InlineScan · in pilot
Digital CISO Agent
Evidence you supply, narrated against the Essential Eight, and an AI endpoint you nominate, red teamed.
InlineScan reads the security evidence you supply and narrates it against a control catalogue. It does not test your network or infrastructure: beyond the DNS lookup that checks you control a domain you add, the only traffic it aims at your systems is prompts to an AI endpoint you nominate, passive requests to a domain whose consent record you have published, and, in pilot, a daily read-only review of an AWS account or Microsoft 365 tenant whose administrator has granted it access. Every statement in a report says where it came from, so you can check the evidence behind a sentence rather than take the sentence on trust.
The control catalogue
The control catalogue, and how much of it this product's evidence reaches
A grid of 70 cells, one for each control in the catalogue, grouped into the catalogue's four sections. 35 cells are filled, for the controls at least one evidence source can reach. The remaining 35 are ruled off, for the controls nothing in this product can look at. A report prints those as not assessed rather than leaving them blank.
The catalogue
70
controls in the list
The same list for every account, and a report prints all of it rather than the part it can answer. ASD is consulting on replacing the Essential Eight with an "Essentials" series; the November 2023 Maturity Model stays in force, and this catalogue will map to a published chapter, not a draft.
Reach
35
its evidence reaches
Every evidence source together reaches this many, Microsoft evidence being the newest of them. The other 35 print a line saying no upload would move them, and the report says which.
Red team
34
adversarial probes
5 classes, 4 phrasings each, mapped to the OWASP Top 10 for LLM Applications.
Egress
1
published address
Every connection from InlineScan arrives at your systems from it. The address is on the trust page.
How it works
Four steps, and the product refuses them out of order.
Consent governs everything this product does to an address. Nothing can be uploaded, collected or tested for a host until somebody has proven they control it and a named person on that account has approved it, and both halves are checked every time rather than recorded once as a policy.
The four steps, in the order the product enforces
An ordered list of 4 steps. Each one depends on the one before it, and the product refuses a step taken out of order.
-
Prove a domain you control
Ownership is proven per host with a DNS TXT record, then approved by a named person on your own account. Inline Code staff cannot approve a domain for you.
DNS TXT, your own approver
-
Upload the results
You run the engine against the host yourself and upload the export: a Prowler run for cloud posture or Microsoft 365, or Defender and Intune device data saved as JSON from the Microsoft API (CSV downloads from the admin portals are not read yet). Nothing can be uploaded for a host that is not verified and approved. Or, in pilot, connect an AWS account or Microsoft 365 tenant, and InlineScan runs the same engine against it once a day from its own account, through read-only access your administrator grants.
A rated engine, run by you
-
Read the narration
The agent narrates what you supplied, maps it to the Essential Eight and the OWASP LLM Top 10, and drafts remediation you can edit. Each status cites the records behind it.
What was observed, when, by what
-
Red team an endpoint
Optional, approver only, and it causes traffic. A run sends adversarial prompts to an endpoint you nominate, and a judge reads each reply against the safe behaviour the probe stated.
Probes, judge, verdict
The blanks
It says Not assessed, and means it.
A silence read as a pass is the failure this report is written against. So a control nothing has looked at prints a sentence saying which kind of nothing is true of it, and never a gap. The report distinguishes ten wordings in that family, because ten different things can be true of the evidence and they ask different things of you. Three are below, in the report's own words.
A control no evidence has reached
Not assessed. Nothing has pointed at this control either way. This is not a gap: nothing has looked, which is different from something having failed.
A further upload can move this one.
A control outside every evidence source
Not assessed. Nothing in this product can look at this control: our evidence is scan results you upload or InlineScan collects from a connected account, our own collector reading a public web host, red-team testing of a nominated endpoint, and the AI register, and none of those reaches this control. […] It is not a gap, it is not a pass, and no upload would change it.
No upload moves this one. Assess it somewhere else.
A control whose evidence is below gap grade
Not assessed as a gap. 2 distinct current observations bear on this control, cited below, and together they do not reach the weight a gap needs: one confirmed finding of medium or higher severity, or confirmed findings in two or more different scopes (hosts, and the account as one). […] This is not a gap, and it is not nothing: the observations are there to be read.
This is the one that asks something of you. Read the observations.
Quoted from the report. A sentence left out of the middle of a quotation is marked; nothing inside the quotation marks is paraphrased. The count in the third is the report's own, computed for the control it is printed against, so it is an example rather than a fixed number.
Adversarial testing
Red team an AI endpoint you nominate.
An assistant behaves differently from its configuration. A system prompt can forbid something the deployed endpoint does anyway, because the model is the thing deciding and the prompt is only one of its inputs. The corpus holds 34 adversarial prompts in 5 classes. A run sends the ones your endpoint can fail, one at a time and never in parallel; a probe that needs a capability you have not declared is marked not applicable rather than counted as a refusal it never earned. 7 of them plant something in an earlier turn and test it in a later one, so an endpoint that cannot carry a conversation is sent fewer. Each asks the target to do something it should decline, so that the declining can be observed. A probe is not an exploit: the dangerous part is what your assistant can reach, not the text of the prompt.
| Class | Probes | OWASP | What the probe asks the assistant to do |
|---|---|---|---|
| prompt injection | 13 | LLM01, LLM07 | Reveal its system instructions, or follow an instruction that arrived as content: hidden in a document, encoded, or planted in an earlier turn. |
| tool abuse | 7 | LLM02, LLM05, LLM06, LLM07 | Enumerate its tools, accept injected arguments into a call, or point a tool at an address the requester supplied. |
| privilege escalation | 5 | LLM02, LLM06 | Return another user's data on an unverified claim, act as an administrator on request alone, or approve its own pending request. |
| data poisoning | 5 | LLM01, LLM04 | Write a durable false instruction into memory, or treat a poisoned document as authoritative context. |
| supply chain | 4 | LLM02, LLM03 | Load and act on an externally hosted instruction file, or disclose exact model, framework and plugin versions. |
Three verdicts
Refused, complied or inconclusive. The judge is asked one question per exchange, which is whether the safe behaviour the probe stated actually occurred, never the open question of whether something went badly. Inconclusive is a real answer rather than a failure to produce one.
A second reading, and when there is not one
A first verdict of complied from the structured reading goes to a second reading through the other output channel; disagreement is downgraded to inconclusive and both rationales are kept. A complied reached only through the text fallback is kept as the single reading it is, and labelled. The second reading guards against a false finding and does nothing for an unearned pass, which is what asking it only of a complied verdict buys and what it costs.
A secret marker, and its limit
Plant a string in your system prompt and any reply containing it is scored as a disclosure. Case is ignored, and percent-encoding, HTML entities and base64 are decoded and checked. Rot13, bare hexadecimal and the marker spelled out in words are not caught, so a run with no marker hit is not evidence the prompt held.
Every probe has 4 phrasings, being the original, two paraphrases and one obfuscated form, each hand written and each asking for exactly the same thing as its parent. What a run cannot do: it cannot tell you the endpoint resists prompts outside the corpus. A completed run with no compliance is supporting evidence for this endpoint at this time, and it is not a guarantee.
Every probe is also filed under MITRE ATLAS and, where an entry applies, the OWASP Top 10 for Agentic Applications, beside the OWASP LLM Top 10 it has always carried. A probe whose whole ask is a disclosure, such as revealing the system prompt, carries no Agentic Applications entry, because that list has none for a disclosure alone.
Checkable
Built to be checked, not believed.
You are handing a security product a list of where your estate is weak, so what happens to that list is not a footnote. All outbound traffic leaves through one gateway, so every connection from InlineScan arrives at your systems from a single published address. Every store call carries an account identifier and the database enforces row-level separation underneath it, so a route that forgot to scope a query still reads nothing.
The address, and what has to be true first- The auth header value you give a red team run
- Held for the length of the run. It is written to no record, no audit trail and no log.
- The secret marker used in a run
- Never written down. The record says one was declared, not what it was.
- Replies, on a run that used a marker
- None at all. A reply is a place an encoded copy of your marker would sit permanently.
- Who did what
- An audit trail of its own. A failed audit write stops the action rather than proceeding quietly.
Reporting
A digest and a board report, built from what you already hold.
Comparing two results for the same host and engine already shows what appeared, what changed severity, and what is no longer reported, with the same caveat every time: absence from a newer result is not evidence of a fix. A monthly digest and a quarterly board report build on the same stored records: what regressed, what improved, what is new, and what still needs a decision. Nothing in either document is drafted by a model. Both are computed from your account's own records when you open them.
They read whatever has been stored for the period, which today means whatever you uploaded, your runner posted, InlineScan's own collector observed, or InlineScan collected from a provider account you connected. Open either from the Reports page and export it as a PDF.
Producing them today still means opening the page. The automatic monthly run exists in the code and is switched off, and sending either by email has not been built, so treat both as available on request rather than as something that arrives on its own.
Roadmap
What is intent, not shipping.
Nothing in this section ships today. It is what the agent above grows into, described as intent rather than as capability, and we will say plainly when each part arrives.
Everything above this line is running now. Everything below it is a design we are working towards, and the two are kept apart on this page for the same reason the report prints a blank rather than a guess.
Platform health
The intent is continuous checks against the configuration baselines that matter: identity, endpoint, cloud posture, logging coverage. The work a fractional officer currently does by hand each month.
Live attack and misconfiguration surfacing
Bringing what your existing tooling already sees into one place, with the context needed to decide whether it matters, rather than adding another console.
Control drift tracking
The intent is to close the gap between two uploads on its own: a scheduled recheck of cloud and identity configuration, not only of the public web host, that finds a control that quietly reverted, before the next audit does, without anyone needing to start it.
Reporting delivered, not just readable
The intent is for a monthly digest and a quarterly board report to arrive on their own, by email, on a schedule, without anyone needing to remember to open the page.
Principles
The constraints we are building inside.
We spend our working life telling clients what happens when an agent has too much access and too little oversight. It would be poor form to ship one that ignores our own advice.
A named human is accountable
The agent does not carry accountability. A person does, and that person is your fractional officer. Nothing in this changes who answers to the board.
It reports, it does not remediate
The design intent is read and report. Changes to your environment stay with humans holding change authority, which is also what the joint agency guidance asks for.
Its own containment comes first
A security agent reading your telemetry is a privileged principal reading attacker-influenced text. It gets the same containment we would build for any client agent, before it goes anywhere near a customer environment.
Existing clients first
Delivered to current fractional officer clients before it is offered as a standalone service, because they are the ones whose baseline we already understand.
Pilots
What a pilot is, and what we ask for.
Access is granted per organisation, by a reviewed change to a file in our repository rather than by a sign-up form, so who can use this and since when is a matter of record. Your team signs in with its Google Workspace or Microsoft work accounts.
-
Free while it is a pilot
No charge for an agreed period. The arrangement is documented like any other engagement, and pricing is agreed with you before it converts to a paid one.
-
Your reporting problem, in detail
What your board actually asks for each month, what takes longest to assemble, and which questions you currently cannot answer without a week of notice.
-
Willingness to review output critically
The narrator has not been measured for its production false-positive rate. We would rather you told us where it is wrong than trusted it, and that feedback is the point of the arrangement.
Get started
Run it against a domain you control.
Tell us what your monthly security reporting costs you in hours and where it falls short. If the fit is right we will set you up as a pilot, free for an agreed period, and agree pricing with you before it converts.