Offense
Find the weakness first.
We probe models, agents, pipelines, applications and binaries the way an attacker would, for the failure modes standard testing rarely reaches.
AI-native security & infrastructureAI-native security
Adversarial
by design.
We attack the way an adversary would, across AI and the rest of the software stack, then harden what breaks.
Defense
Then harden the system.
Every finding feeds back into design. We architect and secure the AI infrastructure that holds under real pressure.
What actually breaks.
Your AI ships into production faster than it can be secured, and it fails in ways standard evals and pentests rarely reach. Not because those tools are bad, but because they were built for deterministic software and known CVEs, not for a model’s behavior or an agent’s decision surface.
Prompt injection past your filters
Instructions arrive inside content you already trust: a document, a page, a tool result.
Agents steered into unsafe tool use
The model is not compromised. It is persuaded, and it holds real credentials.
Authority boundaries that leak
One component acts with the privileges of another, and nothing in the flow says no.
Weak model and data provenance
Weights, adapters, and training data arrive with no integrity story you can check.
Third-party binaries you cannot see inside
Vendor components and toolchains on the AI path, shipped without source.
An attacker who also uses AI
Discovery, exploitation, and reversing are accelerating on their side too.
Specimen · redacted
class LLM01, AG1 High client sealed
POST /tools/invoice.export
Authorization: Bearer [redacted]
{"scope":"all","dest":"https://[redacted]"}
# source: vendor statement (indirect)
# authz: finance.write
# gate: human result: held
The talent that is deep in both offensive security and AI is scarce. We attack the AI and the rest of the software stack with that same judgment. The full catalog of classes we test for is the threat register.
Senior, precise, quietly relentless.
Built for the people accountable for what they ship: CTOs, platform and ML engineers, security and infrastructure leads. Specialized agents and fine-tuned models for machine scale, senior judgment on every finding. No vanity dashboards, no theatre. We tell you where a system breaks, and help you make it stop.
One team, the whole arc.
The same senior judgment from the first review to the last fix. We read a system, rebuild what is weak, attack it the way an adversary would, and harden what breaks. Adversarial testing is the sharp end; the rest is the same understanding aimed earlier.
The team that built a system cannot be the team that proves it safe. An outside adversary, senior and accountable, is the point.
Attack · primary offer
Adversarial testing
We attack models, agents, pipelines, applications and the rest of the software stack the way an adversary would, including the authority-boundary and integration failures standard evals miss.
Review
Secure design review
We read your architecture and code the way an attacker would, against your real threat model rather than a generic checklist. You get the failure modes that matter, ranked by what they would cost, not a list of everything.
Harden
Rebuild and harden
After we break a system, we rebuild the parts that failed and secure the stack around them. The hardening of what we have tested, done by the people who broke it, not a general modernization program.
Differentiator
AI-powered reverse engineering
Our edge, not a separate line. When risk sits past source and you have only a binary, we reverse it, pairing AI with senior operators to surface what static review leaves buried.
Build
Custom agent workflows
We build agentic systems tuned to how your teams actually work, with the guardrails, evals, and audit trails that make them safe to run in production.
Advise
AI infrastructure advisory
We design, scale, and secure the AI/ML infrastructure production depends on, from training and inference to the guardrails around them.
What an engagement looks like.
Most first engagements are a fixed-scope adversarial test, typically two to six weeks. You name the systems, the boundaries, and the questions worth answering. We agree the rules of engagement in writing before anything is touched. If a full test is more than you need yet, a design review is the lighter place to start.
Scope
We map the real attack surface with you. Rules of engagement, test windows and data handling are signed before anything is touched.
Attack
Senior operators attack the agreed targets the way an adversary would. Every high-impact step passes a human gate.
Harden and retest
Findings become changes your engineers can ship, and we re-run the affected attacks until each finding is proven closed.
Retainer
Optional. Two named recurring offers, Continuous Assurance and Continuous Red Team, are on the workbench page.
What you receive
A findings report for engineers, an executive summary a sponsor can read in minutes, and an evidence bundle your team can replay independently. The six phases, the severity rubric and the full deliverables standard are on the method page.
How we measure.
“Secure” is not a finding and “we tested it” is not coverage. Two things make our work checkable rather than assertable. The whole method, phases and rubric included, is on the method page.
Coverage, defined
Coverage maps to named external frameworks (the OWASP Top 10 for LLM Applications, MITRE ATLAS) and our own classes for the agentic gaps they miss. Every test declares the classes it exercises and every finding records the class it demonstrates, so coverage is a number you can audit.
Coverage maps to named external frameworks: the OWASP Top 10 for LLM Applications, MITRE ATLAS tactics, and our own classes for the agentic gaps those miss, including tool abuse, authority-boundary escalation, inter-agent trust, and unsafe autonomy. Every test declares the classes it exercises and every finding records the class it demonstrates, so coverage is a number you can audit.
Severity, weighted for agents
An agent can hold broad tool authority and act without asking, so we score impact and exploitability like everyone else, then score the authority the compromised path actually holds. The same injection reaching a benign tool and one reaching a tool that moves money are not the same risk.
Classic scoring assumes a human or a narrow service acts on a flaw. An agent does not: it can hold broad tool authority and act without asking. So we score impact and exploitability like everyone else, then score the authority and blast radius the compromised path actually holds. The same injection reaching a benign tool and one reaching a tool that moves money are not the same risk.
What we publish.
We write up what we can share without putting a client on the page: the techniques, redacted from the engagement that surfaced them, and the attack classes we find on our own time.
Technique notes
How a class of attack actually works, reproduced on our own targets, with the client and their configuration sealed out.
New attack classes
The agentic failure modes the standard frameworks have not named yet, written down so a defender can start testing for them.
Coordinated advisories
When our work surfaces a defect in a third-party product, the public record once the vendor has had its window to fix.
Before you ask.
The questions that usually come first, answered before the call rather than during it.
What are the rules of engagement?
Staging before production, and production only on your written authorization. Seven named stop conditions, any of which halts testing without waiting for confirmation. Short-lived, least-privilege credentials you can revoke at any moment. A retention period you choose up front, with credentials crypto-erased at teardown. The full rules, phases and rubric are on the method page.
What if you find nothing?
You get the coverage record: which attack classes were exercised, against what, and the evidence that they were. A clean result you can put in front of a board is a result. We do not inflate severity to justify an invoice, and we do not pad a report to look busy.
Who sees the findings?
Named recipients only. If our work on your systems surfaces a defect in a third-party product, we report it to that vendor and the relevant coordinating body under our disclosure policy, with your identity and configuration sealed out of it.
How long does it take?
A first scoped test is typically two to six weeks, depending on how much surface is in scope and how deep you want us to go. Scoping itself is a conversation, not a form.
Test what you are building, before someone else does.
Tell us what you run and what worries you. A senior operator replies, not a sales queue. From there: a 20-minute scoping call, then a written scope with a fixed price before anything is touched.
hello@serpio.ai →Responsible disclosure
Found something in ours?
Report it to security@serpio.ai and we will acknowledge it. We do not threaten researchers who report in good faith, and we will credit you unless you would rather we did not. Machine-readable details are in our security.txt.
When our client work surfaces a defect in a third-party product, we disclose it to that vendor and to the relevant coordinating body under our own policy, with the client sealed out of it.