployment, rollback and monitoring for AI systems in production.
Read moreRetrieval-Augmented Generation (RAG)
Answers drawn strictly from your approved documents, with citations and permission-aware retrieval.
Read more