Skip to main content
Damascode

Damascode

Secure your systems. Control every access.

We help businesses assess and strengthen security across applications, APIs, identities, integrations, and AI-enabled workflows, including unauthorized agents and Shadow AI.

Discuss a security assessmentGet in touch

Business challenges & use cases

AI tools and integrations expand the attack surface. Unauthorized agents and over-permissioned automation create risks that traditional app scans alone may miss.

  • Employees connect unsanctioned AI tools to company data without IT visibility.
  • API keys and service accounts shared broadly for quick integrations.
  • AI agents granted broad tool access without step-level auditing.
  • LLM integrations that bypass normal authorization on backend APIs.
  • Insufficient logging to reconstruct who, or what, performed an action.

Cybersecurity Engineering & NIS2 Technical Readiness

Engineering-led support for organisations navigating Portugal's Regime Jurídico da Cibersegurança (Decreto-Lei 125/2025): technical evidence, QNRCS-aligned gap analysis and remediation. We are not a certification body, law firm or 24/7 SOC unless explicitly contracted. See the NIS2 Portugal guide in Insights for legal context and timelines.

A. Cybersecurity & NIS2 Readiness Assessment

Baseline picture of assets, configurations and gaps before major remediation spend.

  • Technical asset inventory and Internet-facing asset list support
  • Security configuration review (servers, cloud, identity)
  • Identity and access assessment, MFA and privileged account review
  • Application and API security review
  • Infrastructure, network and cloud review
  • Backup and recovery assessment
  • Vulnerability identification
  • Technical gap analysis against applicable QNRCS control areas
  • Prioritised remediation roadmap
  • Executive and technical reporting

B. Cybersecurity Engineering & Remediation

Hands-on implementation of agreed controls with documentation your auditors can follow.

  • IAM and MFA implementation
  • Server and infrastructure hardening
  • Cloud security improvements
  • Application and API security fixes
  • Vulnerability remediation
  • Secure software development uplift
  • Backup and recovery improvements
  • Logging and monitoring configuration
  • Security documentation and technical evidence packs

C. Continuous Security Engineering

Periodic engineering retainers to keep evidence fresh, not implied by a one-off assessment.

  • Periodic security assessments
  • Vulnerability follow-up
  • Access and configuration reviews
  • Backup validation and recovery tests
  • Security improvement roadmap updates
  • Technical reporting and evidence refresh

Service capabilities

Application & API assessments

Review of critical paths, authentication flows, input handling, and API exposure aligned to your architecture.

Identity & access

Authentication, authorization, least privilege, and role design for people and service identities.

Zero Trust alignment

Resource-level access decisions, segmentation patterns, and practical steps toward continuous verification.

Unauthorized AI & Shadow AI

Discovery-oriented review of unsanctioned tools, data flows, and governance gaps, with remediation guidance.

AI agent security

Tool permissions, privilege boundaries, untrusted input handling, and safe patterns for agent actions.

Secure integration architecture

Hardening LLM integrations, external services, and MCP-style tool servers connected to your environment.

Audit & observability

Audit trails, activity monitoring hooks, alerting recommendations, and security-relevant logging design.

Secure development guidance

Remediation priorities, secure coding recommendations, and implementation support within agreed scope.

Scoped implementation projects

Defined deliverables for identity hardening, API gateway rules, or agent governance, not open-ended promises.

Incident response planning

Playbooks, roles, communication paths and technical runbooks for significant incidents, scoped as planning and engineering support, not a 24/7 SOC unless contracted.

Business continuity & disaster recovery

Backup validation, recovery testing and continuity patterns aligned with your RTO/RPO targets and audit evidence needs.

Security policies & technical controls

Drafting and implementation support for policies, standards and control baselines that match how your systems actually run.

Example implementation scenarios

Engagements differ by maturity: some teams need a baseline assessment; others need help closing specific gaps after AI adoption.

  1. 01

    Review of an internal chatbot that reads from SharePoint or Confluence with weak group mapping.

  2. 02

    API inventory and OAuth scope reduction before exposing tools to an AI agent.

  3. 03

    Governance playbook for approving new MCP servers and third-party AI plugins.

  4. 04

    Hardening a customer-facing app after adding LLM features that call backend microservices.

Engagement process

Step 1

Scoping

Define systems in scope, threat priorities, and whether the goal is assessment, remediation, or both.

1

Step 2

Assessment

Structured review of apps, APIs, identities, and AI touchpoints with findings ranked by impact.

2

Step 3

Remediation plan

Prioritized recommendations with effort estimates and optional implementation support.

3

Step 4

Implementation

Hands-on changes where contracted, configuration, code fixes, and integration hardening within scope.

4

Step 5

Monitoring

Ongoing monitoring only when explicitly contracted; we clarify what is one-off vs continuous up front.

5

AI agent & Shadow AI governance

Unauthorized agents can read confidential information, trigger unintended actions, or operate with excessive permissions while leaving weak audit trails. Governance closes that gap.

  • Inventory of approved AI tools and integration points.
  • Policy for data classes that must not leave controlled environments.
  • Approval workflow for agents that can write to production systems.
  • Minimum permissions per tool and per agent role.
  • Retention and access review for logs that prove who initiated an action.

Relevant technologies

Recommendations are stack-specific; we do not claim vendor certifications unless separately agreed in writing.

OAuth 2.0 · OpenID Connect · API gateways · reverse proxies · PostgreSQL · audit logging · Docker · Kubernetes · SIEM-friendly log formats · MCP & LLM integration patterns

Scope & limitations

  • We do not claim 24/7 SOC services, certified penetration testing, or incident response retainers unless explicitly scoped and contracted.
  • Assessments describe risk and recommendations; they are not a guarantee that no vulnerabilities remain.
  • Regulatory compliance (e.g. ISO, SOC 2) is your responsibility unless you engage us for a specifically scoped compliance-oriented project.
  • Continuous monitoring and alerting are available only as contracted ongoing work, not implied by a one-time assessment.

Frequently asked questions

What is Shadow AI in practice?

It is use of AI tools or agents outside IT-approved channels, for example personal ChatGPT accounts with company documents, or unreviewed plugins with API access.

Can you block unauthorized AI agents automatically?

Blocking depends on your network, identity, and endpoint controls. We help you discover gaps, define policies, and implement controls where your architecture supports them.

Do you perform penetration tests?

We do not advertise penetration testing or red-team services by default. We can review applications and APIs and recommend specialized testing if you need it.

How do you secure MCP servers?

We treat them like sensitive APIs: authentication, least-privilege tools, input validation, network placement, and logging for each tool invocation.

What deliverables do we get from an assessment?

A written summary of findings, risk prioritization, and recommended next steps, plus optional workshops with your engineering and security stakeholders.

Do you help with NIS2 in Portugal?

We deliver Cybersecurity Engineering & NIS2 Technical Readiness: technical assessments, QNRCS-aligned gap analysis and remediation. We do not provide legal opinions or official CNCS certification.

Related services

Reduce risk before AI scales.

Share what you are running today, apps, APIs, and AI experiments. We will propose an assessment scope that matches your reality.

Request a security conversation