AI security reviews, policy, and red-teaming
Secure the AI your staff use.Test the AI you build.
Your staff already use AI tools, and some of your data goes with them. If you build AI into your products, it can be manipulated in ways ordinary testing misses. Custos covers both.
Start with a fixed-fee review of where company data goes through the AI tools your people use. For AI you build, we test it the way an attacker would, under written authorization, and retest after you fix it.
- $2,500 shadow AI review, about two weeks
- Testing only under signed rules
- Every finding with evidence and a fix
Start free
Find out where your AI risk is before you spend anything.
Run the five-minute shadow AI check, or spend 20 minutes with a security engineer. When you want facts, the $2,500 shadow AI review finds every AI tool in use and the data reaching it.
- 01Check, freeFreeTake the five-minute shadow AI check, or ask a security engineer about your tools or system.
- 02Find the exposure$2,500Every AI tool your staff use, the data reaching it, vendor terms, and prioritized fixes.
- 03Control it, or test what you build$4,500 / from $7,500A policy with enforced settings for staff AI use, or a red-team assessment of the AI you build.
- 04Keep watchMonthlyMonthly checks of new tools and settings, and quarterly retests of the AI you build.
Each step stands on its own. You never commit to the next one in advance.
Not ready to talk? Take the five-minute shadow AI check, or read how the two tracks work.
Two tracks
The AI your staff use. The AI you build.
Start with the $2,500 shadow AI review, or a red-team assessment from $7,500. Fixed fees, in writing, before any work.
Start free No sales pitch. Use them before you talk to anyone.
Staff AI use
Find it, then control it.
- CENSUSShadow AI ReviewFind out which AI tools your staff use, and what company data goes with them.Latin for “a count, a register,” the root of “census.”$2,500Every tool, every data flow
- LEXAI Policy & ControlsA written AI use policy your staff can follow, and the settings that enforce it.Latin for “law,” the root of “legal.”$4,500
AI you build
Tested like an attacker would.
Ongoing
Watched every month.
Compare the services side by side, or see every price. All services · Pricing
What you get
Findings you can act on, with the evidence behind them.
Every engagement ends with a report your team can work from, and a readout to walk through it.
- 01
An AI tool inventory
Every AI tool and AI feature in use, including the free ones staff signed up for.
- 02
A data exposure map
Which company data reaches each tool, and what the vendor may do with it.
- 03
Rated findings
Each finding with severity, evidence, reproduction steps where relevant, and a specific fix.
- 04
A retest
For AI you build, fixed findings are retested and the report updated.
How an engagement runs
Scoped and authorized first. Then tested and reported.
Nothing is reviewed or tested outside the scope you sign. Every finding is checked by a second engineer.
- ScopeWe agree what is in scope, the sources, and the contacts.
- AuthorizeYou sign the engagement letter and, for testing, the rules of engagement.
- Review or testCustos engineers review tools and data, or test your AI system.
- DecideYou decide which findings to fix, and in what order.
- RetestFixed findings are retested, and the report updated.
From engineers who build AI
Tested by people who know how it breaks.
Our engineers design and ship AI systems for Sophrono clients. They test yours with the same knowledge of where these systems fail.
Shadow AI Review
Find out where your data goes when your staff use AI.
The $2,500 review inventories every AI tool in use, maps the data reaching each one, and checks the vendor terms, in about two weeks.
Pricing
Fixed fees to start. Monthly only if you want it.
You know the cost of each service before you commit.
Staff AI use
The shadow AI review is $2,500. Policy and controls are $4,500. Both fixed, for organizations up to 500 staff.
AI you build
The red-team assessment starts from $7,500, set by scope at scoping, with one retest included.
Ongoing
Monitoring is a monthly fee, quoted by the tools, staff, and systems in scope.
Assessments report what was tested, how, and what was found within the agreed scope. No assessment can show that a system is free of every weakness.
Always yours
Decisions that stay with you.
We find, test, and report. These stay with a named person in your organization, every time.
- What is in scope, and what is not01
- Authorization for every test02
- Which findings to fix, and in what order03
- Which AI tools staff may use04
- What to tell customers, auditors, and insurers05
- Which remaining risks to accept06
- We report what we find. You decide what to fix.
Super Intelligence Newsletter
What AI can do now, in plain English.
From Sophrono, the firm behind Custos: several emails a week on how AI capability is moving and what it changes for your business.
Our standards
Seven rules for every engagement.
Each one is in the engagement letter or the rules of engagement, so you can hold us to it.
SCOPE
Authorized first.
Only what you sign, only how you agreed.
- IIStaging by default.Production testing only with explicit written approval and limits.
- IIINo installed software.Reviews use access you choose to share, read-only.
EVIDENCE
Every finding shown.
You can reproduce what we report.
- IVEvidence with every finding.Steps, screenshots, or records your engineers can check.
- VA second engineer reviews.No finding reaches you unchecked.
CANDOR
Limits stated.
What was tested, and what was not.
- VINo “secure” stamp.Reports say what was tested, never that nothing is left to find.
- VIIFixes, not fear.Every finding comes with a specific, proportionate fix.
Why “Custos”
Custos is Latin for guardian. Juvenal asked the old question: who guards the guardians? Our answer is evidence: every finding shown, every test authorized, every limit stated. Custos is a service of Sophrono. Read the story.