Agentic AI security
Agentic AI security and security automation
AI agents read your data, call your tools and act on your behalf. I test them the way an attacker would and put guardrails around what they can do, then put the same technology to work on security itself.
Scope
What it involves.
- Threat modelling AI agents: what they can read, which tools they can call and who can steer them
- Testing agents and LLM features for prompt injection, data leakage, excessive agency and unsafe tool use
- Guardrails: least-privilege tool access, logging and human approval for actions that matter
- Designing automated workflows (n8n and similar) for repetitive security tasks
When to call
When teams ask for it.
- An AI agent is about to get access to production data, email or internal tools
- Teams are adopting AI tools faster than security can review them
- Analysts spend their day on work a workflow could do
Outcome
What you have at the end.
AI agents and automation you can explain to an auditor: tested, limited to what they need, and logged.
Usually for: Teams building or adopting AI agents and LLM features, or automating operations
Proof
Work and credentials behind it.
Other services
Other ways I can help.
- Penetration testingWeb, API, mobile, network and cloud testing from an attacker's point of view.
- Security operationsDetection engineering, SIEM, incident handling and malware analysis.
- GRC advisoryInformation system audits, ISO/IEC 27001 and security strategy.
- Training and speakingSecurity awareness, technical workshops and conference talks.
Let's scope it together.
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.