We test AI applications and assistant rollouts, assess AI governance against recognised standards, and defend against AI-enabled fraud.
Staff and teams adopt AI tools faster than most security or IT policies can track them, from chatbots plugged into business data to AI features built into products the business ships.
We assess what is already in use, test AI-backed applications and AI assistant rollouts for the class of flaws OWASP catalogues for large language model applications, and prepare AI governance against ISO 42001 and the Voluntary AI Safety Standard. We also defend against the attacks AI now makes easier: phishing written by a model, and fraud attempted with a cloned voice or a deepfake video call. When the business is building the AI feature itself, our engineering practice designs the guardrails, audit trails and tenant isolation in from the start.
AI security work applies the firm's existing testing and advisory discipline to systems that use AI: the same verified findings, the same framework mapping and the same evidence trail as every other engagement.
What the engagement covers
A review of the AI tools already in use across the business, the data they can reach and the policy that should govern them.
What you get
Manual testing of LLM-backed applications, chatbots and AI agents against the OWASP Top 10 for Large Language Model Applications.
What you get
A pre-rollout review of Microsoft 365 Copilot: what it can see, who can reach it and what needs tightening before it goes live.
What you get
Gap analysis and AI management-system groundwork toward ISO 42001, delivered by a certified ISO/IEC 27001:2022 Lead Auditor applying management-system audit discipline to the AI standard.
What you get
Controls and staff readiness against AI-generated phishing, deepfake and voice-clone fraud attempts, built on the firm's phishing-simulation and incident-response practice.
What you get
Design and build of AI features with guardrails, audit trails and tenant isolation in place from the first line of code, drawn from running Aurii's own AI pipelines in production.
What you get
How it is shaped
Testing and reviews run as fixed-scope engagements with a defined target. Governance readiness runs as a defined program with milestones toward the assessment date.
A tester never assesses a system they built.
Aurii
Clinical software
A suggestion the platform makes shows its full clinical wording before the specialist can accept it, and an acceptance is permanent.
Read the case studyBlack Shard engineers. The same team that builds and operates Aurii, our clinical software built on Azure AI Speech recognition with production speech-to-text and OCR pipelines, multi-tenant Postgres and row-level security enforcing tenant separation, tests and secures the AI other businesses run.
Least privilege from day one: read access to the application, tenant or environment in scope, with administrative privilege only where the work demands it. The practices we apply to our own estate apply here: encryption in transit and at rest, few third parties, Australian regions for hosted client data, and an incident path that meets the Privacy Act's notification obligations.
Six: AI security assessment, AI penetration testing against the OWASP Top 10 for LLM applications, Microsoft Copilot security review, AI governance and ISO 42001 readiness with a Voluntary AI Safety Standard assessment, defence against AI-enabled phishing, deepfake and voice-clone fraud, and secure AI engineering with guardrails, audit trails and tenant isolation.
Verification workflows for payment and credential requests that hold when the voice or face on a call is a clone, awareness testing with AI-generated phishing and pretext scenarios reported per team, and an incident playbook written before the call comes in. It extends our phishing-simulation and incident-response practice to attacks built with AI.
Yes. AI security work runs against your applications, tenant and documentation, so scoping, testing and the debrief all run by video call wherever you are.
We do not publish prices, because cost is driven by scope. An AI penetration test or Copilot security review runs as a fixed-scope engagement with a retest of agreed fixes. AI governance and ISO 42001 readiness runs as a program with milestones toward the assessment date. Send a brief with the AI systems in scope.
The findings become the plan. Penetration test and Copilot review reports carry fixes your engineers can apply, with a retest included. AI governance readiness ends at the audit; the management-system documentation and evidence trail hold the position afterward. Where AI features are still being built, secure AI engineering carries the same guardrails into the next release.
