We don’t hand you a bug list. We chain the bugs — and prove it.
Design, source, running app and AIBOM go into an ephemeral sandbox — we surface the individual weaknesses, then chain them into one proven exploit, and hand you the cheapest fix and a reusable rule.
From weaknesses to one proven exploit.
Ephemeral by design
The sandbox is destroyed after each run; nothing your app touches persists.
Chained, not listed
A design gap + a code flaw + a dependency CVE from the AIBOM become one proven exploit.
Shift-left outcome
We show the cheapest place to fix and hand you a detection rule for the whole class.
AI security just became a legal obligation.
The EU AI Act phases in on a fixed calendar. Providers of general-purpose AI models with systemic risk have faced model-evaluation and adversarial-testing duties since 2 August 2025 (Art. 55; Commission enforcement powers from 2 August 2026); this binds model providers, not ordinary deployers. Art. 50 transparency obligations apply from 2 August 2026 (watermarking grace to 2 December 2026 for systems already on the market). High-risk obligations (Art. 9 for providers, Art. 26 for deployers) apply from 2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in regulated products, as moved by the Digital Omnibus on AI (Regulation (EU) 2026/1744; confirm Official Journal publication). As of 4 October 2026. Mapping and orientation, not legal advice. Penalties run up to €35M or 7% of global turnover for prohibited uses, and up to €15M or 3% for most other obligations — confirm classification and dates with counsel.
A findings list
Raw output, no methodology, no framework tags, no verified fix — stale the moment the model changes. Not something an auditor can use.
Defensible evidence
Documented method, mapped findings, verified remediation, re-tested, structured the way regulators are asking for it. Closing that gap is what these engagements do.
Fixed-fee engagements, defined scope.
Every engagement is fixed-fee against a scope agreed before work begins — and the Security Assessment and Full AI Red Team engagements include a re-test after fixes ship.
EU AI Act Readiness
2–3 weeks · fixed fee
Where you stand against Articles 9, 26 & 50 (and Article 55 if you provide a general-purpose model), delivered by our team, plus the evidence structure you will be assessed on. The Sargha product itself maps Art. 4, 10, 14 and 15.
- High-risk classification review
- Gap analysis vs. Art. 9 risk-management
- Safety & Security Model Report — populated
- Incident-reporting runbook + remediation plan
Best for Orgs with AI systems in EU markets, or facing a customer security review that now asks about AI governance.
AI Security Assessment
2 weeks · + 30-day re-test
Adversarial testing of one LLM application or agent, mapped to OWASP LLM Top 10 and MITRE ATLAS.
- Prompt injection, jailbreak, instruction-override
- Excessive agency & tool-access review
- Conventional AppSec of the API surface
- Severity-classified findings + verified re-test
Best for Teams with one production AI app who need defensible evidence before launch, or after a customer asks.
Full AI Red Team
4 weeks · + 30-day re-test
End-to-end adversarial testing across the app, its retrieval layer, and its agent layer — including chained attack paths.
- RAG: indirect injection, retrieval poisoning, tenant isolation
- Agent/MCP: tool-call auth, confused-deputy
- Chained privilege escalation, multi-turn attacks
- Board-level executive summary + full technical findings
Best for Orgs running agentic systems with tool access, RAG over sensitive data, or multi-agent workflows.
AI Discovery Assessment
1–2 weeks · fixed fee
What unapproved AI is actually running in your environment right now — the inventory a governance program starts from.
- Endpoint sensor across Windows, Linux, macOS
- Eleven signal classes — network, MCP & tool scope, keys, IDE assistants, skills, agents, mobile & more
- Full inventory with attribution — machine, user
- Risk-ranked, sanctioned vs. unsanctioned
Best for Security teams beginning an AI governance program who need a real inventory first.
Continuous AI Testing
Rolling · 3-mo minimum
Point-in-time testing goes stale the moment a model changes. This keeps the harness running as your systems evolve.
- Automated adversarial testing on a schedule
- Regression suite — every finding becomes a test
- Monthly framework-mapped report
- Alerting on new AI systems & failure modes
Best for Teams shipping AI changes continuously, where an annual assessment cannot keep pace.
Embedded AI Program
Ongoing · 6-mo minimum
Ongoing ownership of your AI risk program without a full-time hire.
- Ownership of the AI risk register & red-team harness
- AI security policy & standards
- Board and audit-committee reporting
- Direct support during audits & customer reviews
Best for Orgs adopting AI faster than their security function can govern it, without headcount to hire.
Scoping to evidence in four steps.
01 · Scoping call
Free, 30 minutes. If it is not the right fit, we say so — and tell you what would be.
02 · Fixed proposal
Defined scope, fixed fee, fixed timeline. No hourly billing on defined work.
03 · Testing
Weekly progress. Critical findings reported immediately, not held for the report.
04 · Report & re-test
Findings, evidence, remediation roadmap — then a 30-day re-test to verify and document the fixes.
What’s different about our approach.
Auditable by design
Before the sensor is ever deployed, we walk you through exactly what it collects — and what it never touches. You review the agent’s behavior and data flow up front; few vendors let you look under the hood at all.
Evidence is the deliverable
Most engagements end with a findings list. These end with framework-mapped evidence, verified remediation, and an auditor-ready report.
Start with a scoping call.
Thirty minutes, no cost, no obligation. If what you need is smaller or different from what is listed here, we tell you — including if the honest answer is that you do not need an engagement yet.
araghatta.com · discovery.test().prove()
See what AI is already running in your environment.
Start with a free assessment, or talk to us about scope — no rollout required to begin.