Security architecture review for micro SaaS businesses and AI/LLM platforms.

Your system architecture, reviewed against real-world attacks.

Checked against the current OWASP, MITRE ATLAS and agentic AI threat landscape.

Illustrative. The flagged crossing is the most common finding in AI products that act on their own. No scanner looks for it.

Start here

Three guides that cover most of what goes wrong.

Deep, practical write-ups on the failures we see most often. Each one leads with the fix, then the reasoning.

Tenant isolation

The one header check that leaks every tenant's data

Why a client-supplied tenant ID is the most common way multi-tenant SaaS leaks data, and the two-line fix that closes it.

Read the guide → Agent permissions

Why your AI agent shouldn't run with the company's service account

What excessive agency looks like in a LangChain or tool-calling agent, and how to scope credentials down to the user who prompted it.

Read the guide → Over-privileged roles

Auditing IAM roles before they become the incident

A practical way to find the wildcard permissions and unused roles sitting in your AWS account right now.

Read the guide →

Coverage

What reviews typically cover

Four patterns come up again and again.

Tenant isolation: A reporting feature that queries the database with its own permissions, skipping the check that confirms the data belongs to the requesting customer. See guides →
Agent permissions: An AI agent given the company's permissions instead of the user's, open to hijacking by a hidden instruction. See guides →
Over-privileged roles: A service account given higher privileges than needed for the job. See guides →
Exposed storage: A storage bucket or database reachable without authentication, because a default was never locked down after launch. See guides →

The deliverable

Documented hardening, ready to act on.

Every finding names the attack, the fix, and the requirement it satisfies. The same document works for your engineers and your buyer's security reviewer. This is what one looks like.

High SA-04 Tenant isolation

Tenant identifier accepted from a client-supplied header

Path browser → api gateway → data layer

What an attacker does Authenticates as a legitimate user on any tenant, replays the request with a different X-Tenant-Id, and reads records belonging to another customer. No credential theft required.

Requirement Derive the tenant identifier from the verified session at the gateway and discard any client-supplied value. Enforce it again at the data layer so a single bypass is not sufficient.

Satisfies SOC 2 CC6.1 · ISO 27001 A.8.3 · common SIG questionnaire item

↑ Illustrative example, not a real client finding.

Engagements

Three ways to start.

Architecture Threat Model

Scope Where the trust boundaries sit. What happens if one part is compromised. Whether an attacker can reach your real data.

Outcome A clear, ranked list of the flaws that matter. Written so your developers can turn it into work items.

AI / LLM Threat Model

Scope What your AI agent is allowed to do. What data it can see. What happens with what it sends back.

Outcome A plain map of your AI risks, checked against the industry standard. Plus fixes.

Due Diligence Pack

Scope The security questionnaire your customer sent, checked against how your system really works. Not a certification audit. No ISO 27001 or SOC 2 certificate at the end.

Outcome Your questionnaire, answered properly. A list of gaps to fix. A one-page architecture summary you can hand over as-is.

Fit

Who this is for.

→A multi-tenant SaaS where one bad header check could expose another customer's data.
→A team shipping an LLM agent with tool access and no threat model behind it.
→An architecture that grew faster than anyone documented it.
→A platform about to go live that nobody's stress-tested against real attacks.

Contact

Let's talk about your architecture.

No charge, no deck. Just a conversation to see where things stand.

Book a call

Or email hello@zyvra.studio directly.

CompanyVesey Cyber Security is a trading name of Zyvra Studio Ltd · Company No. 17180795 · Birmingham, UK

You'll hear back within two business days. See how we handle your data.