An AI security lab building grounded, verifiable tooling - threat models, risk analysis, and governance that run where your data lives.
Not chatbots bolted onto dashboards. Purpose-built agents that reason about threats, ground every finding in real frameworks, and refuse to invent what they can't verify.
Describe a system in plain English; get a STRIDE data-flow diagram, findings mapped to ATT&CK / CWE / OWASP, and residual risk scored against the controls actually in place.
Adversarial testing, prompt-injection defence, and agentic / MCP threat assessment - the attack surface that appears the moment a model gets tools.
Risk analysis grounded in regulated-finance reality, where a control failure is measured in findings, not just tickets.
EU AI Act classification, ISO 42001, NIST AI RMF - turning framework text into decisions an organisation can actually act on.
CTI agents that pull, verify, and reason over advisory feeds - with the indirect-injection paths that come with them already closed.
The map of an organisation's weaknesses never leaves its machine. Runs on local inference - offline, air-gappable, defensible.
Public repositories and demonstrations - real agents, security-assessed and CI-gated.
A multi-agent cybersecurity platform spanning threat intel, SecOps, threat modelling, cyber risk, and governance - local-first, with a verification pipeline throughout.
A CTI agent with a documented security assessment behind it - including a fixed indirect prompt-injection flaw where feeds reached the model unfiltered.
Plain-English in, STRIDE diagram out - findings mapped to real technique IDs, residual risk scored, and nothing invented. Runs locally.
A cyber domain and brand-monitoring agent for impersonation and exposure detection - built end to end, SAST-clean, with CI security gates.
Every agent is built on the same discipline: deterministic rules decide the security logic, the model only writes the prose, and a verification pass checks nothing was invented.
Narendra Karki - 25+ years on the defending side of security in regulated financial services across the GCC and UK. Security architecture, cyber risk, and the governance that keeps both accountable.
The lab is where that experience meets AI: tooling held to the same standard as the environments it came from - grounded, verifiable, and honest about its limits.