AI-driven security audits · NeoSur Intelligence NV

Findings you can defend in a boardroom.

Cordon reads your codebase with isolated agents, builds a coverage ledger so nothing is quietly skipped, then hands every candidate finding to a fresh agent whose only job is to disprove it. What survives is traced to source. What doesn't, never reaches your report.

Book a security review → See how it runs

Source-first, never probe production Six phases, full audit trail Schemas validated, not eyeballed

Most scanners tell you what might be wrong.
A Cordon report tells you what is wrong, where, and how you'd prove it under questioning.

The verifier never found it. Independence is the method, not a promise: the agent that confirms a finding is a different agent from the one that proposed it.
Severity is earned. No severity is assigned to a hypothesis. If the deciding fact sits outside your source, it ships as needs_validation — with the exact missing fact.
Coverage is countable. Every surface, boundary and attack class is a ledger unit with an owner and a state. You can read what was not looked at.

The method

Six phases. No shortcuts between them.

An audit is only as good as its weakest handoff. Each phase produces an artifact the next one is forced to respect — and the run cannot end without both validators passing.

01 — Reconnaissance

Map the ground

Architecture, trust boundaries, input surfaces and prior evidence, written to a coverage ledger before a single finding is hunted.

02 — Hunting

Coverage-led, not vibes-led

Isolated hunters work from ledger units with named attack classes. Coverage critics then hunt the gaps the first wave left behind.

03 — Validation

Try to break it

Every unique candidate goes to a fresh verifier instructed to disprove it. Three verdicts only: confirmed, needs validation, rejected.

04 — Output

Machine-checkable

Findings land in a schema-validated findings.json. A record that fails validation is a defect to fix, not noise to ignore.

05 — Verification

Re-read the claims

Fresh agents re-verify every final source claim. A material correction gets another independent verifier, not a re-run of the same one.

06 — Report

Written to be argued with

Report, finding detail and open questions are derived from the verified records — never from prose that drifted away from the JSON.

What we audit

Where the boundary actually is.

Web applications & APIs — request framing, authentication and session protocols, cache behaviour, tenant isolation.
Client-side surfaces — DOM injection, messaging trust, UI redress, prototype pollution.
Supply chain & release — dependencies, CI pipelines, signing, update paths, plugins and extensions.
Cloud & deployment — IAM, infrastructure as code, containers, serverless, ingress configuration.
AI & LLM systems — prompt injection, tool and agent boundaries, output handling.
Native & binary — memory safety, local IPC, daemons, desktop and mobile exported components.

The deliverable

Structured enough to file as a ticket.

You receive the report a person reads and the records a pipeline can consume. Same source, no drift between them.

findings.json

// illustrative shape, not client data
{
  "verdict": "confirmed",
  "severity": "high",
  "boundary": "cross-tenant read",
  "source_trace": [
    "api/handlers/export.ts:142",
    "lib/tenant/resolve.ts:37"
  ],
  "observed_result": "dummy tenant B record returned"
}

REPORT.md · FINDINGS-DETAIL.md · NEEDS-VALIDATION.md

Three audiences, one truth

An executive summary for the decision, a technical detail file for the engineer who fixes it, and a separate list of what remains unproven — with the exact fact that would settle it.

Nothing in the report is allowed to claim more than the records support.

Engagement

Start where the risk is.

A focused review of one surface, a full codebase audit, or a re-run that measures what changed since the last one. Most teams begin with one application and extend from there.

Audit subscription

From USD 500 / month

Scope-dependent. Fixed fee per audit cycle, quoted after the first reconnaissance call.

One application in scope, per cycle
Schema-validated findings plus a written report
A re-run against your fixes, with the deltas called out

Request a proposal →

NeoSur Intelligence NV

Bring us the codebase you're least sure about.

Tell us what it does, who attacks it, and what keeps you up at night. We'll tell you honestly whether an audit will find anything worth the invoice.

Book a review → See all services