Selected engagements
AR / 04
Context beforethe claim.
Security work is shaped by systems, constraints, ownership, and timing. These field notes show the kinds of problems we help organisations structure and move forward.
Client identifiers and sensitive evidence are intentionally omitted.
01Independent research
Open-weight AI model resistance testing
Independent research
Open-weight AI model resistance testing
The situation
Ten local model scans needed a repeatable way to test prompt injection, system-prompt leakage, unsafe output handling, excessive agency, retrieval poisoning, and multi-turn policy drift.
Our response
We ran 1,021 adversarial attempts through a controlled local harness mapped to OWASP LLM Top 10 2025, OWASP Agentic, MITRE ATLAS, and NIST AI 100-2. The run returned 320 raw detector findings for analyst validation.
Names identify model families evaluated in this controlled run. Arica is not affiliated with or endorsed by their providers. We tested local model copies—not provider services or infrastructure. Results are specific to the tested versions, prompts, runtime, and harness; they are not universal model rankings.
Discuss a similar challenge02VAPT
Banking infrastructure penetration testing
VAPT
Banking infrastructure penetration testing
The situation
Legacy systems with unknown security gaps and uneven testing coverage.
Our response
Scoped penetration testing, evidence-led reporting, and prioritised remediation guidance.
Discuss a similar challenge03ISO 27001
Certification readiness support
ISO 27001
Certification readiness support
The situation
Scattered documentation, unclear control ownership, and no consistent ISMS framework.
Our response
Gap analysis, policy development, risk assessment, internal-audit preparation, and certification support.
Discuss a similar challenge04Secure engineering
E-commerce platform security
Secure engineering
E-commerce platform security
The situation
A payment workflow required stronger protection and clearer security ownership.
Our response
Threat modelling, secure SDLC guidance, code review, and continuous testing practices.
Discuss a similar challenge05Assurance
Healthcare privacy and security
Assurance
Healthcare privacy and security
The situation
Fragmented systems and documentation created uncertainty around sensitive health information.
Our response
A unified compliance framework, control implementation, evidence preparation, and staff training.
Discuss a similar challenge06VAPT
SCADA security assessment
VAPT
SCADA security assessment
The situation
Industrial systems exposed attack paths through legacy protocols and weak segmentation.
Our response
Safety-conscious OT testing, network segmentation review, and ICS hardening guidance.
Discuss a similar challenge07DevSecOps
Secure delivery lifecycle
DevSecOps
Secure delivery lifecycle
The situation
Rapid release cycles were creating security debt and inconsistent code review.
Our response
SAST and DAST integration, security gates, remediation workflows, and developer training.
Discuss a similar challenge08Enterprise
Hybrid network security assessment
Enterprise
Hybrid network security assessment
The situation
Complex infrastructure made policy and exposure difficult to understand consistently.
Our response
Attack-surface assessment, validation exercises, and a sequenced remediation roadmap.
Discuss a similar challenge09Architecture
Zero-trust implementation
Architecture
Zero-trust implementation
The situation
Perimeter-led security no longer matched remote work and cloud migration.
Our response
Identity-centred design, micro-segmentation, and continuous-verification controls.
Discuss a similar challengeWhat the work delivers
Evidence you can work with.
Clear findings, their business impact, and the technical context your team needs to understand the exposure.
A defined response, practical priorities, and a clear next decision for the people responsible for fixing it.
Start a conversation
Your situation will be different.
That is the point. Send us the environment, constraint, deadline, or risk you are dealing with and we will shape the engagement around it.
Start a conversation