SEB tests the failure modes that generic pentesting never looks for: prompt injection, excessive agency, poisoned retrieval, and MCP tool descriptions that lie.
Scroll to walk the stack, or click any node to jump to it.
Passive signals only, from public information. No login, no active probing, no gate.
Prompt injection has been the number one item in the OWASP LLM Top 10 across two consecutive editions. Easier to feel than to read about.
MCP servers found exposed to the internet with no authentication, up from 492 ten months earlier, nearly tripling.
of enterprise apps predicted to embed task-specific agents by end of 2026, from under 5% in 2025.
rise in large malicious prompt-injection payload detections, March to May 2026, approaching 1% of observed prompts.
The model reads tool descriptions as instructions, not as documentation. A poisoned description arrives inside the trusted context window, before the user ever types anything. Nothing in the protocol requires the description to match what the tool does.
It is a supply-chain problem wearing an application-security costume: you are executing text authored by whoever published the server.
Passive, read-only scan of what is already publicly visible. No login, no active probing.
A real test starts from a signed written authorization. Every single time.
Adversarial testing against the OWASP LLM Top 10 with Garak and the L1B3RT4S corpus. 48-hour turnaround.
Monthly re-scans, or manual red-team review with a full remediation roadmap.
Passive public-surface scan: AI surface signals, exposed headers, PII forms.
RUN IT ABOVEOWASP LLM Top 10 automated scan with Garak and L1B3RT4S, delivered as a written report with a 0-100 posture score.
START A SCANMonthly re-scan with a severity-delta bulletin and priority fixes between scans.
TALK TO USManual red-team testing, architecture review, remediation roadmap, and a one-hour workshop with your team.
TALK TO USRunning a live MCP server? Adds tool-description poisoning probes and a dedicated report section.
SEB is built and run by one person, out of Kelowna, BC. That is deliberate: no bench of overhead to cover, no enterprise sales process between you and the person who runs your scan.
Questions about a report, a finding, or the scope of an engagement go straight to the person who ran it, not a ticket queue.
The methodology is not improvised. Every engagement is scoped against the OWASP LLM Top 10 and Agentic Top 10, run with Garak (NVIDIA's open-source LLM red-teaming framework) and the L1B3RT4S adversarial prompt corpus. Teams running a live MCP server get OWASP MCP Top 10 coverage, independently verified against the primary source.
Testing and disclosure practice are governed by the HackerOne Good Faith AI Research Safe Harbor framework (January 2026). Every engagement starts from a signed written authorization and stays inside the scope it defines.
Consent-first, always. Nothing runs against a live product without signed written authorization.
Real, named tooling: Garak and L1B3RT4S, mapped to OWASP LLM, Agentic, and MCP Top 10.
Governed by the HackerOne Good Faith AI Research Safe Harbor framework (January 2026).
Small-team pricing, published in full, built for a founder's budget.
Structured around PIPEDA's fair information principles (accountability, limited collection, safeguards, controlled retention) for any personal information handled, not retrofitted after a complaint.
Nothing claimed that has not shipped. Installed-but-never-fired tooling is not listed as an active capability, and SEB has 0 completed engagements to date.
Passive, public information only. No login, no active testing, no obligation.
Or direct: mbaptiste20@gmail.com