Home / Customer engagements
Customer engagements.
Real engagements, anonymized at the client’s request. Metrics are from actual deployments; company names are withheld here. Company names are withheld here and everywhere on this site. References are available under NDA during an evaluation. Together these span the full offering: endpoint AI discovery, application security testing, and end-to-end product security for regulated environments.
Selected engagements
Selected engagements
Financial services
Financial services · Windows / macOS / Linux · MDM rollout
- Challenge
- AI adoption was outpacing governance across a regulated fleet. Security had no inventory of the agents, keys and tools in use, and auditors were beginning to ask.
- Deployment
- The single-binary sensor was rolled out to ~3,400 endpoints via the customer’s MDM, read-only, with no user disruption.
- What surfaced
- Unsanctioned AI CLIs, SDKs and apps; agent/MCP integrations with broad tool scope; provider API keys exposed in developer environments; and egress to external AI endpoints — each attributed to a machine and user across eleven signal classes.
- Action
- Isolate the highest-risk agents, rotate exposed keys, scope MCP tools to least privilege, and bring sanctioned tools into governance with owners.
- Outcome
- A complete, attributed AI inventory with risk scoring, and a compliance-evidence pack generated straight from the console — the visibility a governance program is built on.
Application Security · SAST + DAST
Full estate coverage · static + dynamic testing · framework-mapped
- Challenge
- A large application estate — around 100 web apps — needed complete, defensible security coverage ahead of customer security reviews, with a single prioritized view rather than 100 separate scan dumps.
- Engagement
- End-to-end SAST and DAST across all ~100 applications, with every finding triaged and validated to cut false positives, and mapped to OWASP and CWE.
- What surfaced
- Injection and access-control flaws, vulnerable and typosquatted dependencies, exposed secrets, and configuration/exposure issues — ranked by real, validated severity across the estate.
- Action
- A prioritized remediation roadmap by app and severity, verified through a re-test after fixes shipped.
- Outcome
- One consolidated, evidence-graded view of 100 applications — findings the teams could actually act on, with a verified re-test and an auditor-ready report, instead of a hundred noisy scan reports.
Three separate clients · three regulatory regimes
End-to-end product security
- Context
- Three different clients, each under its own regime: a healthcare platform (HIPAA), a payments company (PCI-DSS), and a SaaS provider (ISO 27001) — each needing complete, end-to-end product security and the specific evidence its own auditor asks for, without standing up a large in-house AppSec team.
- Engagement
- For each client, full-lifecycle coverage — source (SAST), live app (DAST), dependency & supply-chain, container and IaC posture, model & AI/LLM red-team, and threat modeling — mapped to that client’s framework controls.
- What surfaced
- Concrete findings across the whole stack — IDOR / broken object-level authorization in production APIs, a confused-deputy flaw in an AI agent’s tool use, cross-tenant misconfiguration, system-prompt extraction and sensitive-data exfiltration against the LLM layer, and vulnerable / typosquatted dependencies in application and agent code — each tied to the specific control it affects (HIPAA Security Rule, a PCI-DSS requirement, or an ISO 27001 Annex A control), so remediation and audit evidence came from a single source of truth.
- Action
- Remediate by control priority per client, then keep the harness running so evidence stays current release to release — point-in-time testing goes stale the moment a release ships.
- Outcome
- Audit-ready, framework-mapped evidence for HIPAA, PCI-DSS and ISO 27001 clients respectively — end-to-end product security delivered as a repeatable program across regulated environments, not a one-off scramble.
Next
Want to speak to a reference?
See this on your environment
Want to speak to a reference, or see this on your environment? Book a 30-minute call — most engagements start with a fixed-fee assessment, and you can download the exact report formats first.
Get started
See the AI on your fleet in about a week.
Run the sensor across your estate and receive an AI risk report and an AI Bill of Materials. The assessment is free and carries no commitment.