An exposure your stack does not measure
Your AI can leak what you protect, and act where you never authorised it. Your stack cannot tell you how often.
You already own that exposure. What follows is why the tooling you already run cannot measure it, and what it takes to put a number on it.
The code scanner in your security suite
What it needs to get in
Your repository
What it looks at
The code your team wrote
The exposure agent that maps your estate
What it needs to get in
Telemetry from your fleet
What it looks at
The network, the identities, the paths between them
EthiCompass
What it needs to get in
An interface your AI system exposes for testing
What it looks at
How the AI system behaves when it is pushed
So far these are differences of scope. A company runs all three, and each one covers ground the others never reach.
Why the finding holds
A number you can act on, and still defend.
What your own stack produces
Work product. It does not travel.
Written by your team, for your team, to get a fix shipped. Terse, internal and fast, which is exactly right for that job. The day the finding has to leave the building — a board paper, a customer questionnaire, a supervisor — it was never built to survive the trip.
EthiCompass
A number, and the exchange behind it.
Every finding carries the conversation that produced it and a rate over a stated number of runs. Your engineers can act on it on Monday, and it still stands up when a board, a customer or a supervisor asks six months later — without you standing next to it.
You buy a penetration test because the output is a list of things you have to fix, and because your own team saying “we checked” is not the same exercise. This is that, pointed at the behaviour of an AI system instead of at infrastructure. The output lands on your engineers’ desks first. That it also survives a reader outside the building is what you get for free, and it is why the same work does not have to be done twice.
One phrase, two exercises
“We already red-team our AI.”
Usually true, and usually about something else. In security, red teaming means simulating an attacker against infrastructure: mapping the network, finding the permission that was left open, reaching the critical asset. The red agent in an exposure platform does that well.
That agent never speaks to your AI assistant. It audits the ground the assistant stands on. What we do is hold a designed population of conversations with the assistant itself, built from your products, your policies and your customer profiles, to measure how often it answers two equivalent people differently.
Both exercises are worth running. They examine different objects, and finishing one tells you nothing about the other.
The nearest thing you already run
Your AI gateway does speak to the assistant. It is still a different instrument.
A guardrail or gateway sits inline on live traffic and decides, per request, whether to allow it. It is a control: it acts, continuously, on everything. That is the right design for stopping a prompt injection at the moment it arrives, and nothing here replaces it.
What it does not do is run a designed population of conversations and report a rate. A gateway can tell you it blocked four hundred requests last month. It cannot tell you how often your assistant quotes a different outcome to two applicants whose files differ only in ways you are not allowed to price on, because that question has no answer until someone deliberately constructs both conversations and holds them.
One is a control acting on live traffic. The other is a measurement over a sample you designed. They are different line items because they answer different questions, and a reader who treats them as substitutes will be surprised by whichever one they skipped.
Where it sits
Exposure platforms admit whole categories of vendor, one at a time.
The documented categories today are asset inventory, vulnerability management, cloud security and operational technology. Findings from those vendors normalise into the exposure graph, enrich the asset inventory and surface new attack paths.
A category for the behaviour of AI systems does not exist yet, and there is no open interface or published SDK that would let one appear by engineering effort alone. We say this plainly because the alternative is implying an integration that is not there. The useful question is when that category opens, and who is positioned when it does.
Why this is checkable
The independent layer of AI red teaming was bought up between 2024 and 2026.
OpenAI acquired Promptfoo. Check Point acquired Lakera. Zscaler acquired SPLX. Cisco acquired Robust Intelligence. Palo Alto Networks acquired Protect AI. F5 acquired CalypsoAI. Each of those tools now belongs to a company whose own systems it was built to examine.
You can verify every one of those six without asking us. That is the point: our independence is a fact about the market rather than a promise about our character. An examiner cannot sign their own paper, and most of the examiners have been bought by the people they examine.
What we cannot tell you yet
No competent authority, audit firm or insurer has yet accepted one of our hash-citable traces as evidence in a proceeding. If that matters to your decision, it should, and you should weigh it. External review of the methodology is under way through university and research-centre partnerships, and it is under way rather than finished.
We would rather you heard that from us than discovered it in a procurement review.
See it run against a system like yours.
Every engagement is scoped with you and authorised by you before a single run exists. The fastest way to judge the evidence is to watch it being produced.