Wardkey

Wardkey is a security testing firm for companies that ship AI agents, LLM features, AI phone agents and multi-tenant SaaS.

What we test: prompt injection that leads to a real tool call, data crossing between customers through RAG, vector stores or agent memory, MCP tool permissions, and tenant isolation in Next.js, Supabase and Firebase apps. For voice agents we call the agent ourselves and test caller identity, recordings, tool authorization, telephony abuse and consent.

How we work: a certified tester is named in the proposal and leads the engagement. Findings are reproduced before they are reported, and AI behaviour that changes between runs is reported as a rate, for example 4 of 20 attempts. Confirmed findings come with a fix as a pull request and a regression test; your engineers review and merge, and a tester who did not write the fix retests it.

What you get: a report an auditor can follow from discovery to closure, mapped to the OWASP LLM and Agentic Top 10, MITRE ATLAS, SOC 2 and ISO 27001, plus a signed attestation letter once critical and high findings are closed.