Regulated enterprise · 3,400 endpoints
AraghattaFinancial services · Windows / macOS / Linux · MDM rollout
Challenge
AI adoption was outpacing governance across a regulated fleet. Security had no inventory of the agents, keys and tools in use, and auditors were beginning to ask.
Deployment
The single-binary sensor was rolled out to ~3,400 endpoints — our largest AI-discovery deployment to date — via the customer's MDM, read-only, with no user disruption.
What surfaced
Unsanctioned AI CLIs, SDKs and apps; agent/MCP integrations with broad tool scope; provider API keys exposed in developer environments; and egress to external AI endpoints — each attributed to a machine and user across eleven signal classes.
Action
Isolate the highest-risk agents, rotate exposed keys, scope MCP tools to least privilege, and bring sanctioned tools into governance with owners.
Outcome
A complete, attributed AI inventory with risk scoring, and a compliance-evidence pack generated straight from the console — the visibility a governance programme is built on.
Platform company · 100 web applications
Application Security · SAST + DASTFull estate coverage · static + dynamic testing · framework-mapped
Challenge
A large application estate — around 100 web apps — needed complete, defensible security coverage ahead of customer security reviews, with a single prioritised view rather than 100 separate scan dumps.
Engagement
End-to-end SAST and DAST across all ~100 applications, with every finding triaged and validated by our reasoning core to cut false positives, and mapped to OWASP and CWE.
What surfaced
Injection and access-control flaws, vulnerable and typosquatted dependencies, exposed secrets, and configuration/exposure issues — ranked by real, validated severity across the estate.
Action
A prioritised remediation roadmap by app and severity, verified through a re-test after fixes shipped.
Outcome
One consolidated, evidence-graded view of 100 applications — findings the teams could actually act on, with a verified re-test and an auditor-ready report, instead of a hundred noisy scan reports.
Regulated clients · HIPAA · PCI-DSS · ISO 27001
Product Security · Regulated clientsThree separate clients · three regulatory regimes · end-to-end product security
Context
Three different clients, each under its own regime: a healthcare platform (HIPAA), a payments company (PCI-DSS), and a SaaS provider (ISO 27001) — each needing complete, end-to-end product security and the specific evidence its own auditor asks for, without standing up a large in-house AppSec team.
Engagement
For each client, full-lifecycle coverage — source (SAST), live app (DAST), dependency & supply-chain, container and IaC posture, model & AI/LLM red-team, and threat modelling — mapped to that client's framework controls.
What surfaced
Concrete findings across the whole stack — IDOR / broken object-level authorization in production APIs, a confused-deputy flaw in an AI agent's tool use, cross-tenant misconfiguration, system-prompt extraction and sensitive-data exfiltration against the LLM layer, and vulnerable / typosquatted dependencies in application and agent code — each tied to the specific control it affects (HIPAA Security Rule, a PCI-DSS requirement, or an ISO 27001 Annex A control), so remediation and audit evidence came from a single source of truth.
Action
Remediate by control priority per client, then keep the harness running so evidence stays current release to release — point-in-time testing goes stale the moment a release ships.
Outcome
Audit-ready, framework-mapped evidence for HIPAA, PCI-DSS and ISO 27001 clients respectively — end-to-end product security delivered as a repeatable programme across regulated environments, not a one-off scramble.