What's included

How we approach it

• Scope and rules of engagement. Agreed in writing, before the first packet.
• Recon and attack. We chain findings into the path that actually carries risk.
• Prioritised remediation. Specific, with the context to fix the root cause.
• Retest and prove. We confirm the risk is closed and give you the evidence.

What you get

• A findings report written for engineers and for the board.
• Reproducible proof for every finding, with business impact.
• A prioritised remediation plan.
• A free retest to confirm the fixes hold.
• An executive readout.

Typical engagement

Most engagements start as a focused test of your highest-risk estate — a crown-jewel application, your external perimeter, or a red-team objective — over two to four weeks, then move to a continuous programme where that fits.

Common questions

What's included

How we approach it

• Map the estate and identities. We see what you run and who can reach it.
• Review against benchmarks and attack paths. Not just a checklist — how it breaks.
• Prioritise by blast radius. We fix what a breach would reach first.
• Prove the fix. We retest and confirm the exposure is closed.

What you get

• A posture report mapped to benchmarks and real attack paths.
• Findings prioritised by blast radius, not raw count.
• Identity and infrastructure-as-code guardrails.
• A free retest to confirm the fixes hold.

Typical engagement

A point-in-time review of one cloud or subscription over one to three weeks, or a continuous posture programme for estates that change every day.

Common questions

What's included

How we approach it

• Gap assessment. Where you are against where the standard expects you to be.
• Remediation and build. Controls and policies people can actually follow.
• Evidence and internal audit. We make you audit-ready and run the internal audit.
• Sustain. Virtual CISO leadership keeps the programme alive after certification.

What you get

• A gap report against your chosen standard.
• Controls and policies written for how you actually work.
• A board-ready risk register.
• An audit-ready evidence pack.

Typical engagement

A certification-readiness programme over three to six months, or ongoing virtual CISO leadership for organisations that need the capability without the full-time hire.

Common questions

What's included

How we approach it

• Onboard and baseline. We learn your estate and what normal looks like.
• Tune detections. We raise the signal and cut the noise.
• Monitor, hunt and respond. Round the clock, with agreed authority to act.
• Review and improve. Every incident makes the next detection better.

What you get

• Monitoring coverage across your estate.
• Tuned detections mapped to attacker techniques.
• Monthly reporting you can take to the board.
• An incident runbook, and response on standby.

Typical engagement

A managed service with onboarding over two to four weeks, then continuous coverage. Incident response is also available on standby for the day you need it.

Common questions

What's included

How we approach it

• Define the gap and level. The role, the scope, and what good looks like.
• Match vetted people. Background-checked and qualified for the role.
• Embed and deliver. Inside your team, or delivering an outcome end to end.
• Transition or extend. Hand over, convert to a hire, or keep the capability.

What you get

• Vetted practitioners matched to the role.
• A clear statement of work.
• Regular delivery updates.
• A transition or hand-over plan.

Typical engagement

Individual specialists or a small pod, project-based or contract-to-hire — from a few weeks to a standing engagement that grows with you.

Common questions

What's included

How we approach it

• Discover. Build a cryptographic inventory across your estate.
• Assess. Rank your quantum risk by data sensitivity and lifetime.
• Plan. A prioritised, standards-aligned PQC migration roadmap.
• Prove. Validate the quantum-safe path and confirm crypto-agility.

What you get

• A cryptographic inventory of your estate.
• A quantum risk register, ranked by exposure.
• A prioritised PQC migration roadmap.
• An executive briefing on quantum risk and the plan.

Typical engagement

A focused readiness assessment over a few weeks, then a phased migration you can plan around — starting with your longest-lived, highest-value secrets.

Common questions

What it tests

What it tests for

Thirty-four threat categories across 120 attack vectors, each one tied to a business consequence rather than a technical curiosity. Data and privacy — data leakage, prompt injection, system prompt extraction, credential theft, exposure of regulated information. Brand and operations — jailbreak, hallucination, toxicity, misinformation, excessive agency, denial of service. Regulatory and ethics — bias and fairness across nine axes, safety constraints, training data poisoning, social engineering, supply chain.

How it works

• Connect. Point it at the AI systems you already run. No change to how they are built or hosted.
• Attack. It composes payloads rather than replaying a fixed list, adapts on near misses, and keeps the vectors that worked.
• Score. Every finding rated 0 to 100 and banded from Minimal to Critical, with the conversation that produced it attached.
• Act. Findings push into your tracker, evidence goes to your auditor, and the brief goes to your board.

Your data never leaves

Arka runs inside your network with local inference. No prompts, no model outputs and no findings leave your environment at any point, and it works in air-gapped deployments. For regulated organisations this is usually what decides the question, because most AI security tooling needs you to send exactly the data you are not permitted to send.

Evidence your auditor will accept

What you get

• A score for every finding, banded for sequencing.
• The transcript behind each one, so it can be reproduced.
• Compliance mapping across seven frameworks.
• A board brief alongside the technical report.
• Re-runs on every release, so posture is trended rather than frozen.

Who it is built for

Regulated organisations whose AI carries encoded safety constraints, data access controls and compliance obligations — and where someone has to prove those constraints hold under attack. Healthcare and clinical decision support. Banking, customer AI and KYC. Insurance claims and underwriting. Hospital patient safety. Critical infrastructure. Voice agents handling live calls.

Common questions

What it covers

How it works

• Scope. Choose the frameworks and apply scope. The platform lays out every control you have to answer, one row at a time.
• Collect. Your team uploads evidence straight into the workspace. No attachments chased over email for six weeks.
• Score. Each control is rated Met, Partially Met, Not Met or Not Applicable, against its test objectives.
• Guide. Remediation guidance is drafted from the control, the evidence and maturity criteria, then reviewed by a consultant before you see it.
• Publish. A numbered snapshot is frozen for the record. You see v1, v2, v3 as the picture improves, never a document edited under you.
• Report. Export to PDF, Excel or Word from any published version.

Gaps that actually close

Every gap carries an owner, a target date and the evidence that will close it before anything is published, and a remediation plan is built from the gap register in a single step. A gap cannot quietly go stale, and the plan to fix it is not a follow-up email that someone forgets to send.

Guidance you can explain

Remediation wording is generated from the control text, the evidence library and maturity criteria, not an opaque model, and a consultant signs it off before it reaches you. You can always see why a control was scored the way it was, which is the part an auditor asks about.

Runs where your evidence has to stay

Deploy Arro hosted, or on your own premises. For regulated organisations that cannot send audit evidence outside their environment, it runs entirely inside it, and the published record never leaves your control.

What you get

• One control library mapped across every framework in scope.
• A versioned snapshot at each milestone, evidence that cannot be quietly edited.
• A gap register where every gap has an owner, a date and closure evidence.
• Remediation tracked from gap to retest to closed.
• Reports in PDF, Excel and Word, from any published version.

Who it is built for

Organisations preparing for certification or running recurring assessments across information security, privacy and third-party risk, and the teams who have to show, not assert, that their controls hold. It is also the platform behind every KonarkX governance and compliance engagement.

Common questions