Authorised scope
We assess systems within an agreed client scope, with defined targets, permitted techniques, data handling rules, escalation routes, and reporting expectations.
Responsible AI security work, scoped for defence.
DDAI conducts authorised defensive assessment work for AI systems, Large Language Model applications, Retrieval-Augmented Generation systems, and agentic workflows.
Our purpose is to help organisations identify weaknesses, improve controls, document remediation, and create evidence that supports governance, audit, and procurement review.
Our operating principles
Defensive purpose
Our work is designed to improve security, governance, resilience, procurement readiness, and responsible AI deployment.
Human accountability
AI-assisted analysis may support review, triage, documentation, and controlled validation. Human review remains responsible for scope, interpretation, severity, remediation, and final reporting.
Evidence-led delivery
Findings, remediations, retests, control changes, and governance records are structured so they can be reviewed, retained, and, where suitable, packaged through Evidary.
Data minimisation
We avoid unnecessary collection of sensitive data. Where evidence is required, we prefer hashes, structured metadata, redaction, and controlled retention.
How advanced AI models may be used
DDAI is preparing defensive workflows that may use advanced AI models to support authorised security and governance work, including secure code review, vulnerability triage, policy review, remediation planning, controlled validation, documentation, and evidence preparation.
Access to specialised cybersecurity models is subject to provider approval, account-level controls, approved-use scoping, monitoring, and applicable model-provider terms. DDAI does not state or imply access to gated models unless that access has been granted.
Supported work
Secure code and architecture review
Authorised AI application assessment
Retrieval-Augmented Generation security review
Agentic workflow governance review
Prompt injection and policy bypass assessment
Sensitive information disclosure review
Remediation planning
Retest and evidence refresh
Governance and procurement evidence preparation
Review and escalation
Each engagement has an agreed responsible contact, emergency stop route, reporting process, and remediation path. High-priority findings are handled through client-approved reporting channels.
Defensive AI security work should create control, not uncertainty.
DDAI helps organisations test AI systems responsibly and turn the results into practical governance evidence.
Discuss a responsible AI security assessment