Audit · 01
Your agent executes code. Who decides what?
I take your system as it actually runs and look for where it breaks — not in theory, in your code.
What I look for
An agentic system has three surfaces classic code review does not cover.
The data path. What the agent reads can contain instructions. A web page, a ticket, a vendor PDF: any content entering a prompt is untrusted input, and almost no architecture treats it as such.
Memory. A system that remembers is a system where a note written yesterday can become an instruction today. If the memory → prompt path is not sanitized, poisoning is persistent and invisible.
Non-human identities. Every service, API key and token the agent can use is an account. Most organizations have no inventory, and discover during the audit that a demo agent carries a production credential.
What you receive
- OWASP ASI Top 10 mapped to controls actually in place, gaps named
- Adversarial review of the data path: inputs, memory, tools, outputs
- Supply chain and machine-identity audit
- Prioritized P0 / P1 / P2 report, each with its fix and its cost
- CI gates ready to wire in, so a closed hole stays closed
What it produced on my own system
I do not merely know how to audit: I inflicted this audit on my own ecosystem, and here is the raw result.
First pass across four production environments: 122 known vulnerabilities. The real root cause was not the one I was looking for — a command-line tool installed inside a service's virtual environment, pinning stale versions of libraries the service also used. No amount of reading application code would have found it.
Cleared to 0. Three CVEs with no upstream fix are tracked by name and reviewed monthly — an unnamed exception is a forgotten exception. A nightly audit section now goes red the moment one reappears.
On the agent side, the most embarrassing hole came from tool classification: it was done on the name. English verbs were covered; French verbs — generer, supprimer — fell into the read bucket and slipped through without validation. The fix was not to add French to the list, but to make effect declaration mandatory at tool registration.
What this audit does not cover
An honest scope beats a report that claims to cover everything.
- This is not a network penetration test or a general infrastructure audit. I look at the AI system and its chain, not your Active Directory.
- This is not a certification. No label comes out of this audit — a prioritized report and gates do.
- I do not fix during the audit. Separating findings from remediation keeps the findings honest; fixing belongs to the build or to your teams.
- Without access to the code and a running environment, the exercise becomes documentary review. I will say so rather than invoice a degraded audit.
This capability is engaged in
Frequently asked questions
Do we have to give you access to production data?
No. The audit covers code, configuration, the dependency chain and system behaviour. A staging environment with synthetic data is enough in the large majority of cases. If a point can only be verified on real data, I flag it and you decide.
Can our data stay with us during the engagement?
Yes, and that is the default. I work on your environment, nothing is copied locally to my machine, and none of the analysis tooling I use sends anything to a third-party service. It is the constraint I have imposed on my own ecosystem from the start.
How long does an audit take?
Three to five days for a typical system, handover included. Scoping happens in a 30-minute call, and the quote goes out within 48 h. A system with several agents, several models and an extended tool chain may need more — that will be said up front, not afterwards.
What happens after the report?
Nothing mandatory. The report is prioritized P0/P1/P2 with the fix and its cost for each item, and the CI gates ship ready to wire in: your teams can take it all over. If you would rather the remediation be done, that is the Build engagement. If you want it not to degrade, that is the Retainer.
Do you work on systems that are not local AI?
Yes, for the audit. The vectors — indirect injection, memory poisoning, supply chain, non-human identities — are the same whether inference runs on your machine or at a provider. That said, if your problem is that data goes to a third party and should not, the answer will be a local build, and I will say so.
Your data cannot leave the building?
That is precisely the problem I solve. A 30-minute call is enough to scope an audit.