Security, SecOps and CISO as a service

The security function for AI infrastructure, from governance to the kernel

We engineer and operate GPU clusters, Kubernetes platforms and the clouds underneath them, alongside our clients’ teams. We bring the security function with that work: a part-time CISO who knows the infrastructure down to the fabric, security operations on the platforms we run, and security engineering built into every layer of the design. It is the same team, so the person writing your policies knows how the cluster actually behaves.

Our security leadership has built security functions from the ground up in international SaaS, healthtech, insurance and finance companies, led programs through SOC 2, ISO 27001, HIPAA and PCI DSS audits, and sat on audit and security committees. We work in English, French and Arabic.

Why AI infrastructure changes the security model

A GPU cluster is not a larger web cluster. Its attack surface is different, and so are the assets worth protecting:

  • Shared accelerators: GPUs, MIG partitions and vGPUs shared between teams or tenants need isolation that survives a driver bug or a misconfigured device plugin.
  • Fabrics that bypass the kernel: RDMA over InfiniBand or RoCE moves data without the usual network stack, so tenant isolation has to be enforced in the fabric itself, with partition keys, VRFs and DPU policies.
  • Models and data as crown jewels: model weights and training datasets are often worth more than the hardware. They need encryption, strict access paths and audit trails.
  • Firmware and supply chain: BMCs, NIC and GPU firmware, drivers and container images all come from third parties and all need to be tracked, verified and patched.
  • Endpoints that take instructions: inference APIs and agents accept natural language, which brings prompt injection, data exfiltration and abuse into scope.

CISO as a service

For companies that need a security leader without a full-time hire, or a CISO who understands GPU infrastructure:

  • Building the function: security organization, roles and a multi-country team, sized to the company rather than copied from a template
  • Governance: security policies, risk register and a security roadmap with a budget, reported to the board and the audit committee
  • Compliance programs: gap analysis and preparation for SOC 2, ISO/IEC 27001, NIS2, DORA, GDPR, HIPAA, PCI DSS and EU AI Act obligations, and for customers who require SecNumCloud or HDS hosting
  • Regulators and customers: communication with financial, insurance and health regulators, answers to security questionnaires and due diligence
  • Business continuity: business continuity and disaster recovery plans, crisis management and full-scale crisis simulations
  • Security culture: awareness and phishing programs for organizations of 1,000 people and more
  • Third parties: governance of managed security providers, hosting providers and colocation sites

SecOps

Day-to-day security operations on the platforms we engineer and operate, or on yours:

  • SOC and SIEM: design of the security operations center, SIEM built on OpenSearch to keep log costs under control, or governance of an external SOC provider
  • Detection and response: audit logging across hosts, Kubernetes and the cloud layer, runtime detection with Falco or Tetragon, automated playbooks, alert triage and escalation
  • Zero Trust: identity-based access to every system, with fewer false positives and tighter access control
  • Cloud security posture: CSPM, CWPP, WAF and DDoS protection on AWS and Azure, Microsoft 365 security reviews
  • Vulnerability management: image and host scanning, patch cadence, tracking of firmware and driver advisories for GPUs and NICs
  • Access management: single sign-on, just-in-time administrative access, regular access reviews, secrets rotation
  • Incident response: containment, investigation across layers, post-mortems and corrective actions written into the runbooks, with crisis simulations to bring time to recovery down
  • Attack surface management: continuous inventory of what is exposed, in the cloud and on premises
  • Testing: scoping and follow-up of penetration tests and red team exercises, with fixes tracked to closure

DevSecOps and secure development

  • Shift left: SAST and SCA in CI/CD, so vulnerabilities are found in the pull request rather than in production
  • Secure SDLC: security requirements, design reviews and security design testing built into the delivery process
  • Supply chain: signed images, SBOMs and dependency policies from build to deploy

Security engineering in every build

Security is part of the design review for each layer of the stack, not a checklist at the end:

Layer Controls we design in
Datacenter floor Physical access control, isolated BMC network, signed and versioned firmware baselines
Fabric EVPN-VXLAN and VRF segmentation, InfiniBand partition keys, MACsec where needed, DPU-enforced policies
Storage Encryption at rest and in transit, keys in a KMS you control, immutable backups
Cloud and virtualization Hardened hypervisors and hosts based on CIS Benchmarks, no shared admin accounts
Kubernetes RBAC, Pod Security Admission, Network Policies, admission policies with Kyverno or OPA, signed images
AI platform Per-tenant isolation of models and datasets, short-lived secrets, confidential computing where the hardware supports it
Model serving Authentication, rate limits, input and output guardrails based on the OWASP Top 10 for LLM applications

We use threat models such as MITRE ATT&CK and MITRE ATLAS to decide what to protect first, and we keep policies, configuration baselines and evidence in Git, so an audit becomes a review of history rather than a search for screenshots.

Sectors we know

  • SaaS and software, from fast-growing scale-ups to international platforms
  • Healthtech, with protected health information and medical devices
  • Insurance, reinsurance and finance, across the EU and the Middle East
  • AI labs, GPU clouds and infrastructure operators, where our engineering teams work every day

Frameworks we work with

  • NIS2 and DORA for operational resilience in the EU
  • ISO/IEC 27001 and SOC 2 for security management and assurance
  • GDPR, HIPAA and PCI DSS for personal, health and payment data
  • NIST CSF and ISO/IEC 27032 for cybersecurity programs
  • The EU AI Act for AI obligations
  • SecNumCloud and HDS requirements for French sovereign cloud and health data hosting
  • CIS Benchmarks for system hardening

Certifications held in the team include ISO/IEC 27032 Lead Cybersecurity Manager and a data privacy practitioner certification. We prepare you for audits; certification of your organization is issued by accredited bodies.

Ready to secure your infrastructure?

Tell us where you stand: a cluster to secure, an audit to prepare, or a security function to set up. Talk to an engineer.

Need this in production?

Tell us what you are building. An engineer replies.

Talk to an engineer