Tervaq Security Intelligence
We investigate digital abuse and AI-enabled threats, assess controls under authorization, and help teams verify the changes they make. The work is evidence-led, confidential by agreement, and grounded in the systems your team actually operates.
The work
Not every claim is a confirmed incident. Our reports distinguish what was observed, what a source reported, what testing established, and what is still unknown.
What is happening, and what does the evidence actually show?
Review lawfully obtained information about account abuse, identity misuse, malicious automation, and AI-assisted fraud. Separate source claims from confirmed observations and identify what needs further investigation.
An evidence-led assessment with a timeline, confidence levels, affected workflows, and recommended next steps.
Where could the controls fail?
Assess agreed application and AI workflows using controlled tests. Examine identity boundaries, agent permissions, business logic, and abuse controls within written authorization and a defined scope.
A technical findings report, safe reproduction evidence, risk priorities, and clearly documented limitations.
Does the change address the problem?
Work alongside your engineering and security teams to review proposed mitigations and retest the affected controls. Record what was fixed, what remains open, and what was outside the assessment.
A remediation review and retest record your team can use to make the next decision.
Research focus
Our focus includes financial services, digital platforms, and organizations deploying AI into sensitive workflows. Each engagement is shaped around the risks, controls, and operating context of the system being assessed.
Enrollment, recovery, authentication, and transaction-related controls.
How automation changes the speed, reach, and behavior of abuse.
Tool permissions, unintended actions, data exposure, and human review boundaries.
Commercial engagements
Investigations, technical assessments, and remediation validation are paid professional services. Fees, deliverables, access, and timelines are agreed before commissioned work begins.
Defined project
A specific research question or risk, a bounded scope, and agreed deliverables. Suitable for an initial investigation or an independent review.
Fixed project fee agreed before work begins.
Milestone-based
A longer collaboration on applied AI, security controls, or complex workflows. Work is divided into reviewable milestones with clear ownership.
A paid statement of work with milestones and acceptance criteria.
Ongoing engagement
Research and briefings around an agreed set of threats, products, or markets. Coverage, review cadence, and escalation arrangements are set together.
A recurring fee for the agreed scope and service level.
Working principles
The purpose of this work is to help organizations protect their systems and users. Our commercial services and responsible reporting are separate.
Security reporting
For an issue affecting Tervaq, start with a brief, non-sensitive summary and request an appropriate disclosure channel. For a third-party system, use that organization’s official reporting process. This page is not a public bounty program or authorization to test.
Work with Tervaq
Describe the risk or research question at a high level. We will discuss scope, authorization, and a paid engagement that fits the work.