Somebody in your organization is pasting documents into a chatbot. Somebody built a form with AI-written code. Somebody connected an assistant to the shared drive. None of that is wrong — but no one has written down which tools exist, what data they can touch, or whether the vendor trains on what you send. We do that, and then we fix what it turns up.
Read-only assessment · Fixed scope · Call or text (940) 281-6672
A July 2026 study scanned 549 public repositories that identified themselves as AI- or "vibe"-coded. Among the 467 substantial ones: 48.8% had injection-category flaws, 30.2% had a critical or high-severity finding, and 23.3% exposed a secret. The most common single issue was unescaped HTML rendering, in 43%.
Two caveats we will give you before you ask, because we would rather you trusted the rest: the study capped findings at 300 per repository, so the worst offenders are under-counted; and the sample includes small demo projects, which flatter the average. The authors' own reading is that real applications score worse. We cite it because it is measured, not because it is scary.
.env files, hardcoded credentialsThe first three are review and advisory work — we read, inventory and recommend. The fourth is different in kind: we actively test the infrastructure, which is why it needs written authorization and a scope agreed in advance. Most organizations should start with the inventory. You cannot test an agent estate nobody has written down yet.
We run an AI system against other people's email every day. That means we have had to answer, for ourselves and in writing, the exact questions we will ask you: which model provider, does it train on inputs, what does the model see, what does it never see, who approves an action before a human is contacted, and what happens when it is wrong.
Our own answers are on our Trust page and our Privacy policy. We think an AI security assessment from someone who has not had to answer those questions about their own product is worth very little.
On the agent-infrastructure testing specifically, we will tell you what it is: new ground. MCP servers, model gateways and vector stores are a few years old, the public tooling for testing them is younger than that, and anyone claiming a decade of experience in it is telling you something untrue. What we can say is that we run this infrastructure ourselves, against real mail, every day — so the failure modes we look for are ones we have had to close on our own systems first, not ones we read about.
The large agent-governance platforms now being funded are real and good — and they are built for enterprises with a SecOps team, an IAM team and a platform team. If you have those, buy one of those. If you do not, the useful thing is a person who inventories what you have, tells you what to turn off, and writes it down. That is this.
Thirty minutes, free. We ask what your staff are using and what it can reach, and tell you honestly which of these is worth doing — or that you are already fine.
Schedule a scoping sessionOr call the Security Architect directly — (940) 281-6672
Three, mainly. Staff pasting sensitive data into AI tools that may train on it; AI-written code shipping with vulnerabilities — a 2026 study of 549 AI-coded repositories found roughly 30% had a critical or high-severity finding and about 23% exposed a secret; and AI agents or integrations that can reach far more of your systems than they need. The common thread is that almost no organization can list which AI tools its staff use or what those tools can touch.
It can be, with guardrails. Several major providers state plainly that free-tier prompts may train their models, so the first rule is not to paste customer, donor, payroll, or regulated data into consumer tiers. A short acceptable-use policy and business-tier tools with data protections cover most of the risk.
Prompt injection is when an attacker hides instructions inside content an AI reads — an email, a document, a web page — to make it act against you. It matters most if you run an AI assistant or agent that reads untrusted content or can take actions like sending mail or moving money. The defenses are least-privilege access and human-approval gates on anything consequential.
MCP (Model Context Protocol) servers connect AI agents to your real tools and data. A misconfigured one can expose tools without authentication, grant scopes far wider than a tool needs, or carry tool descriptions that can be poisoned to redirect an agent. If you have connected agents to real systems, that infrastructure needs the same testing as any internet-facing system.
With an inventory. You cannot secure or test an AI estate nobody has written down. List which AI tools staff actually use, what each can reach, and whether the vendor trains on your data — then decide what to shut off or lock down first.