Glasswing-Grade Security

Security Assessment Tiers

Choose the depth that matches your timeline and budget.

Security Snapshot

$500

2-4 hours | Rapid baseline

Automated codebase scan (Guardian)
Dependency analysis (Mythos)
STRIDE threat model (high-level)
Top 10 critical findings
Executive summary + remediation guide

Start Snapshot

Defensive Assessment

$2,000

1 week | Comprehensive audit

Complete codebase security audit
Agents of Chaos failure mode mapping
STRIDE per-service threat model
30-40 findings (detailed)
Remediation playbook + 30-day follow-up
Email support for implementation

Schedule Assessment

Enterprise Hardening

$5,000–10,000

4 weeks | Full transformation

Everything in Defensive Assessment
Agent hardening implementation
Auth/authz architecture setup
CI/CD security pipeline
Quarterly red-team reviews (1 year)
Incident response plan
90-day implementation support

Discuss Enterprise Plan

Our Methodology

STRIDE Threat Modeling

Model threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Design-time security thinking, not just code review.

Agents of Chaos Framework

Assess resilience across 8 failure modes: Prompt Injection, Authorization Bypass, Dependency Poisoning, Configuration Drift, Monitoring Gaps, Failure Cascade, Recovery Weakness, Attestation Failure.

NIST AI Agent Standards

Align with NIST's Feb 2026 AI Agent Standards for risk assessment, responsible AI practices, operational security, and supply chain security.

OWASP Top 10 + Extended

Traditional application security (injection, broken auth, sensitive data exposure) plus AI-specific risks (LLM integration, model poisoning, insufficient monitoring).

Guardian Static Analysis

Our proprietary engine scans for security anti-patterns, misconfigurations, and AI-specific risks across all code paths. No false positives; real, actionable findings.

Glasswing-Informed

Built on research from Anthropic's $100M Project Glasswing, a defensive cybersecurity coalition strengthening defenses for AI safety, open-source, and critical infrastructure.

Sample Findings

Real vulnerabilities from recent assessments (anonymized). This is the caliber of findings you'll get.

Finding	Severity	Category	Remediation
Database credentials hardcoded in config file	CRITICAL	Configuration	Move to environment variables / secrets manager
JWT tokens lack expiration and revocation mechanism	HIGH	Authentication	Add token expiration (15 min) and refresh token rotation
LLM prompts directly interpolate user input (injection vulnerability)	HIGH	AI Agent Security	Sanitize inputs, use structured output, add jailbreak detection
API endpoints lack authorization checks (multi-tenant data leak)	CRITICAL	Authorization	Validate user ownership for all resource access
Missing rate limiting on authentication endpoints	HIGH	Rate Limiting	Implement 5-failed-attempt lockout (15-min cooldown)
No audit logging for privileged operations	MEDIUM	Logging & Monitoring	Add audit logging; store in immutable, append-only log
Dependency vulnerability in lodash (CVE-2021-23337)	MEDIUM	Supply Chain	Upgrade to lodash 4.17.21+; add security gate in CI/CD
CORS configured with wildcard origin	HIGH	Configuration	Whitelist specific origins; validate origin header

Tools & Research We Use

Guardian (Dominion Labs proprietary static analysis)

Mythos Analyzer (dependency scanning & supply chain risk)

Agent Hardener (AI safety validation)

NIST AI Agent Standards (Feb 2026)

Agents of Chaos framework (8 failure modes)

STRIDE threat modeling

OWASP Top 10 + AI extensions

Project Glasswing research