02Service line
AI engineering, security and governance services for production systems
Onion Infosec designs, builds and secures AI systems: LLM applications, retrieval-augmented generation, agents and automation connected to enterprise data and tools. Every build includes evaluation, access control, monitoring and governance, because the same company also tests and defends these systems.
- Line
- 02 of 07 · AI
- Shape
- Decide → Build → Run → Secure → Govern → Apply
- Delivery
- Project, retainer or managed service
01Context
What the AI service line covers
The AI line covers the full path from deciding where AI is worth using to running it in production. That includes use-case assessment and data readiness, engineering of applications built on large language models, integration with existing systems and workflows, and the infrastructure needed to serve, evaluate and observe models.
It also covers the two areas most AI projects leave until late: security and governance. We threat-model and test LLM applications, run AI red team exercises, and help organizations set usage policy and align with ISO/IEC 42001 and the NIST AI Risk Management Framework. Systems are built on commercially available foundation models and open-weight models, selected per use case after evaluation.
- A prototype is a long way from a production system
- A demo built on a prompt and an API key is quick to make. Production needs evaluation, access control, cost limits, monitoring and a fallback for when the model is wrong. That engineering decides whether a pilot becomes a system people can rely on.
- LLM applications fail in new ways
- Prompt injection, sensitive information disclosure, insecure output handling and excessive agency are design-level risks. A conventional web application test does not look for them, so they need to be modeled and tested before launch.
- Governance questions arrive early
- Customers, auditors and regulators ask which AI systems are in use, what data they touch and who is accountable. An inventory, a usage policy and a risk assessment method answer those questions with evidence.
Architecture
An AI system is an application with a new kind of input.
A language model cannot tell an instruction from a document. That one property decides where the trust boundary goes, and what has to be tested, governed and watched.
An AI system drawn left to right: enterprise data, then retrieval that turns documents into context, then a large language model, then the application, assistants and agents, which call tools and APIs and serve people and systems. A dashed trust boundary surrounds retrieval, model and application, because everything entering the model's context is untrusted input. Beneath the system run three rails: security, governance aligned with ISO/IEC 42001 and the NIST AI RMF, and operations.
Trust boundary
Threat modeling, prompt injection testing, output handling, agent and tool permissions.
AI usage policy and risk management aligned with ISO/IEC 42001 and the NIST AI RMF.
Evaluation runs, monitoring, prompt and model updates, cost control.
- Data and request flow
- Trust boundary: everything that enters the context window is untrusted
02Approach
How we work on AI
Work starts from a specific task and a way to measure it. Before building, we agree what a good output looks like, assemble an evaluation set from real examples, and decide what the system must never do. Model choice, retrieval design and prompt design are then tested against that set instead of judged by impression.
Security and governance run inside the same project. Data access is scoped per user, tool permissions for agents are kept minimal, and inputs and outputs are logged for review. A threat model and a risk assessment are produced alongside the architecture, so there is no separate security phase at the end.
01
Evaluate before and after every change
Prompts, models and retrieval settings are versioned, and each change is run against the evaluation set. Regressions are caught before release.
02
Least privilege for models and agents
A model sees only the data the requesting user may see. An agent gets only the tools the task needs, with human approval for actions that are hard to reverse.
03
People stay accountable
Outputs that affect customers, money, safety or security decisions are reviewed by a person. The system records what it recommended and what was decided.
04
Portable by design
Model providers are accessed through an abstraction layer where practical, so a model can be replaced when cost, quality or policy changes.
03Capabilities
How AI work is organized.
Decide
Choose use cases worth building and confirm readiness.
Build
Engineer applications, agents and automation.
Run
Operate models and pipelines with evidence of how they behave.
Secure
Test and harden AI systems against misuse.
Govern
Keep risk, policy and accountability in step with adoption.
Apply
Put AI to work inside security operations.
AI strategy and readiness
Decide where AI is worth using before spending on it. These engagements produce a ranked list of use cases, a view of data and platform readiness, and a plan a delivery team can start from.
- AI use-case assessmentWorkshops and process review that identify candidate use cases and rank them by value, feasibility, data availability and risk. Output is a prioritized shortlist with a recommendation for each.
- Data readiness reviewAssessment of the data a use case depends on: where it lives, its quality, who owns it, and which access and privacy constraints apply. Gaps are listed with the work needed to close them.
- Build, buy or configure analysisComparison of custom development, commercial AI products and AI features already present in platforms the organization owns. The result is a costed recommendation per use case.
- AI roadmap and operating modelA sequenced plan covering use cases, platform, skills, governance and budget, with named owners and decision points.
- Proof of concept designDefinition of a time-boxed proof of concept with success criteria, an evaluation set and exit conditions agreed before any build starts.
AI engineering
Design and build of applications that use large language models and other machine learning models. Each build ships with an evaluation suite, access controls and the documentation a team needs to run it.
- AI application developmentEnd-to-end build of AI-enabled features and standalone applications, including the interface, backend, model integration and deployment pipeline.
- Generative AI solutionsDrafting, summarization, classification, extraction and conversational systems built on foundation models. Prompts, guardrails and evaluation sets are delivered as versioned assets.
- LLM integrationConnection of hosted or self-hosted language models to existing products and internal systems through a gateway that handles authentication, routing, rate limits, cost tracking and logging.
- RAG applicationsRetrieval-augmented generation over internal documents and data: ingestion, chunking, embedding, hybrid search, reranking and cited answers. Document-level permissions are enforced at query time.
- AI agentsAgents that plan and call tools to complete multi-step tasks. Tool scopes, approval steps, budgets and audit logs are designed in, and behavior is tested against adversarial inputs.
- Enterprise AIInternal assistants and search connected to knowledge bases, ticketing and line-of-business systems, with single sign-on, role-based access and usage reporting.
- Model evaluation and selectionSide-by-side testing of candidate models on your tasks for quality, latency, cost and data-handling terms. Output is a documented selection, and the evaluation harness is retained for future use.
AI automation and integration
Apply AI to specific steps in existing workflows and connect it to the systems where work already happens. The aim is a measurable reduction in manual handling, with a clear route for exceptions.
- Workflow automation with AIRedesign of a process so that classification, routing, drafting or data entry steps are handled by a model, with confidence thresholds and a human queue for exceptions.
- Intelligent document processingExtraction of structured data from invoices, contracts, forms and correspondence using OCR and language models, with validation rules and review screens for low-confidence fields.
- Enterprise system integrationConnectors between AI services and CRM, ERP, ITSM, collaboration and data platforms through APIs, event streams and webhooks.
- Conversational interfacesChat and voice interfaces for customer service and internal support, grounded in approved content and able to hand over to a person with full context.
- Tool and API design for agentsDesign of the functions an agent may call, including input validation, scoped credentials and idempotent actions, so that automation is safe to retry and easy to audit.
AI infrastructure and observability
The platform work that keeps AI systems available, affordable and measurable. Delivered as code on the cloud platform or data center you already use.
- Model serving and hostingDeployment of models through managed AI services or self-hosted inference servers, with autoscaling, network isolation and capacity planning for GPU workloads.
- LLMOps pipelinesVersion control and CI/CD for prompts, retrieval configuration, evaluation sets and model settings, so that every release is reproducible and can be rolled back.
- Vector and data infrastructureSelection and operation of vector stores, embedding pipelines and document sync jobs, including re-indexing strategy and deletion handling.
- AI observabilityTracing of prompts, retrieved context, tool calls and responses, with dashboards for quality scores, latency, token usage and error rates.
- Cost and performance managementCaching, model routing, prompt compression and batch processing to control spend and latency, with budgets and alerts per application.
- Continuous evaluationScheduled and pre-release evaluation runs that score outputs against reference answers and rubric checks, and flag drift after model or data changes.
AI security
Security assessment and testing for systems that use AI, delivered by the practitioners who run our application and offensive security work. Findings come with fixes an engineering team can apply.
- LLM securityArchitecture and code review of LLM features covering prompt handling, output handling, data flows, tool permissions and secrets. Findings are rated and mapped to the OWASP Top 10 for LLM Applications.
- AI threat modelingStructured threat modeling of AI features against the OWASP Top 10 for LLM Applications and MITRE ATLAS, covering prompt injection, sensitive information disclosure, supply chain risk and excessive agency.
- AI red teamingAdversarial testing of models, agents and the applications around them: direct and indirect prompt injection, jailbreaks, data extraction, tool abuse and unsafe output. Results include reproducible test cases.
- Guardrail design and testingDesign of input and output filtering, content policy checks and action approval steps, followed by tests that measure how often the guardrails hold.
- Data leakage controls for AIControls that keep sensitive data out of prompts, logs and third-party services: redaction, data classification rules, tenant isolation and retention settings.
- AI supply chain reviewReview of third-party models, datasets, plugins and AI-enabled SaaS for provenance, license, data-handling terms and known weaknesses.
AI governance and risk
A working governance structure for AI: who may use what, for which purpose, with which data, and how risk is assessed and recorded. Sized to the organization instead of copied from a template.
- AI risk assessmentAssessment of individual AI systems and use cases for security, privacy, safety, fairness and legal risk. Each produces a risk record with treatment decisions and owners.
- AI usage policyAn acceptable use policy for staff and developers covering approved tools, data that may be entered, review requirements and disclosure. Delivered with rollout guidance.
- AI system inventoryA register of AI systems in use, including AI embedded in purchased software, with purpose, data categories, owner and risk tier.
- ISO/IEC 42001 readinessGap assessment and implementation support for an AI management system aligned with ISO/IEC 42001: scope, policy, roles, impact assessment and controls. We prepare organizations for audit and do not certify.
- NIST AI RMF alignmentMapping of current practice to the Govern, Map, Measure and Manage functions of the NIST AI Risk Management Framework, with a prioritized action plan.
- Regulatory mapping for AIAnalysis of how AI-specific and data protection obligations, such as the EU AI Act and GDPR, apply to your AI systems and what evidence each requires.
AI for security operations
AI and automation applied to detection, triage and response work. Machines gather context and draft. Analysts decide.
- AI-assisted SOCDesign of triage and investigation workflows in which a model summarizes alerts, correlates related events and proposes next steps. The analyst approves every conclusion.
- Security automationSOAR implementation and playbook engineering for enrichment, ticketing, notification and approval-gated containment across SIEM, EDR, identity and email platforms.
- Alert enrichment pipelinesAutomated lookup of asset, identity, vulnerability and threat intelligence context, so that alerts arrive with the facts an analyst would otherwise collect by hand.
- Analyst assistantsAssistants that translate analyst questions into SIEM queries, explain detections and draft incident notes. Access is read-only unless a person approves an action.
- Autonomous SOC Analyst L1 & L2Our in-house product for AI-assisted triage and investigation is in development and is not commercially available. The automation patterns used in service work inform its design.
04Process
How an AI engagement runs.
Frame
Agree the task, the users, the data involved, the success measure and the actions the system must never take.
Assess
Review data readiness, integration points, and security and privacy constraints. Produce the threat model and the risk record.
Prototype and evaluate
Build the smallest version that can be scored against the evaluation set. Compare models, retrieval designs and prompts on evidence.
Build and secure
Engineer the production system with identity, permissions, guardrails, logging and CI/CD. Run adversarial tests before release.
Release and observe
Roll out in stages with tracing, quality monitoring, cost budgets and a feedback route for users.
Operate and govern
Hand over with runbooks, or continue under a managed service. Keep the inventory, risk record and evaluation set current as the system changes.
What you receive
- Use-case shortlist and AI roadmap with owners and decision points
- Architecture and data flow documentation for each AI system
- Source code, prompts and infrastructure as code in your repositories
- Evaluation set, scoring harness and baseline results
- Threat model and AI red team report mapped to the OWASP Top 10 for LLM Applications
- AI risk assessment records, system inventory and usage policy
- Observability dashboards, cost budgets and operating runbooks
05Technical depth
Typical AI engagements, technology and methods.
AI readiness assessment
A short, fixed-scope engagement. Use cases are ranked, data and platform readiness are reviewed, and the output is a roadmap with a recommended first build.
Proof of concept
A time-boxed build of one use case against agreed success criteria and an evaluation set. Ends with a go or no-go recommendation and an estimate for production.
Production build
A phased project that takes a validated use case to production with access control, observability, evaluation pipelines and runbooks. Delivered by a mixed engineering and security team.
AI security assessment
Fixed-scope threat modeling and adversarial testing of an existing or pre-release AI system, reported with reproducible findings and remediation guidance.
AI governance program
A project that sets up inventory, policy, risk assessment and oversight, aligned with ISO/IEC 42001 or the NIST AI RMF. It can continue as an advisory retainer.
Managed AI operations
An ongoing managed service covering monitoring, evaluation runs, prompt and model updates, cost control and incident handling for AI systems in production.
Technology areas
Model platforms
Application frameworks
Retrieval and data
Serving and operations
AI security testing
Security operations
Technologies are named to describe the work. Naming a product does not indicate a commercial partnership.
Frameworks and methods
OWASP Top 10 for LLM Applications
Baseline for threat modeling and testing LLM features. Findings are mapped to its categories.
MITRE ATLAS
Catalog of adversary tactics and techniques against AI systems, used to plan red team scenarios and describe findings.
NIST AI Risk Management Framework
Structure for AI risk work across the Govern, Map, Measure and Manage functions, including its generative AI profile.
ISO/IEC 42001
Management system standard for AI. Used for gap assessment, implementation support and audit preparation.
ISO/IEC 23894
Guidance on AI risk management, applied alongside the enterprise risk method already in place.
OWASP ASVS
Security requirements for the conventional application code, APIs and authentication that surround every model.
EU AI Act
Reference for risk tiering and documentation duties where a system falls within its scope. One regulatory example among several.
06Across lines
Security and governance are part of every AI build.
Each AI project we deliver includes a threat model, permission design for data and tools, logging of prompts and actions, and an adversarial test before release. A risk assessment record and an inventory entry are created at the same time, so the system is ready for customer and audit questions. The people who do this also deliver our application security, offensive security and GRC services.
07Questions
AI: questions we are asked
No. We build on commercially available foundation models and open-weight models, and select per use case after evaluation. Fine-tuning is used where evaluation shows it is needed and the data supports it. We make no claim to proprietary models, benchmarks or training data.
Yes. Models can be consumed through the AI services of your existing cloud tenant, or open-weight models can be self-hosted in your cloud account or data center. The choice depends on data sensitivity, cost, latency and the skills available to operate it.
By design and by measurement. Answers are grounded in retrieved sources with citations, outputs are constrained to defined formats where possible, and an evaluation set tracks accuracy across changes. Where an error would be costly, a person reviews the output before it is used.
The model, the application around it, and the data and tools it can reach. Work includes threat modeling against the OWASP Top 10 for LLM Applications, adversarial testing such as prompt injection and data extraction, and a review of permissions, logging and guardrails. See AI security.
Not yet. It is one of three Onion Infosec security products in development and is not commercially available. AI-assisted SOC and security automation work is delivered today as a service on the platforms you already run. See security automation and the product page.