Why Alacrix
We challenge the system before it is trusted with real work.
Alacrix is independent of whoever builds your AI. We assess whether the risks are understood, test whether the controls hold, state the exposure that remains and give accountable owners an evidenced basis to approve, condition or decline deployment.
Our position
We do not build your AI. We independently assess whether it can be trusted, and we say what remains exposed.
Comparison
Where the other parties stop.
The builder proves the system works. GRC advisers assess documents. Conventional security testing looks at the environment. Independent AI assurance covers what none of them own.
| Capability | AI builder or vendor | GRC or policy adviser | Conventional security testing | Alacrix |
|---|---|---|---|---|
| Interest in approval | Direct | Indirect | Limited | None |
| Material risk | Framed around capability | Documented at framework level | Assessed as technical threat | Assessed against real reliance and consequence |
| Control testing | Self-assessed | Reviewed on paper | Environment and application scope | Exercised across risk, security, safety and governance |
| Human oversight | Assumed | Described in policy | Out of scope | Tested for whether it changes outcomes |
| Residual risk | Rarely stated | Held at register level | Not concluded | Stated and assigned for accountable acceptance |
| Deployment view | Recommends go-live | No readiness position | Findings only | Independent readiness conclusion with conditions |
Principles
How we work.
The standard we hold ourselves to when an organisation relies on our conclusion.
Independent of the build
We do not build, resell or operate the AI systems we assess, so the conclusion is not shaped by an interest in approval.
Controls tested, not described
A control counts when it has been exercised. Documentation is evidence of intent, not of operation.
One joined-up assessment
Risk, security, safety, governance and evidence are assessed together because failures form at the joins.
Residual risk stated plainly
We do not claim AI can be made risk free. We state what remains and who is accepting it.
Human accountability made explicit
Where consequence is material, we test whether a named person can genuinely intervene in time.
Agentic AI held to its authority
Systems that act, not just draft, are assessed against the permissions and containment their authority demands.
Agentic AI
More autonomy requires harder challenge.
An agent that can search, write, send, update or trigger is not merely generating output. It is exercising delegated authority inside your operating environment.
We assess what it can reach, which actions it can take unassisted, whether approval gates are meaningful, whether misuse would be detected and whether a person could contain or reverse unexpected behaviour in time.
Next step
Establish what your organisation can prove.
An independent assurance review is the fastest route from assumed safety to tested controls, stated residual risk and an evidenced decision.