Intelligence led Cybersecurity, working globally with enterprises and governments on the most challenging cyber missions: operations, architecture, governance, assurance, intelligence, threat modelling and control implementation
Provable · Audit-ready · Defensible security where it matters mostEnforceable authority and least-privilege access for AI systems: what an agent may do, which identity it acts under, and where the runtime boundary sits. Policy controls you can enforce, not just document.
Cryptographically verifiable evidence for agent actions and delegated authority. Auditability built at the action level, in a form an auditor, regulator or partner can check without trusting our word.
Threat models for agent-to-tool and agent-to-agent activity, then adversarial testing against the model. Nine rounds of adversarial security testing on our own tooling, with security assumptions and limitations documented.
Security controls for cloud estates and CI/CD delivery: identity, pipeline integrity, controls that operate at the pace of deployment and hold through change.
Security intelligence for critical defence missions and offensive red-agent deployments. The same authority, evidence and boundary controls apply when the agent is the instrument.
Advice for CISOs, boards and senior leadership teams on AI and technology risk: what to govern, what to accept, what to refuse. Calibrated to the decisions those rooms actually make.
Raucle is our open-source division, building AI security tools the public can inspect. Its first project is a trust layer for AI agents: agent authority that can be enforced, and agent activity that can be independently verified.
Signed receipts. Agent identity. Portable trust, cross-organisational handshakes, revocation and compliance evidence. Every claim the system makes can be checked by anyone holding the receipts.
The first Raucle tool was built for one purpose: understanding what agents actually do in offensive red-team engagements. Watching every action an agent takes, with no benefit of the doubt.
That work held up. The tooling has since been developed and opened for regulated and safety-critical environments: financial services, payments, healthcare, retail, manufacturing, defence, critical infrastructure and government.
raucle.com github.com/epic28-ltd/raucleDesigned trust and accountability architecture for agent-to-tool and agent-to-agent activity, covering identity, delegation and revocation.
Developed cryptographically verifiable evidence for agent actions and delegated authority, verifiable offline by any party.
Conducted nine rounds of adversarial security testing on our own tooling. Assumptions and limitations are documented and published.
Contributed upstream to Microsoft's Agent Governance Toolkit.
EPIC28 stands for Electronic Progressive Intelligence CyberSecurity. An independent cybersecurity company, working globally with enterprises and government organisations on complex technology-security problems.
The practice covers governance, assurance, intelligence, cloud security, threat modelling and control implementation. The current development focus is the secure adoption of generative and agentic AI for critical cybersecurity defence missions and offensive red-agent deployments.
Our consultants have spent twenty-five years in banking and capital markets, central government and defence, manufacturing, retail, telecoms and software security.
Raucle, our open-source division, builds AI security tools in the open. We build what we advise on, we test what we build, and we publish both.
For engagements or press, use the address that fits. Every message reaches a consultant.
