Grounded, verifiable work across AI security, cybersecurity, information security, and AI governance - agents, policies, and research built for regulated environments.
Not chatbots bolted onto dashboards. Purpose-built agents that reason about threats, ground every finding in real frameworks, and refuse to invent what they can't verify.
Describe a system in plain English; get a STRIDE data-flow diagram, findings mapped to ATT&CK / CWE / OWASP, and residual risk scored against the controls actually in place.
Adversarial testing, prompt-injection defence, and agentic / MCP threat assessment - the attack surface that appears the moment a model gets tools.
Risk analysis grounded in regulated-finance reality, where a control failure is measured in findings, not just tickets.
Published AI acceptable-use policies verified against primary legislation in the UK, EU, Bahrain, and India - plus EU AI Act, ISO 42001, and NIST AI RMF work that organisations can actually act on.
CTI agents that pull, verify, and reason over advisory feeds - with the indirect-injection paths that come with them already closed.
The map of an organisation's weaknesses never leaves its machine. Runs on local inference - offline, air-gappable, defensible.
Public repositories and demonstrations - real agents and governance artifacts, security-assessed and verified.
A multi-agent cybersecurity platform spanning threat intel, SecOps, threat modelling, cyber risk, and governance - local-first, with a verification pipeline throughout.
An eight-part series of practical governance artifacts. Part 1 is live: AI acceptable-use policies for the UK, EU, Bahrain, and India - each verified against the consolidated primary legislation, including the enacted Arabic text for Bahrain.
A CTI agent with a documented security assessment behind it - including a fixed indirect prompt-injection flaw where feeds reached the model unfiltered.
Plain-English in, STRIDE diagram out - findings mapped to real technique IDs, residual risk scored, and nothing invented. Runs locally.
A cyber domain and brand-monitoring agent for impersonation and exposure detection - built end to end, SAST-clean, with CI security gates.
Every agent is built on the same discipline: deterministic rules decide the security logic, the model only writes the prose, and a verification pass checks nothing was invented.
Narendra Karki - 25+ years on the defending side of security in regulated financial services across the GCC and UK. Security architecture, cyber risk, and the governance that keeps both accountable.
The lab is where that experience meets AI: tooling held to the same standard as the environments it came from - grounded, verifiable, and honest about its limits.