Aeon AI Risk Management
Penetration testing for systems that can access, execute, or leak.
Aeon CyberGuard is an AI-native pentest lab. It starts with a free public-exposure snapshot and free threat-model call, then moves to a paid diagnostic or signed 10-business-day AI-native pentest review, and finally to an ongoing Release Security Gate retainer.
Questions this page answers
- What does the CyberGuard AI-native pentest lab cover?
- CyberGuard reviews what websites, applications, APIs, AI agents, MCP servers, RAG systems, tool calls, and AI/ML platforms can access, execute, or leak across authorization, command boundaries, and data paths.
- What is the first tier?
- The free public-exposure snapshot uses public sources only to map externally visible AI attack-surface signals. It does not test, probe, or access prospect systems.
- Is CyberGuard authorized-only?
- Yes. The free snapshot and threat-model call are passive and public-only. Any diagnostic, Review, or Release Security Gate testing starts only after signed Rules of Engagement, scope, named authorization owner, test window, data handling, and stop conditions.
- What are the CyberGuard steps from first look to ongoing coverage?
- Start with a free public-exposure snapshot built from public data, review it in a free 60-minute threat-model call, then choose a paid diagnostic or full 10-business-day AI-native pentest review under signed ROE. Teams shipping AI agents continuously can move into the ongoing Release Security Gate retainer.
- Is CyberGuard backed by active security research?
- Yes. Aeon's owned-lab, AI-driven, human-reviewed pipeline found 101 authorization vulnerabilities across 60 open-source AI and infrastructure projects, including 4 Critical and 32 High findings. Aeon's verified public track record includes four patched security advisories and two assigned CVEs.
- Does Aeon provide SOC 2 certification?
- No. Aeon supports SOC 2 readiness with audit-ready evidence your assessor can map to your controls. Your auditor still issues the opinion. Aeon does not issue SOC 2 reports, ISO certifications, or assurance opinions. Independent CVE Numbering Authorities assign CVE identifiers.
Access
Test whether one user, tenant, or role can reach another's data through agents, APIs, RAG collections, model-platform objects, or support tools.
Execute
Review whether an agent, MCP server, or tool call can be driven to perform unauthorized actions, including indirect prompt injection, command-boundary issues, and unsafe internal API reach.
Leak
Follow data paths across AI integrations, SSRF exposure, secret handling, unsafe retrieval flows, logs, and customer-security evidence.
Free public-exposure snapshot
The first tier maps externally visible AI attack-surface signals from public sources only, with no access, probing, legal paperwork, or vulnerability claim.
Free threat-model call
A 60-minute call explains what the snapshot means, the single top fix, and what would require signed authorization.
Paid diagnostic or AI-native pentest review
A fixed-fee diagnostic or the full 10-business-day review runs under signed ROE and produces verified findings, reproduction-safe evidence, developer-ready fixes, and retest-ready closure.
Release Security Gate retainer
Ongoing coverage for major agent, model, MCP, AI platform, or configuration releases, with verified remediation and retest evidence.
SOC 2 readiness evidence
Findings are mapped to OWASP LLM Top 10, MITRE ATLAS, and your SOC 2 and NIST AI RMF controls so your assessor can use the evidence while your auditor still issues the opinion.
Research-backed proof
Aeon's owned-lab, AI-driven, human-reviewed pipeline found 101 authorization vulnerabilities across 60 open-source AI and infrastructure projects. The separate verified public record contains four patched advisories and two assigned CVEs.
Public proof assets
The frozen research evidence snapshot, AI Exposure Assessment sample, CyberGuard one-pager, and executive briefing deck are public. The evidence-package sample and ROE template show how the AI-native pentest lab scopes, validates, fixes, and retests findings.
Proof boundary
Aeon is firm-attributed, authorized-only, human-verified, and AI-assisted. Four coordinated disclosure records are public and patched, including two assigned CVEs. Other private records remain aggregate-only.