Canadian AI security that tests your models and pipelines, then fixes what breaks.
One Canadian team attacks your AI, then hardens it.
We map what your model reaches, who can reach it, which tools it holds, and what an attacker gains. Data flows, not diagrams.
Prompt injection, data extraction, and jailbreaks run against your actual deployment, under written rules of engagement.
Gateways, output filtering, retrieval permissions, and tool authorisation built into the pipeline instead of written into a document.
The Canadian Centre for Cyber Security published its top 10 AI security actions in May 2026. We test against all three of its pillars.
IN PRODUCTION
Our vendor said the assistant was secure because the platform was SOC 2. SMEnode got it to print a customer record inside a summary request in about forty minutes. Not a platform flaw, our retrieval config. They fixed the filtering, retested, and wrote down what they tried so our own team could repeat it.
Two different services share this name. We do the one that defends your models.
AI security splits in half and buyers get sold the wrong half constantly. One meaning is using AI to defend a network: threat detection, alert triage, the products every vendor now ships. The other is protecting the AI systems you run from being attacked, and that's ours. Model security, pipeline security, and the retrieval layer where most real incidents actually happen. If a vendor answers "how do you secure our assistant" by describing their detection engine, they've heard a different question from the one you asked.
Prompt injection is the risk that earns its reputation. It sits at LLM01 on the OWASP list because it unlocks most of the others, and it isn't fixed by a better system prompt. Risk clusters in three places. Retrieval that returns documents the asking user shouldn't see, which is a permissions failure wearing an AI costume. Output that leaves without inspection, so extraction succeeds quietly. And an agent with tool access, where a successful injection stops being a disclosure and becomes an action. We test all three by attempting them.
There is no Canadian AI statute to comply with. AIDA died when Parliament was prorogued in January 2025 and no successor has been tabled, so what binds you is privacy law, your sector regulator, and your client contracts. The guidance, though, is unusually good: the Canadian Centre for Cyber Security published Top 10 AI security actions (ITSAP.10.049) in May 2026, structured on three pillars covering adversarial use of AI, protecting AI systems, and protecting users and business processes. OSFI has issued its own frontier AI bulletin for financial institutions. PIPEDA applies to whatever your model can reach, and a breach here averages 7.11 million dollars in Canada.
Four steps, and the second one is us attacking your system on purpose. Reviewing an architecture diagram tells you what should happen. Running the attack tells you what does. We work against a real deployment with agreed scope and written rules of engagement, because a red team on production needs both. Findings arrive with the exact prompt or request that worked, so your engineers can reproduce them without taking our word for anything.
What the model reaches, who can reach it, what tools it holds, and what an attacker gains. Data flows, not diagrams.
Prompt injection, indirect injection through retrieved content, extraction, jailbreaks, and tool abuse. Scoped and logged.
Retrieval permissions, output filtering, gateway controls, tool authorisation. Fixes in the pipeline, not guidance in a document.
Second pass against the fixes, then the test set goes to your team so regressions get caught later.
Answers first, including which half of this market we're in. An architect takes the call.
Ces disciplines partagent la même équipe chevronnée et arrivent souvent ensemble. Suivez le fil jusqu'à la prochaine.
PARLONS-EN
Un spécialiste chevronné répond en moins d'une heure, 24/7.