Skip to content

AI security is the lead practice · EU AI Act ready

Where technology, security and trust come together.

We help organizations design, secure, engineer and transform technology across applications, AI, infrastructure, compliance and digital platforms.

Talk to a security expertSee the 85 services

Looking for training? Explore Cybaethrex Training

POSTURE SCORE
78
+37 since baseline
OPEN PATHS TO DATA
1
down from 6
CRITICAL FINDINGS
2
1 new this week
EVIDENCE READY
94%
ISO 27001 · 42001
Exposure over the engagement12 weeks
assessarchitectassure
FINDINGSEVERITY
Broken object-level authorisation on /v1/accountsCritical
Indirect prompt injection via retrieved documentsHigh
Cloud role scoped far wider than the workloadHigh
No adversarial test plan for clinical modelMedium
ILLUSTRATION OF AN ENGAGEMENT’S OUTPUT · REPRESENTATIVE FIGURES

01AT A GLANCE

Everything a security decision needs, in one engagement.

10 practices and 85 services, grouped by the order work actually happens: assess what is there, engineer what is missing, build what does not exist, govern it, then decide where it goes next.

PRACTICES

10

One accountable team across assessment, engineering, build, governance and advisory.

ATTACK PATH · HOW FINDINGS ARE DELIVERED

A finding is a fact. A path is a business risk.

We show the chain: how one weak assumption becomes access to the thing you actually care about.

  1. Attacker
  2. Public API
  3. Broken authorisation
  4. Internal service
  5. Cloud role
  6. Customer data

AI SECURITY · LEAD PRACTICE

An AI system is an architecture, not a model.

User, application, LLM, RAG, agent, tools, MCP, enterprise data: every component moves trust somewhere new, and each is a class of finding we test for.

  • OWASP LLM Top 10
  • NIST AI RMF
  • ISO/IEC 42001
  • EU AI Act

SERVICES

85

in the catalogue

RESPONSE

1 day

A practitioner replies within one business day. Not a sales desk.

  • EU AI Act
  • NIST AI RMF
  • ISO/IEC 42001
  • ISO 27001
  • NIST CSF
  • NIST 800-53
  • GDPR
  • OWASP LLM Top 10
02What we do

Ten practices, one accountable team.

85 services across assessment, engineering, build, governance and advisory. Most engagements draw on two or three.

SECURITY

Application Security

Manual, adversary-led testing of web, mobile and API surfaces. Business logic and authorisation first, because those are the findings that turn into breaches rather than tickets.

8 SERVICESExplore

SECURITY

AI & LLM Security

9 SERVICESExplore

SECURITY

Security Architecture

Architecture-level work where the expensive findings are cheapest to close: reference designs, trust boundaries and the roadmap that sequences them.

8 SERVICESExplore

SECURITY

DevSecOps & Security Engineering

Security inside the pipeline rather than beside it. If the secure path is slower than the insecure one, engineers route around it, so we make the secure path the default.

9 SERVICESExplore

TECHNOLOGY

Software & Application Development

8 SERVICESExplore

TECHNOLOGY

Dashboards & Platforms

A team that cannot see its own posture will not manage it, and leadership that only sees snapshots funds the wrong thing. We build the reporting layer that fixes both.

8 SERVICESExplore

ADVISORY

ISO & Compliance Advisory

ISMS work that produces a system the business can actually operate, not a binder written for an auditor and never opened again.

9 SERVICESExplore

ADVISORY

Privacy & Data Protection

8 SERVICESExplore

ADVISORY

GRC, Risk & Audit

Audit, risk and governance work written to the standard your regulators, customers and certification bodies actually apply.

10 SERVICESExplore

ADVISORY

Technology Consulting

Working with technology and security leaders on the decisions that set direction: strategy, transformation, and where the risk actually sits in a changing estate.

8 SERVICESExplore
03Products

Products we build and run.

Alongside the consulting practice, we build our own software: Aethrex, a unified security and AI security platform, and MarkeTrex, an AI marketing agent for social media that keeps your team in control.

UNIFIED SECURITY & AI SECURITY PLATFORM

Aethrex

See everything. Secure everything. Prove it.

One platform across the full security lifecycle: exposure, application, detection, endpoint, cloud, AI and governance, for the team defending a modern, AI-driven enterprise.

  • Exposure management
  • Application security
  • Detection & response
  • Endpoint & cloud
  • AI security
  • Governance & compliance
Explore AethrexRequest an Aethrex demo

AI SOCIAL MEDIA MARKETING

MarkeTrex

AI marketing that stays under your control.

An AI marketing agent that drafts your social posts and creatives. Your team approves every post before it publishes to Facebook, Instagram, TikTok and LinkedIn.

  • AI-drafted posts and creatives
  • Nothing goes live without approval
  • Facebook, Instagram, TikTok and LinkedIn
  • Approve from your phone
  • Multiple brands, each login sees only its own
Explore MarkeTrexBook a MarkeTrex demo
See all products
04How we work

Assess. Advise. Architect. Assure.

One continuous engagement model. Each stage hands the next something real, and the last one hands you evidence.

01

ASSESS

Establish the real picture

Systems, exposure, ownership and business impact, mapped as they actually are rather than as the architecture diagram claims. Nothing useful follows from a scope built on assumptions.

  • Attack surface and asset discovery
  • Trust boundaries and privilege paths
  • Impact framed in business terms
02

ADVISE

Turn findings into decisions

Findings ranked by consequence rather than severity label, with trade-offs made explicit. Leadership gets a small number of decisions to make, each with a cost and a reason.

  • Prioritised, costed remediation
  • Board and regulator-ready framing
  • Clear ownership per decision
03

ARCHITECT

Design what closes the gap

Reference architectures, control design and the operating model that keeps them working after we leave. Design-level fixes close classes of issues rather than individual tickets.

  • Reference architectures and control design
  • Policy, process and accountability
  • Built to be run by your team
04

ASSURE

Prove it holds

Validation that the change worked, documented to a standard that survives a customer security review, a regulator or an audit committee.

  • Targeted retesting and verification
  • Evidence packs for audit and customers
  • Ongoing assurance cadence
05Selected work

What the engagements produced.

Anonymised, but real. Each ran the same way: assess the actual exposure, advise on the decisions that matter, design the fix, prove it holds.

Multi-cloudCloud security

89 findings

misconfigurations closed across AWS and Azure

Challenge
Two clouds grown separately, with no shared view of identity, exposure or blast radius.
Approach
We reviewed both estates against the privilege paths that actually reach data, rather than auditing settings in isolation.
Outcome
Eighty-nine misconfigurations remediated and a single posture baseline the team could keep enforcing after we left.
HealthcareAI security

Adversarial

vulnerabilities found in a clinical ML model

Challenge
A healthcare AI system heading toward clinical use with no adversarial testing in its assurance plan.
Approach
We tested the model the way an attacker would: crafted inputs, boundary probing and the data pipeline feeding it.
Outcome
Adversarial weaknesses identified and documented before deployment, with retraining and input-validation guidance.
Incident responseContainment

2 hours

to containment, 100% of data recovered

Challenge
Live ransomware with encryption already spreading across shared infrastructure.
Approach
Containment first, forensics second: isolate propagation paths, then establish entry point and dwell time.
Outcome
Contained inside two hours with full data recovery, followed by the access-control changes that closed the original route in.
06AI Security · in practice

An AI system is an architecture, not a model.

Every component moves trust somewhere new, and every label under it is a class of finding we test for. This is the scope of an AI security assessment.

  1. 01

    USER

    Untrusted input, always

  2. 02

    AI APPLICATION

    Where policy is enforced: or is not

    PROMPT INJECTION
  3. 03

    LLM

    Instruction-following, not judgement

    GUARDRAIL EVASION
  4. 04

    RAG

    Retrieved content is executable text

    INDIRECT INJECTION
  5. 05

    AGENT

    Plans, loops and acts on your behalf

    AGENTIC RISK
  6. 06

    TOOLS

    Every tool is a new privilege

    TOOL ABUSE
  7. 07

    MCP

    Transitive trust across servers

    PRIVILEGE ESCALATION
  8. 08

    ENTERPRISE DATA

    The boundary that must hold

    DATA LEAKAGE

Cybaethrex Training

Need to build your team's security capabilities?

Cybaethrex Training delivers professional, corporate and university programs in AI security, cloud security and offensive security, taught by the same practitioners who run the engagements.

Explore Cybaethrex Training

Next step

Have a security decision to make?
Let’s make it an informed one.

Tell us what you are building, adopting or worried about. You will get a practitioner’s view of where the risk actually sits, before any engagement is scoped.

Talk to a security expertExplore our services