Our framework
The Corner Piece Framework™
Every jigsaw starts at the corners, and so does trusted AI. Before we build, govern, defend, or test anything, we frame every AI system with four questions.
01Access
What data, systems, and tools can this AI reach?
02Authority
What is it allowed to do, and what needs human approval?
03Accountability
Who owns it, decides about it, and answers for it?
04Assurance
How do we know the controls work, and can we prove it?
Our five pillars (Build, Govern, Defend, Prove, and Learn) fill in the rest of the picture. A missing piece is the back door.
Operating model & frameworks
Trust is an operating discipline, not a label.
Example engagement · illustrative
surfacemapping AI + infrastructure attack surfacemapped
redteamprobing models · prompts · agents · data4 findings
controlsshipping fixes ranked by exploitability12 shipped
Frameworks we map our work to
- OWASP Top 10 for LLM Applications
- Baseline test catalogue for prompt injection, data leakage, and insecure output handling in AI applications.
- OWASP Agentic AI guidance
- Threats specific to agents: tool misuse, excessive authority, memory poisoning, and identity abuse.
- MITRE ATLAS
- Adversary tactics and techniques against AI systems, used to plan realistic red-team scenarios.
- NIST AI Risk Management Framework
- Structure for governance work: govern, map, measure, and manage AI risk.
- NIST Cybersecurity Framework
- Connects AI controls to your existing security program and reporting.
- ISO/IEC 42001
- AI management-system requirements, used to shape governance and evidence ahead of any certification effort.
- EU AI Act
- Risk-tier and obligation mapping for organizations with exposure to the EU market.
Framework alignment is scoped to each engagement and is not represented as certification, legal advice, or automatic compliance.