Services

Every service is a fixed scope with named deliverables, run under the TriOngle Method v1.0, with every finding mapped to the frameworks and the law it touches. Prices are on request; see pricing.

Architect scopes

Design the AI system secure from the start.

Architect scopes: code, service and deliverables
Code	Scope	Deliverables
A1	AI architecture reviewAn independent review of how your LLM or agent system is put together, from the data it reads to the actions it can take, while the design is still easy to change.	Trust-boundary diagram of the system as built Findings, each mapped under the TriOngle Method Target architecture, with the order in which to make the changes
A2	Threat modelling for LLM and agent systemsA written threat model of your LLM or agent system: what an attacker would want, how they would get it, and which controls to build first.	Threat model: assets, data flows, trust boundaries and actors Abuse cases written as concrete attack stories Control priorities, ranked by the risk each one removes
A3	Secure retrieval (RAG) designRetrieval that respects the permissions of the source systems, resists planted documents and keeps every tenant’s data in its own lane.	Permission-aware retrieval design Poisoning tests against the index and its ingestion path Tenant isolation review

Assure scopes

Attack it the way an adversary would, and prove the fixes.

Assure scopes: code, service and deliverables
Code	Scope	Deliverables
S1	AI red teaming and adversarial testingWe attack your AI system as deployed, the way an adversary would, prove each finding with a proof of concept, and retest the fixes.	Report with every finding mapped under the TriOngle Method Proofs of concept you can rerun Retest letter for the fixed findings Regression suite for your CI
S2	Agent and MCP assuranceAssurance for an agent system end to end: what its tools can do, whose authority they use, how they are sandboxed, and what its MCP servers expose.	Tool permission matrix OAuth and scope review Sandboxing review MCP server audit
S3	Guardrails and evaluationChoosing and tuning guardrails on evidence, and an evaluation suite in your CI that reports error rates with the method and the date.	Guardrail choice and tuning, vendor-neutral Evaluation suite that runs in your CI Error rates, each with its method and date
S4	AI supply chainKnow what your AI system is made of: models, datasets, adapters, packages and servers, with signatures and provenance you can check.	AI/ML bill of materials (models, datasets, adapters, packages, MCP servers) Signing and provenance plan Model file scans

Govern scopes

Meet the EU AI Act, ISO/IEC 42001 and GDPR in the same engagement.

Govern scopes: code, service and deliverables
Code	Scope	Deliverables
G1	EU AI Act, ISO/IEC 42001 and GDPR readiness, one reportSecurity, privacy and AI Act readiness in a single engagement and a single plain-language report, for engineers, the board and your counsel.	AI Act risk classification of each system Gap analysis against the AI Act, ISO/IEC 42001 and GDPR Technical documentation outline Article 50 transparency checks Data protection impact assessment (DPIA)
G2	AI incident responseBe ready for the incidents that only AI systems have: playbooks, a logging specification that lets you reconstruct what an agent did, and a tabletop exercise.	Incident playbooks for AI-specific incidents Logging specification Tabletop exercise with your team
G3	Post-quantum readiness for AI systemsAn inventory of the cryptography your AI systems depend on, and a plan to move it to post-quantum algorithms on the published timelines.	Cryptography inventory as a CBOM Migration plan with priorities and dates

AI agents

Twelve deeper scopes for agent systems. S2 Agent and MCP assurance covers an agent system end to end at a fixed depth; each scope below goes further on one area, and can be added to S2 or bought on its own. Each is mapped to the OWASP Top 10 for Agentic Applications (2026)^⁠[1] and, where it applies, to MITRE ATLAS, the MCP security best practices and the CoSAI guidance. The triangle beside each code shows the side it belongs to.

AI agent scopes: code, service and deliverables
Code	Scope	Deliverables
AG1	MCP server and tool-chain auditA close audit of the MCP servers and tools your agents use: how they authorise, what they can reach, how they install, and whether their descriptions can be turned against you.	Inventory of MCP servers and tools, local and remote Authorization review: token audience, passthrough, client registration and scopes SSRF and installation tests Tool-poisoning tests
AG2	Agent identity and delegation designDecide who an agent is when it acts: on behalf of a person or as its own principal, with which scopes, under whose sponsorship, and for how long.	Principal model: on-behalf-of or autonomous, per agent Token flows Scope catalogue Sponsor and lifecycle rules Conditional access policy
AG3	Coding-agent and CI hardeningSecure baselines for the coding agents your engineers use and for multi-agent harnesses such as OpenRig, with tests for sandbox escape and injection through pull requests.	Secure baselines for the coding agents and harnesses in use Hook and approval policy Sandbox-escape tests Pull-request and issue injection tests
AG4	Injection-resistant architecture reviewPrompt injection is not solved by filters. AG4 redesigns agent workflows so that injected text cannot reach the actions that matter.	Data-flow map of each agent workflow Rule of Two score per workflow Redesign using capability separation or plan-then-execute Risk register
AG5	Memory and context integrity assessmentAgents that remember can be made to remember the wrong things. AG5 maps what writes to memory and what reads it, and tests whether an outsider can plant a falsehood.	Map of memory writes and reads Provenance tagging design Memory-poisoning tests Purge policy
AG6	A2A and multi-agent trust reviewWhen agents talk to agents, each one is an input to the next. AG6 reviews how they authenticate each other, what they accept, and how a failure is contained.	Peer authentication review Session-smuggling tests Cascade analysis Kill switches and their test
AG7	Agent evaluation suiteA suite of attack scenarios mapped to MITRE ATLAS that runs in your CI on every change of model, prompt or tool, with a scorecard per model.	Attack scenarios mapped to MITRE ATLAS Regression harness for your CI Scorecard per model and configuration
AG8	Runtime monitoring designTelemetry and detections that show what your agents are doing in production: scope jumps, unusual egress, memory writes and new tools.	Telemetry schema for agent activity Detections: scope jumps, egress, memory writes, new tools SIEM content: rules, dashboards and triage notes
AG9	Managed agent runtime reviewA configuration review of the managed agent runtime you build on: its policy layer, gateway, identity, network isolation and guardrails.	Configuration review of the runtime in use Findings mapped under the TriOngle Method Hardened baseline configuration
AG10	Agent supply-chain governanceControl what your agents are allowed to install: MCP servers, skills and plugins, each on an allow-list, checked for provenance and pinned.	Allow-list for MCP servers, skills and plugins Provenance checks Review and approval workflow Version pinning and patching policy
AG11	Model migration and routing reviewBefore you switch models or route between them: evaluation parity, where each provider keeps your data, what each licence requires, and what happens when a provider fails.	Evaluation parity results, old model against new Data residency and retention matrix per provider Licence and attribution check Failover plan
AG12	Agent incident responsePlaybooks for the incidents agents create, and a way to reconstruct from traces what an agent saw, decided and did.	Playbooks: injection, token theft, memory poisoning, rogue agent Trace forensics procedure Tabletop exercise

In development

Synthetic-actor defence (in development)

AI agents and other synthetic actors now operate inside company systems, often unseen.

We are building a security service for this problem, first for Swomi’s own security operations.

Status: in development. No opening date is set, and we will not describe what it does until it does it.

Tell me when it opens

How a scope works

You choose a scope, or describe the problem and we suggest one. We agree the system boundary, the questions that matter and the rules of engagement in writing, then quote a price for that fixed scope. Scopes can be combined in one engagement, for example S1 AI red teaming and adversarial testing with G1 EU AI Act, ISO/IEC 42001 and GDPR readiness, one report, and the report covers both.

Every engagement includes the framework mapping of the TriOngle Method, a plain-language report, and test evidence kept on EU servers only.

References

Numbered in the order they are first cited on this page; each entry links back to the places that cite it. Every source was opened on 4 November 2026.

↑ OWASP Top 10 for Agentic Applications for 2026. OWASP Gen AI Security Project, 9 December 2025.