Spearfish
An AI-powered cyber security division, by Kingly Clark.
You are not up against one person anymore
Breaking in used to take one person, one door at a time. Now it takes a swarm: hundreds of agents trying every door at once.
More than 90%
of the sign-up attempts Microsoft saw in early 2025 came from bots, not people.
This is not a forecast
-
July 2026
OpenAI’s own models broke into Hugging Face.
They escaped a test environment and reached production systems, running thousands of actions across a swarm of sandboxes.
-
November 2025
A state-linked group pointed an agent at thirty organisations.
The agent did the break-in. People did a fifth of the work.
Simply put: you are outnumbered.
Code nobody wrote line by line and shared logins leave more ways in than ever. A swarm finds them in minutes.
You cannot hire your way out of a gap that size.
Deploy the Spearfish Swarm
An AI-powered cyber security swarm, built to combat agentic attacks at their own speed.
The only thing that keeps up with a swarm is another one. Ours runs more than 15,000 checks on everything you expose, around the clock.
Assets
Every domain and IP address you own, even the ones nobody remembers.
Infrastructure
Open ports, exposed services, known vulnerabilities and weak encryption.
APIs
Your API specifications, tested against the OWASP API Top 10.
Email
Whether someone could send email in your name.
Leaked logins
Your people’s logins, found in breach dumps and ranked by risk.
Lookalike domains
Caught as they are set up, often before the phishing starts.
Your people set the rules.
The swarm works in seconds.
Hire us to break in
Our testers lead every engagement, and our agents extend their reach. They change tactics as they learn, read your code when you share it and hunt the open-source parts for flaws nobody has published yet.
AI and LLM apps
Tested against the OWASP LLM Top 10, from prompt injection to tool abuse.
Web apps
Tested against the OWASP Top 10, from logins to business logic.
Mobile apps
iOS and Android, and the API behind them.
APIs
Deeper than the swarm: whether one user can reach another’s data.
External network
Firewalls, remote access and the known flaws in them.
Internal network
From one compromised machine to control of your whole network.
Phishing
A simulated campaign against your own people.
Ready for the auditors
- Baseline
Your security controls mapped to ISO 27001, NIST CSF 2.0 and CIS, with a board report and a 90-day plan.
- ISO 27001
Everything from gap analysis to certification.
- Frameworks
Gap assessments against NIST CSF 2.0, CIS or ISO 42001.
- AI governance
Your AI maturity, measured on a model aligned to the NIST AI RMF and ISO 42001, with actions for the next 30, 60 and 90 days.
- Cloud
Your cloud configuration, benchmarked against CIS.
- Programme
Your baseline tracked for a year, with monthly reviews and a fresh assessment at the end.
Our people, start to finish
- Day one
We agree the scope, sign your letter of authorisation and have the swarm running the same day.
- Every finding
One of our specialists confirms it and cuts the noise, so you only see what is real.
- Every month
A review of what changed, and what to fix first.
- On demand
Reports for your board, your auditors and your insurers.
- As needed
Advice and incident support, by the day or on a monthly retainer.
- At the root
Where the design itself is the flaw, we rebuild it with you.
All of this will eventually be tested against your organisation. The only question is whose swarm gets there first: yours or theirs.