Discuss an engagement
MenuClose

Continuous AI security testing for governments and financial institutions.

Bendings Gauge runs continuous red and blue team work inside your approved scope. Bendings operators approve risky actions, and your organization can stop the work at any time.

Explore Gauge Discuss an engagement
Oil painting of a stone coastal fortress at night under a cloudy moonlit sky, a few windows lit amber.
  1. Public reconnaissance
  2. Initial access
  3. Lateral movement
  4. Agreed objective

An illustrated engagement path from public reconnaissance, through initial access and lateral movement, to an objective agreed in writing.

Oil painting of a stone sea wall at night that bends once as it runs out to sea, a small watch house at the bend with one lit window.

Our own AI model works around the clock.

Gauge probes the systems in scope day and night, the way a patient adversary would, and hunts through the logs and alerts you share for activity your detections missed. Our operators set its limits and answer to you for its work.

Deployment
Inside your network, in your country or fully air-gapped. Your data stays there and is never used to train the model.
Operator approval
Exploitation, lateral movement and other risky actions wait for a Bendings operator to approve them.
Action log
Gauge logs every action it takes, and you receive the complete log.
Scope
Gauge refuses any target outside the signed scope.

Gauge runs on Bendings Frame, the operating system our team works in. Frame schedules, controls and records Gauge’s work.

About Bendings Gauge Watch the Gauge film About Bendings Frame

Start with the question you need answered.

We run eight kinds of engagement. Each is scoped to a decision your leadership has to make.

Reconnaissance

Learn what an adversary can find out about you before they try anything. We map the digital exposure you agree to and show where closer testing is worth the time.

Scope
Authorized external reconnaissance and attack-surface review.
You receive
An exposure map, supporting evidence and priorities for further testing.
Reconnaissance in detail
Oil painting of a lone observer on a desert ridge at dusk, looking across the water toward a city skyline.
Reconnaissance

Red team

Find out whether an adversary could reach an objective that matters to the business. One agreed scenario tests technology, people and your response together.

Scope
Objective-led adversary simulation within agreed rules of engagement.
You receive
An evidence-led account of attack paths, control gaps and defensive observations.
Red team in detail
Oil painting of four people studying floor plans and a city map under a single brass lamp in a dark room.
Red team

Penetration testing

Find the weaknesses in your applications and infrastructure, and learn what each one would let an attacker do.

Scope
Web, API, mobile, cloud, internal and external infrastructure, operational technology and hardware. Remote, on site or in our lab, as agreed.
You receive
Validated findings, evidence of impact and remediation guidance in priority order.
Penetration testing in detail
Oil painting of an antique brass lock taken apart on a workbench under a lamp, a moonlit harbor beyond the window.
Penetration testing

Physical and human testing

Test the doors and people around your systems. Safety limits and stop conditions are agreed before anyone arrives on site.

Scope
On-site physical security and social-engineering assessments under explicit written authorization.
You receive
Documented control failures and practical recommendations for facilities, procedures and staff awareness.
Physical and human testing in detail
Oil painting of a figure in the rain approaching a lit stone bank entrance, a guard visible in a gatehouse.
Physical and human testing

Blue team and incident response

Put experienced defenders beside your team for a fixed period, focused on the threats and detection gaps you name, and reach them at any hour when an incident starts.

Scope
Time-bound secondment, threat hunting, detection validation and a 24-hour incident response retainer.
You receive
Documented investigations, detection improvements and response recommendations matched to the agreed remit.
Blue team and incident response in detail
Oil painting of a lighthouse sending its beam across a stormy sea at night.
Blue team and incident response

Post-quantum readiness

Find where your organization relies on cryptography a quantum computer could break. Leave with an inventory, a risk ranking and a migration plan dated against the rules that apply to you.

Scope
Cryptographic discovery, inventory and quantum risk assessment across your systems, suppliers and internet-facing services, measured from outside and checked from inside.
You receive
A cryptographic inventory, a quantum risk assessment ranked by how long your data must stay secret, and a dated migration plan, each traced to the regulator item it answers.
Post-quantum readiness in detail
Oil painting of a stone harbor office at dusk, a cabinet of tagged brass keys under one oil lamp, and through the window a calm dark blue sea with a storm far out on the horizon.
Post-quantum readiness

AI red teaming

Find out what your own AI systems can be made to say, reveal or do. We attack your chatbots, copilots, retrieval systems and agents as an adversary would, inside a scope you sign and with a stop you hold.

Scope
Adversarial testing of AI systems you build or deploy: chatbots, copilots, retrieval systems, AI agents and their tools, MCP servers, and the models and plugins they depend on.
You receive
Validated findings rated by impact and mapped to OWASP and MITRE ATLAS, with evidence, fixes in priority order and a retest.
AI red teaming in detail
Oil painting of a figure seen from behind holding a brass cam disc up to an oil lamp beside a brass writing automaton at night, its back open on a stack of cam discs, a moonlit sea beyond the window.
AI red teaming

AI testing assurance

Find out whether the limits on an AI testing system hold before it tests you. We check a provider’s AI-driven testing, or your own, against our ten published controls, and test them in practice where the provider agrees.

Scope
Review of the contract, rules of engagement and technical controls of AI-driven security testing, bought from a provider or run by your own team, against our ten published controls.
You receive
A finding for each of the ten controls with its evidence, a record of an observed run, contract clauses for each gap and a retest of what was fixed.
AI testing assurance in detail
Oil painting of a falconer in a plain dark jacket seen from behind on a rocky desert ridge at dusk, a falcon on his raised glove and its leash in his other hand. A second figure in a long coat holds a lantern a few paces off, and a faint skyline of modern towers stands on the horizon.
AI testing assurance

Every engagement starts with a defined scope, written authorization and agreed rules of engagement.

The people who test your defenses can stay to strengthen them.

Red team

We pursue an objective your board would recognize, inside written rules, and report which controls held and which never saw us.

Blue team

We sit with your defenders for a fixed term, tune the detections that missed us and rehearse the first hours of an incident.

Questions we can help answer.

Government ministries and agencies
Could a patient adversary reach the systems citizens rely on, and would we notice in time?
Central banks and regulators
Do the institutions we supervise hold up the way their attestations say they do?
Banks, asset managers and trading firms
Could someone move money, data or orders without us seeing it before settlement?

Every engagement runs in the same five stages.

How an engagement runs

  1. Authorize

    Scope, rules of engagement and written authority are signed before testing starts. Everyone knows who can stop the work, and how.

    You receiveSigned scope and rules of engagement

  2. Observe

    We map what an outsider can learn about you from public sources, then agree with you which paths are worth testing.

    You receiveExposure brief

  3. Operate

    The team works toward the agreed objective inside approved windows and logs every action with a time and an operator.

    You receiveTimestamped activity log

  4. Report

    Executives get the business risk in plain language. Engineers get evidence, reproduction notes and fixes in priority order.

    You receiveExecutive and technical reports

  5. Retest

    Once fixes are in place we test them again and confirm in writing what is closed and what is still open.

    You receiveRetest letter

Reported in your regulator’s terms.

We scope and report testing against the framework your regulator or board already uses, so findings land in language your auditors recognize.

Frameworks by jurisdiction

  • United States

    • NIST SP 800-115
    • NIST Cybersecurity Framework 2.0
    • FFIEC guidance for financial institutions

  • Kingdom of Bahrain

    • Central Bank of Bahrain Rulebook, cyber security requirements
    • National Cyber Security Center guidance

  • Kingdom of Saudi Arabia

    • NCA Essential Cybersecurity Controls
    • SAMA Cyber Security Framework

  • State of Qatar

    • National Information Assurance Policy
    • National Cyber Security Agency guidance
Oil painting of an empty boardroom at dawn, a single desk lamp lit, windows open onto a harbor with wooden dhows.

Policies we keep on every engagement.

Bendings is a cybersecurity firm founded in 2013. We work for governments, banks and asset managers in the United States and the GCC, and most clients find us through other clients. This site says as little about them as they would expect.

Client names
Stay private. We do not publish them, and we do not ask clients to endorse us.
Authority
No testing starts without a signed scope and a named person who can stop it.
Findings
Each one comes with the evidence behind it and a severity your risk team can defend.
About the firm

Discuss an engagement privately.

Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.

Email engage@bendings.com What happens next