Testing and defence led by a published security researcher with five CVEs, including a CVSS 9.1 Mirai botnet kill-switch.
All security →SOC 2, ISO, and the Canadian privacy stack, run end to end with an independent auditor.
All frameworks →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →AI/LLM security is the practice of protecting applications built on large language models and AI agents from threats unique to them, such as prompt injection, data leakage, and model abuse. It addresses risks across the model, its data, its tools, and its outputs. The OWASP Top 10 for LLM Applications is the leading reference for these risks.
LLM-powered products introduce attack paths traditional security never had to consider: untrusted text becomes executable instruction, retrieval pipelines leak sensitive data, and autonomous agents can be steered into abusing their own tools.
A solid AI security pass combines threat modeling of the model, data, and agent surfaces with adversarial testing against the OWASP LLM Top 10. traztech runs the threat modeling and co-delivers the hands-on adversarial work with our offensive-security partner.
traztech delivers AI / LLM security assessments for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
This comes up the moment a product ships a model-backed feature and a buyer asks what the model does with their data. The questions arrive faster than most frameworks have adapted to them.
The failures that matter are architectural rather than prompt-level: what the model can reach, what it retains, what happens to its output downstream, and whether anybody can say which models touch customer data.
Not specifically. SOC 2 will ask whether access is controlled and changes are managed. It will not ask whether customer data is used for training or how you evaluate a model for degradation, which buyers ask every time.
ISO 42001 is the AI management system standard, and the NIST AI RMF is a widely used risk framework. The EU AI Act imposes obligations based on how a system is classified.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation across 76 controls with zero exceptions, on a team of 15.
Before you go
Definitions only get you so far. I send a few short notes on how this plays out in practice. Unsubscribe in one click, and replies reach me directly.
From Jacob Masse, principal of traztech. No spam, unsubscribe in one click.