AI and agent security review
Prompt injection paths, over-permissioned tools, data leaking through retrieval, unsafe outputs and missing human checks, mapped against the OWASP Top 10 for LLM applications.
Security has been my long-running research interest: how systems get broken, and how often the way in is a convincing message rather than a clever exploit. I review what you've built the way an attacker would read it, then help fix what matters.
For teams shipping AI agents or LLM features, startups before a funding round or enterprise deal, and organisations worried about phishing and scams aimed at their staff or customers.
01/What you get
Backend and cloud review
Authentication and authorisation, secrets handling, dependency risk, exposed services and cloud permissions, with fixes ranked by how likely and how costly each issue is.
The human attack surface
How phishing, impersonation and payment scams would reach your team and your customers, including M-PESA and support-channel fraud, and the process changes that blunt them.
A report you can act on
Plain-language findings, proof for each one, and a short fix list your engineers can start on the same week.
02/How it works
- Step 1
Threat model
What you are protecting, from whom, and which paths an attacker would most likely try first.
- Step 2
Review
Code, configuration, agent tools and the real workflows where people make trust decisions.
- Step 3
Report
Findings ranked by risk, each with evidence and a concrete fix.
- Step 4
Fix together
Optional: I help your team close the important issues and re-check them.
03/Proof
04/Questions
Is this a penetration test?+
No. It is a builder's security review: design, code, configuration and process, done by an engineer who studies how attacks work. If you need a certified penetration test for compliance, I'm happy to prepare you for one and work alongside the testing firm.
Why the focus on people?+
Because that is where most real incidents begin. Phishing, impersonation and scams work by exploiting trust and urgency, so understanding how people decide is as important as understanding the code.
Can you review an AI agent we've already shipped?+
Yes, and it is one of the most useful reviews to do. Agents combine model output with real permissions, which creates risks most traditional checklists miss.
Related writing