Security engineering

Cyber & AI security

Threat models, release controls, and operational checks for software and the agents inside it.

The operating problem

A final penetration test cannot substitute for a secure delivery process. We connect threat modelling to implementation, release checks, and incident response, including the tools and data an AI agent can access.

See the mechanism

Where each agent request stops, and why.

Controls for an AI agent belong outside the model: provenance rules, tool allow-lists, data rules, and human approval. Pick a request to see which check catches it.

Agent guard pipeline · illustrative policy

From: Signed-in user

Summarise the supplier contract in /legal/2026.

Checking…docs.read

An example policy, not a product. Each request passes the checks in order and stops at the first one it fails. Where the instruction came from matters as much as what it asks for.

What we build with you.

Threat model

Trust boundaries, data flows, misuse cases, agent permissions, and owners for the controls that reduce exposure.

Delivery gates

Code, dependency, secret, container, and infrastructure scanning tied to severity, triage, and remediation ownership.

Agent controls

Tool allow-lists, scoped identities, bounded execution, sensitive-data handling, and approval for consequential actions.

Assurance evidence

Recorded findings, remediation checks, operational playbooks, and evidence produced by the release process.

Frameworks we map to

Controls pinned to named threats.

The OWASP Top 10 for LLM Applications 2025 puts prompt injection first and lists sensitive information disclosure and excessive agency among the other nine.¹ Indirect injection arrives through external sources such as websites or files. OWASP's mitigations include least-privilege access, human approval for high-risk actions, and keeping untrusted content clearly separated.²

For agents, OWASP advises limiting the extensions an agent can call to the minimum necessary and enforcing authorisation in downstream systems rather than relying on the model to decide.³ NIST adds a sober point: current mitigations do not fully protect against prompt injection, so systems should be designed on the assumption that it can happen whenever a model reads untrusted input.⁴

We threat-model AI features against MITRE ATLAS, a living knowledge base of adversary tactics and techniques involving AI, including LLM prompt injection (AML.T0051).⁵ At the organisation level, findings map to the six NIST CSF 2.0 Functions: Govern, Identify, Protect, Detect, Respond, and Recover, which NIST says apply to AI systems too.⁶

For technical reviewers

Rules are enforced in the tool gateway rather than in the prompt, following OWASP's advice to authorise actions in downstream systems.³ Comments map each rule to the OWASP 2025 entry it addresses.¹

agent-policy.yaml · enforced in the tool gateway

agent: support-assistant
identity: svc-support-assistant      # its own scoped identity, not a user's token

tools:
  docs.read:       { allow: true, scope: user_readable_folders }
  crm.lookup:      { allow: true, fields: [name, order_ids], max_rows: 20 }
  payments.refund: { allow: true, approval: named_approver }    # LLM06 Excessive Agency
  email.send:      { allow: true, recipients: internal_domain_only }
  crm.export:      { allow: false }                              # LLM02 Sensitive Information Disclosure
  shell.exec:      { allow: false }

provenance:
  # Indirect prompt injection: instructions hidden in content the model
  # retrieves (documents, web pages, emails) rather than typed by the user.
  # That content can shape an answer but never authorise a tool call.  (LLM01)
  untrusted: [web_page, email, uploaded_file, retrieved_chunk]
  tool_calls_require: user_turn

output:
  redact: [phone, national_id, card_number]
  log: every_call_with_identity_and_decision

A useful starting point

Your first engagement.

Assess one application, establish a scan baseline, and implement the highest-value pipeline controls with your engineers.

One critical application and its deployment diagram
Repository and pipeline access within an agreed scope
Your risk owner and incident response process

Sources

Evidence and further reading

Primary sources for the standards and practices referenced on this page. They describe the field, not Verne's own results.

OWASP Top 10 for LLM Applications 2025 (opens in a new tab)OWASP Gen AI Security Project · 17 November 2024The 2025 list, from LLM01 Prompt Injection to LLM10 Unbounded Consumption, including LLM02 and LLM06.
LLM01:2025 Prompt Injection (opens in a new tab)OWASP Gen AI Security Project · undatedIndirect injection via websites or files; least privilege, human approval for high-risk actions, and separating untrusted content.
LLM06:2025 Excessive Agency (opens in a new tab)OWASP Gen AI Security Project · undatedMinimise the extensions an agent can call, require human approval for high-impact actions, and authorise in downstream systems.
Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2 E2025) (opens in a new tab)NIST · March 2025Current mitigations do not fully protect against prompt injection, so designs should assume it is possible with untrusted input.
LLM Prompt Injection (AML.T0051) (opens in a new tab)MITRE ATLAS · last modified 27 May 2026ATLAS, which describes itself as a living knowledge base of adversary tactics and techniques involving AI, lists LLM prompt injection as AML.T0051 in direct, indirect, and triggered forms.
The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29) (opens in a new tab)NIST · 26 February 2024The six Functions, Govern through Recover, and their application to AI systems among other technology environments.

AI Systems Readiness Audit

Bring us your
most complex workflow.

In 7–10 working days, Verne maps your workflows, data sources, repetitive decisions, automation opportunities, and AI risk areas. You receive a prioritized roadmap showing what to automate, integrate, avoid, and build first.

Book a Strategy Call Request a Systems Audit

Tell us what is broken. We will map the system.