Enterprises engage us to design their security architecture, advise on AI security, and build the controls that make their security claims verifiable. We work in the open, so what we deliver can be inspected, audited and trusted.
Target-state architecture, design reviews, control mapping and delivery roadmaps. We work to SABSA and to the standards your sector already recognises, and we stay engaged through build and operation, not just the review board.
We advise on securing AI systems and the agents that act on your behalf, from model selection to enforcement of what agents are permitted to do. Our advisory work aligns to the Code of Practice for the Security of AI, ETSI EN 304 223 and EU AI Act Article 12.
We design evidence trails that show controls operating, in a form an auditor, regulator or customer can verify independently.
When your control needs to be built rather than bought, we design and build it with your teams. Reference implementations, integration tooling and control libraries, delivered in the open under licences you can defend to your auditors.
Most consultancies deliver a PDF and leave. We deliver working controls, and we build them in the open: source on GitHub, Apache-2.0 licensing, design decisions documented where your engineers can read them.
That is not ideology. Security that depends on a vendor's word is harder to defend than security your own auditors can inspect. Openness is how we make our work auditable, and it is how we hold ourselves to the same standard of proof we ask of your systems.
Every engagement leaves behind something your team owns and can run: code, reference architectures, evidence trails. No lock-in to a proprietary framework, no black boxes your auditors cannot see inside.
Our published work stands in for references you cannot ring. It is inspectable, versioned and current.
github.com/epic28-ltdEPIC28 stands for Electronic Proactive Intelligence in Cybersecurity. We are a consultancy that designs security architecture for regulated organisations, advises on AI security, and builds security solutions in the open for enterprise use.
Our consultants have spent twenty-five years in banking and capital markets, central government and defence, manufacturing, retail, telecoms and software security.
We build what we advise on, and we publish what we build.
For engagements or press, use the address that fits. Every message reaches a consultant.
