01
Audits
Independent assessment of your technology environment, including the AI systems connected to it.
- Technology assessment
- Stack assessment, AI-agent assisted and analyst reviewed
- LLM scan of chatbots, copilots and agents
Third-party reviews for large organizations · Americas, Ireland, Singapore and the Cayman Islands
info@forensicfive.comFree website scan
Security · Auditing · AI
Independent assurance for your technology — and the AI built into it.
Audits, testing, reporting and third-party reviews for large organizations. Work has been delivered across North and South America, and as far as Ireland, Singapore and the Cayman Islands — under a written scope, and documented to the standard counsel, insurers and boards expect.
Engagement standards
Every engagement includes
- Written scope and fixed fee before work begins
- A named analyst accountable for the findings
- Confidential reporting; your NDA executed on request
- Method, coverage and limitations stated in every report
Typical assessment window
1–4 weeks
Findings mapped to recognized frameworks
NIST CSF 2.0CIS ControlsISO/IEC 27001OWASP LLM Top 10MITRE ATLAS
Our services
Five practice areas.
One accountable firm.
Each service can be engaged independently. Most clients begin with an introductory meeting, then an audit, and extend into testing, reporting or an enterprise review as findings require.
The first step
Set up one introductory meeting
We discuss the project and your concerns — what is in scope, what is not, and whether a written engagement is warranted. No fee, and no work begins afterward unless you approve it.
02
Reporting
Security documentation prepared for the people who must rely on it — operators, counsel, insurers and directors.
- Findings reports with evidence and limitations
- Security policies and system documentation
- Board and insurer briefing materials
03
Testing
Controlled attack simulation within an agreed window, against only the systems you authorize.
- Penetration testing — web, server and application
- AI penetration testing — prompt injection, agent misuse, data leakage
- Retesting to confirm remediation
04
Enterprise
Independent third-party reviews for large organizations that require an outside opinion — vendor, hosting and due-diligence work included.
- Vendor and managed-service provider reviews
- Hosting, cloud and virtualization architecture review
- Due diligence ahead of acquisition or renewal
05
Context
Security practices for teams that train, tune and supply data to large language models.
- Training and fine-tuning data governance
- Retrieval, context and memory controls
- Staff and executive training on responsible AI use
AI assurance
AI systems now hold real permissions. They warrant real review.
A language model that can read company documents and act through business tools introduces risks that conventional assessments were never designed to find. AI assurance examines four layers — inputs, agents, data and hosting — under the same written scope as any other engagement.
- I
Inputs and content
Manipulation through chat, files, email and web content the model reads.
- II
Tools and agents
What an agent can access, under whose credentials, and what constrains it.
- III
Data and context
What is retrieved, logged and retained — and who can see it.
- IV
Models and hosting
Training data provenance, where models run, and who can change them.
Our approach
A defined engagement, from scope to remediation.
An introductory meeting comes first. No work begins until targets, authorization, schedule and fee are written down. The same four steps apply to an audit, a test, a third-party review or an AI engagement — including work delivered internationally.
Read the full approach →01
Scope
Targets, constraints, schedule and fee are agreed in writing before any work begins. If we are not the right firm, we say so here.
02
Assess
Automated and AI-assisted analysis, validated by a named analyst. Production impact is agreed in advance. Nothing is reported until it has been read.
03
Report
Prioritized findings with supporting evidence, written for operators, counsel, insurers and boards. Method, coverage and limits are stated plainly.
04
Advise
We review the report with your team, sequence remediation and retest on request. The engagement ends when you have a written record you can use.
1–4 wks
Typical assessment, report included
1 day
Usual response to new inquiries
1 analyst
Named and accountable on every paid engagement
Canada
Headquartered in St. Albert. Work as far as Singapore, Ireland and the Cayman Islands
Engagement terms
Professional standards you can rely on.
The terms we work under, so that a review never becomes a risk in its own right.
Written authorization only
We test only the systems, applications, models and accounts named in writing.
Production availability protected
High-impact tests are disabled by default and disclosed in advance.
Strict confidentiality
Reports are confidential to the named client. Your NDA is executed before work begins.
Client data is not used for training
Client material is never used to train or tune any model.
Fixed fee, no retainer
No obligation to purchase hosting, tools or ongoing services to receive the report.
Accurate representation
Unconfirmed findings are labelled as such. Method, coverage and limits are stated plainly.
Begin an engagement
Request a written proposal.
Describe the system, vendor or AI deployment under consideration. We respond with the proposed scope, timeline and fee — before any work begins.
info@forensicfive.com
#200, 200 Carnegie Dr., St. Albert, Alberta T8N 5A7