Sample Work — Axiomeer

Excerpt 01 — AI Security Readiness Assessment

Executive threat model readout

One page from the executive pack. The full deliverable carries two to three of these, each traced to a specific system and priced into the remediation roadmap.

Threat Model — Customer Support Copilot

Client: Series B health-tech, ~380 staff
Engagement: AI Security Readiness
Classification: Confidential — Board

System in scope

A vendor-hosted assistant embedded in the support desk. It reads inbound ticket text, retrieves from an internal knowledge base, and holds a tool integration permitting lookup of customer account records. Deployed by the support function in Q1; no security review was performed prior to launch.

Assessed exposure

Critical. Untrusted external text reaches a model holding a data-retrieval capability scoped more broadly than the requesting user's own permissions. Exploitation requires no privileged access and leaves no distinguishing signal in current logging.

Attack path

An external party submits a support ticket containing instructions directed at the assistant rather than the agent — the ticket body is attacker-controlled input. (OWASP LLM01 — Prompt Injection)
The assistant processes the instruction as part of its context and invokes the account-lookup tool, which is not constrained to the requesting customer's own record. (OWASP LLM06 — Excessive Agency)
Retrieved third-party account details are rendered into the drafted reply and returned to the original sender. (OWASP LLM02 — Sensitive Information Disclosure)
Support logs record a normal ticket interaction. No alert fires; the event is indistinguishable from ordinary activity. (MITRE ATLAS — evasion via legitimate interface)

Controls present

Vendor-side content filtering (marketing-documented, not contractually specified). Agent review before send — the reply is not auto-dispatched, which is the sole meaningful barrier and depends entirely on the agent noticing anomalous content under queue pressure.

Gaps

Tool scope: Account lookup is not bound to the ticket's originating customer identity.
Input handling: Ticket content is not delimited or treated as untrusted within the prompt context.
Detection: No logging of tool invocations or retrieved record identifiers; the event is unreconstructable after the fact.
Contract: The vendor agreement contains no provision on model behaviour, retention, or breach notification for AI-specific failures.

Recommendation

Immediate (0–30 days). Bind the account-lookup tool to the ticket's verified customer identity — this single change eliminates the disclosure path independent of model behaviour. Enable tool-invocation logging with retrieved record identifiers.

90 days. Introduce an AI vendor review gate covering data handling, retention, and breach notification, and apply it retroactively to the three assistants already in production.

Board framing

A customer-supplied message can, without any credential or system compromise, cause our support assistant to disclose another customer's account information — and we would not currently detect it. The corrective action is a permission change, not a platform replacement, and is scoped at under two engineering days.

Excerpt 02 — Third-Party Access Audit

Access risk inventory

An extract from the inventory delivered with every access audit. The full matrix lists every authorisation in the tenant; this shows the classification logic and the revoke-first ordering.

Third-Party Access Inventory — Extract

Client: ████████ · 210 seats
Platform: Google Workspace
Authorisations found: 94

Summary

Applications authorised

Critical — revoke first

Medium — review

Unused for 90+ days

Revoke-first extract

Application	Publisher	Access granted	Users	Last active	Risk	Rationale & action
██████ Sync	Unverified	Full Drive · read/write	1	418 days	Critical	Authorised by a user who left in 2025. Token remains valid with full file access. Revoke immediately.
████ Analytics	Unverified	Domain-wide delegation	All	62 days	Critical	Delegation granted for a 2024 migration that concluded. Impersonates any user. Revoke; confirm project closed.
███████ Notetaker	Unverified	Calendar · Drive · Meet recording	14	2 days	Critical	Adopted organically; records client calls and retains transcripts on vendor infrastructure. No DPA in place. Suspend pending vendor review.
█████ CRM Connector	Verified	Gmail · read-only	38	Today	Medium	Business-critical and verified, but mailbox scope exceeds requirement. Reduce to metadata scope.
██████ Scheduler	Verified	Calendar · read/write	52	Today	Low	Scope proportionate to function; publisher verified. No action.

Classification basis

Risk is scored as data sensitivity × access level × publisher posture, applied identically to every authorisation and stated in the report so the rating is auditable rather than asserted. Findings map to SOC 2 CC6.1–6.3 (logical access) and, where regulated data is in scope, to HIPAA minimum-necessary provisions.

Delivered alongside

The complete 94-row inventory, the ordered revoke list formatted for an administrator to execute directly, the control-mapping page for the audit file, and a 60-minute findings session with the team.

See the documentation before you commit to a call.