Production AI · Custom annual engagement

Continuous AI Assurance

Keep security evidence current as your AI system changes.

For teams whose baseline assessment and release roadmap show recurring review work across sensitive data, agents, tools, or permissions. Confirm the need and engineering ownership before committing to an annual plan.

Scope & deliverables

What the engagement covers.

Quarterly red-team testing

Schedule focused testing of agreed production-representative AI workflows each quarter. Prioritize changes and risk using the current system inventory and prior findings.

Release, model, and provider reviews

Maintain a versioned change and regression record for reviewed releases, models, providers, and routing. Link each material change to affected assumptions, test cases, findings, and evidence within agreed capacity.

Tools, MCP, and architecture changes

Examine new tools, MCP integrations, retrieval sources, memory systems, architecture changes, and new agents before or around the agreed rollout milestone.

Identity and permission reviews

Review agent identity, delegated access, tool scope, cross-tenant permissions, and approval boundaries as the product evolves.

Enterprise questionnaire support

Support agreed security questionnaires with current testing context, evidence, and accurate scope statements. Define volume and response windows in the plan.

Annual comprehensive reassessment

Reassess the agreed system each year. Consolidate coverage, versions, regression evidence, finding status, and fix verification. Review completed work and expected changes before agreeing renewal.

Baseline to renewal

Keep a record that explains what changed.

Versioned regression record

Identify the system version, model/provider, retrieval and tool configuration, test identities, expected boundary, test date, evidence, and remaining limits. Link fixes to the finding and verification result.

Renewal tied to useful work

Review material changes assessed, unresolved findings, repeated boundary failures, and engineering follow-through. Match the next plan to the actual roadmap and review workload, with capacity agreed before renewal.

Commercial scope

Know what you are commissioning.

Custom annual engagement. The proposal defines covered systems, quarterly test windows, change-review capacity, questionnaire allowances, response windows, retest terms, and annual reassessment scope. Material scope growth is quoted explicitly. An initial assessment establishes or confirms the baseline; its commercial treatment is agreed in the proposal.

Before work begins, agree delivery dates, authorized access, exclusions, data handling, and payment terms. Review our methodology and report expectations.

Practical answers

Before we start.

Is this real-time monitoring or incident response?

This offer covers planned testing, change review, and evidence support. It does not include runtime monitoring, SOC/MDR, on-call containment, or emergency incident response.

Are release reviews unlimited?

No. The annual scope defines included systems, review capacity, notice periods, response windows, and how additional changes are prioritized or quoted.

How does the annual plan start?

Complete or validate a baseline assessment first. Review its findings, the next-quarter roadmap, and the team’s capacity to implement fixes. Agree an annual calendar only when recurring work is concrete; targeted follow-up can suit a stable system.

Why reassess between annual pentests?

Changes to models, retrieval, identity, tools, or agent permissions can change the assumptions behind a previous result. We use the agreed change criteria to decide when additional review is needed.

Prepare for the engagement

Relevant buyer guides.