skulk
skulk
Two engagements, at the two moments that matter: a design review before you build, and an automated posture assessment before you ship. Every finding carries its evidence. Every report states what it did not assess.
The same eight control domains, asked twice. In the design phase they are a checklist — decisions, made cheaply, before anything is built. Before release they are a verification — run automatically against the system that actually shipped. Either stands alone; together they close the loop between what you decided and what you built.
A working session with the people building it. One decision per control domain — where the tenant boundary lives, what each agent may hold, how memory is partitioned and retained, what gets logged. No access, no scan, no credentials.
Choose this when you are designing or refactoring an AI application, or when nobody can currently answer “is this index multi-tenant?” from a written record.
The scan. Four surfaces read together — your repository, your cloud control plane, your stores, and the intent you declared — and compared. Where reality disagrees with what you decided, that disagreement is the finding.
Choose this when you are about to ship, when something changed — a new agent, a new tenant, a new tool — or when a customer, auditor or board asks a question you would rather answer with evidence than belief.
The two engagements above do not replace the layers you already run, and they are not interchangeable with them. Here is the honest comparison — including when to choose one of these instead.
Continuous AI-SPM across your cloud estate, correlated with wider cloud posture — and it discovers AI infrastructure well. Choose one when you run AI at scale and can staff a platform. It is a subscription and a deployment, and it discovers by cloud API.
Human-led adversarial testing — prompt injection, jailbreaks, attacker creativity against a live system. Choose one when a critical system needs to be attacked rather than audited. It answers what can be broken; neither engagement above does.
In-line defenses screening prompts and outputs in production. Choose one to protect a live perimeter. A guardrail enforces at runtime — it does not audit the entitlements and IAM paths behind it.
Same environment, same findings. The second report shows exactly what was fixed and what is new — no tester variance in between.
A traced graph path, a file and line, or a named configuration field. If we cannot show it, we do not report it.
Seven checks compare what you told us to what we found — declared row-level security against the live catalog, declared agent identity against its actual execution identity, declared providers and retired stores against the code that still calls them, a declared-private Vertex endpoint against its observed network path. Disagreement is the finding.
The report lays every declaration you made beside what we found — confirmed, contradicted, or not verifiable with the reason — and states how old your declaration is, so its confirmations are weighed against their freshness.
Every report states its own limits. Nothing unparsed or unassessed is ever presented as clean.
Every check carries OWASP LLM Top 10 and MITRE ATLAS mappings, with NIST AI RMF where defensible, so findings arrive in vocabulary your security team already reports in.
A control-plane assessment has a hard edge. Pretending otherwise is how false comfort happens, so the edge is stated in every report.
When these matter, the report says so — as recommendations, never as findings we didn’t verify.