Attack yourself before others do.

UK-sovereign AI security. Varangian runs the operating doctrine PureTensor uses on its own estate: continuous self-attack, bounded self-healing and a disaster-recovery copy no agent can reach. We publish the ledger every five minutes. Then we run the same doctrine for you.

Request a doctrine gap assessment Read the live ledger

Doctrine ledger our production estate

Reading production telemetry

Measuring

A dark tile is a control that is holding. A lit tile is one that is not, and it is published anyway. The lamp test lights every tile to show that each one can.

Measurements and thresholds
Jurisdiction
United Kingdom
Recovery site
Iceland
Compute
Own Blackwell-class GPUs
Client data
No foreign model APIs

Six engagements. One doctrine.

Each engagement applies the doctrine we already run on our own production estate, and the evidence is published in the ledger, refreshed every five minutes.

  • Continuous adversarial validation

    Autonomous penetration testing and exposure validation with documented production-safety rails; threat-led testing ready for DORA and TIBER-EU.

    Rule IDORA Art. 26TIBER-EUNCSC CAF

  • AI-system red teaming

    Prompt injection, memory poisoning, tool abuse and agent authority-boundary testing against the systems you deploy.

    Rule IEU AI Act Art. 15NCSC CAF 4.0

  • Resilience engineering

    3-2-1-1-0 backup architecture, immutable and logically air-gapped copies, isolated recovery environments, restore drills with published recovery objectives.

    Rule IIINIS2 Art. 21Cyber Governance Code

  • Trustless architecture

    Workload identity, just-in-time access, four-eyes authorisation and zero-trust backup.

    Rule IVCyber EssentialsUK GDPR Art. 32

  • Agentic operations design

    Bounded-authority self-healing loops and the enforcement pattern that keeps every agent out of the vault.

    Rules II and VNCSC CAF 4.0EU AI Act

  • Sovereign deployment

    On-premise or UK/EU-sovereign inference for workloads that must not leave your jurisdiction.

    Own computeUK and EU jurisdiction

Five rules, applied to ourselves first.

We apply every rule to our own estate before we sell it. The ledger shows whether we are keeping them today, red included.

  1. I

    Attack yourself continuously.

    In our estate

    Independent model seats review our repositories adversarially every day and open evidence-bearing pull requests; a human re-runs every claim before merge. Exposure is probed from outside our own network, never from inside it. Monitors are audited for the ability to go red.

    For yours

    Continuous adversarial validation of your estate, on our sovereign compute, mapped to DORA threat-led testing and NCSC CAF.

    Live evidence
  2. II

    Self-heal with bounded authority.

    In our estate

    A deterministic scan-and-fix loop with models only at the edges, promoted from shadow to suggest to canary to auto, with a Tier-0 carve-out. Outcomes are graded resolved, recurred or indeterminate, and never green by default.

    For yours

    Autonomous remediation designed with a written authority boundary and a human approval gate for everything outside it.

    Live evidence
  3. III

    Three copies, two media, one out of reach.

    In our estate

    Nightly backups to erasure-coded storage with read-only mounts and no cluster-admin key, staggered mirrors to Iceland, and a send-only to receive-only topology so the recovery site can never push damage upstream. Restores are tested weekly by automation and quarterly by a manual drill.

    For yours

    3-2-1-1-0 resilience engineering with published recovery objectives and an isolated recovery environment.

    Live evidence
  4. IV

    Trustless by construction.

    In our estate

    Rotation with completeness proof, same-day privilege reduction, a private mesh, and trust tiers graded by surface.

    For yours

    Workload identity, short-lived credentials, four-eyes on destructive actions, and zero-trust backup: the identity that writes a backup cannot delete it.

    Live evidence
  5. V

    Agents run the estate. Agents never touch the vault.

    In our estate

    Enforced and audited daily: audit/agent_vault_audit.py probes every model-driven seat from inside its own sandbox and proves no agent credential can read, list or delete disaster-recovery snapshots. The ledger row below is that measurement, and it goes red the day a path appears.

    For yours

    An agentic operations design where no agent credential has a path to disaster-recovery or crucial backup storage. It is the control that turns an AI incident into an inconvenience instead of an extinction event.

    Live evidence

The live doctrine ledger

Generated from our own fleet, refreshed every five minutes and rendered from ledger.json. Every row can go red. A ledger that cannot go red is not a ledger.

Reading the ledger

Measuring

Controls
11
Holding
–
Warning
–
Red
–

Values are measured on PureTensor's production estate. "Red" means the doctrine is not met today and the fix is scheduled; it is published anyway. A missing or unknown measurement is shown as red, never as green.

The regulatory clock

The obligations that make this doctrine mandatory, with the date each one bites, and the threat evidence behind them. Every line links to its primary source.

Obligations, in date order

  1. UK

    UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of security measures.

    Source: legislation.gov.uk
  2. EU

    NIS2 Article 21(2)(c) makes backup management and disaster recovery a mandatory measure, and Article 20 places personal accountability on management bodies.

    Source: EUR-Lex
  3. EU

    DORA Article 26 requires threat-led penetration testing at least every three years, on live production systems, under the TIBER-EU framework.

    Source: EUR-Lex
  4. UK

    The NCSC and DSIT Cyber Governance Code of Practice asks boards for tested recovery plans and independent assurance.

    Source: GOV.UK
  5. UK

    NCSC Cyber Assessment Framework v4.0 adds outcomes for AI-related and autonomous-software risk.

    Source: NCSC
  6. UK

    The UK Cyber Security and Resilience Bill brings managed service providers, data centres and critical suppliers into scope, with 24-hour early warning and 72-hour incident reports.

    Source: UK Parliament
  7. UK

    Cyber Essentials 'Danzell' requirements mandate 14-day vulnerability remediation and hardware-backed MFA for cloud administrative access.

    Source: NCSC
  8. EU

    EU AI Act Article 15 requires high-risk systems to be resilient against adversarial attack, prompt injection and data poisoning.

    Source: EUR-Lex
  9. EU

    The Cyber Resilience Act's 24-hour reporting of actively exploited vulnerabilities to ENISA begins 11 September 2026; full application follows on 11 December 2027.

    Source: EUR-Lex

Threat evidence

  • 62%Breach data, 2025

    Verizon's 2025 Data Breach Investigations Report puts the human element in 62% of breaches, vulnerability exploitation at 31% of initial access and credential abuse at 13%.

    Source: Verizon DBIR
  • Assume breachNCSC guidance, 2025

    The NCSC describes large language models as confusable deputies that cannot reliably separate instruction from data, and advises an assume-breach stance on prompt injection.

    Source: NCSC
  • CVE-2025-32711Zero-click, 2025

    EchoLeak (CVE-2025-32711) was a zero-click prompt injection in Microsoft 365 Copilot that exfiltrated corporate data from a single inbound email.

    Source: NIST NVD

Built, owned and operated by us.

Client work runs on hardware we own, in jurisdictions we chose, with a recovery path no agent can reach.

Compute
6× NVIDIA RTX PRO 6000 Blackwell
VRAM
576 GB
Fabric
400 GbE
Storage
Erasure-coded, distributed
Primary site
United Kingdom
Recovery site
Iceland, outside the Fourteen Eyes

Sovereign source control and memory. Resident open-weight models.

This website is served from a content delivery network; client engagement data is never processed there.

Recovery path

Rule III
  1. United Kingdom Production estate

    Nightly backups to erasure-coded storage with read-only mounts and no cluster-admin key.

    Backup jobsmeasuringpending
    Staggered mirror, send‑only
  2. Iceland Recovery site

    Receive-only and append-only: the push identity cannot forget or delete, and the site can never push damage upstream.

    Iceland copymeasuringpending
    Pulled every 2 h, read‑only
  3. Vault Hardlinked generations, 90 days

    No fleet or agent identity can log in. An agent that destroyed the recovery copy would find the previous generations intact here.

    Agent pathsmeasuringpending
Restores are tested weekly by automation and quarterly by a manual drill. The latest result is the first row of the ledger. The arrows are one-way: each hop can be started from one side only.

Leadership

Varangian is led by the engineer who built and runs the estate the ledger measures, with advisers drawn from capital markets and the boardroom.

  • Portrait of Heimir Helgason

    Heimir Helgason

    Founder & Director

    Builds and operates the Blackwell-class cluster behind Varangian and the autonomous operating doctrine it runs. Previously algorithmic trading and cross-border financial advisory across Europe and the Middle East; co-founded and exited a technology-driven brokerage in Iceland.

  • Portrait of Ahmed W. Khalil

    Ahmed W. Khalil

    Strategic Advisor

    CFA charterholder and former infrastructure finance lawyer; international law, institutional capital allocation and European private equity. Advises on capital strategy and market expansion.

  • Portrait of Alan B. Apter

    Alan B. Apter

    Advisory Board

    Investment banker with over 40 years advising multinationals and boards: Morgan Stanley, Merrill Lynch, Renaissance Capital, Eaglestone Group. Columbia Law School. Founder of Bretalon Ltd.

Trust and disclosure

What we publish about ourselves, and what we do not claim until it is held.

Coordinated vulnerability disclosure

Report a security issue under our disclosure policy. Our contact details are published in a standard security.txt file.

Contact: mailto:ops@varangian.ai
Expires: 2027-09-01T00:00:00.000Z
Policy: https://varangian.ai/vulnerability-disclosure.html
Disclosure policysecurity.txt

Certifications targeted

  • Cyber Essentials PlusApplication planned Q4 2026planned
  • ISO/IEC 42001Gap analysis, 2027planned

None claimed until held.

Programmes

NVIDIA Inception Program member

PureTensor is a member of NVIDIA Inception, the programme for AI start-ups.

Start with a short problem statement.

If there is fit, we schedule a technical call.

  1. Problem statement

    A few paragraphs: the estate, the concern, and any deadline or regulation you are working to.

  2. Technical call

    A call with us to agree scope, people and timing.

  3. Doctrine gap assessment

    Your estate measured against the five rules, with the gaps written down.

Email

Or draft it here

Nothing is sent from this page. Your email client opens with the draft addressed to ops@varangian.ai; if it does not, copy the draft and paste it into any email.

Reporting a vulnerability? Use the disclosure policy.