EastSec

Our specialty is in auditing, documenting and suggesting improvements in the use of AI and Agentic tools. With the increased usage of agentic tools (such as Claude Code, Codex CLI [OpenAI/ChatGPT], Gemini [Google], Copilot, etc.) document and data access is an oft overlooked aspect of their usage.

Many users will compromise between allowing more-than-needed data access while conversely not benefiting from an increase in output from the underlying AI Models. This unnecessarily increases data exposure, and many are not aware of the increased data that they are unknowingly sharing with the models (and their providers!)

Furthermore, the usage of agentic tools is connected to a higher level of risk-taking and blindly trusting the usage of third party libraries and unsigned binaries. This can lead to ransomware attacks and other data breaches.

Our services include:

• Analysis and documenting the exposure between AI and proprietary data / documents
• Document and data access control in the context of AI and Agentic tools (Claude Code, ChatGPT, Copilot etc.)
• Secruity solutions for limiting AI attack surfaces
• Hardening security for usage of Agents in development processes

With many years of experience in both developing hardware, firmware solutions within such industries as medtech, etc., and equally as many years in their security analysis, we provide a unique combination of services within these fields.

We offer review and documentation of physical products, focusing on intrusion weaknesses, firmware copy-protection, software license key circumvention and secure data storage.

Expertise areas include:

• Microcontroller firmware security and production readying, including full-chain hardware signing (from Development to Deployment)
• FPGA centric hardware security (Xilinx, Altera, etc.)
• RTOS (VxWorks, Zephyr, etc.) and other real-time embedded frameworks
• PLC and other industrial controllers (ModBus, CAN, ladder logic)
• Compliance with such directives as Cyber Resilience Act (CRA) and Medical Device Regulation (MDR)

We offer testing of networks for weaknesses and vulnerabilities. The scope of the task can be entirely customer specified along with the extent of its testing.

This can include anything from access to internal networks via external-facing services, or specific parts of your network such as Active Driectrory or other ACL-controlled parts.

Services include but are not limited to:

• Active Directory (locally maintained or Azure AD)
• Review of internet-facing services and attack surface documentation
• Hardening of Linux, Huawei and Cisco platforms

Web Applications can have many, increasing layers of complexity, that are often not reviewed for security vulnerabilities, as a trade-off for dynamically generated content. These security vulnerabilities can be exploited by actors who wish to gain unauthorized access to underlying databases and/or network infrastructure.

Our consultancy has a deep-knowledge with reviewing applications using technologies such as Node.js, PHP, MySQL, MongoDB, Java, Python.

Within this area our services include:

• Security reviews of critical interfaces (such as database access, internal and external API's)
• Mapping and documenting attack surfaces
• Suggestions for Improvements and/or design aid for security oriented architecture