Devoile
Devoile is a security testing platform that simulates real-world attacks against both employees and AI systems using publicly available intelligence. The platform builds credible attack paths—such as supplier pretexts and indirect prompt injections—and runs them within agreed boundaries to produce reproducible, evidence-backed findings. It delivers a Human & AI Assurance Report with remediation mapped to frameworks including OWASP LLM Top 10, MITRE ATLAS, and the EU AI Act.
- Cybersecurity
- Artificial Intelligence
- Software Only
- Data & Analytics
Funding
Founders
Founder details are not available yet.
Product
Problem
Attackers exploit publicly available information about employees—roles, reporting lines, suppliers, breach history, and public documents—to build credible social engineering and fraud campaigns. This same intelligence now works against AI agents, enabling prompt injection, retrieval poisoning, and excessive agency attacks that bypass traditional system-focused defenses.
Solution
Devoile collects the attacker's view of an organization from public sources and weaponizes it into reproducible attack paths targeting both people and AI systems. The platform runs adversarial campaigns within agreed boundaries against employees, LLM applications, agents, retrieval pipelines, and connected tools, then traces the full consequence chain. Each attack path arrives with its evidence, impact, and remediation, and is tested again after fixes. The approach moves beyond abstract severity scores by showing exactly what an attacker knew, what they tried, why it worked, and what they gained.
Target Audience
Primary customers are enterprise security teams, risk officers, and compliance professionals who need to protect both employees and AI systems from human-layer attacks and demonstrate proactive risk reduction in security reviews and audits.
Features
- Continuous collection of public intelligence on people, roles, suppliers, breach exposure, and AI interfaces
- Attack path construction covering impersonation, indirect injection, excessive agency, retrieval poisoning, and MCP server abuse
- Cross-referencing of data points such as mobile numbers, carrier information, and leaked credentials to assess attack feasibility
- Human & AI Assurance Report with reproducible attack paths, public-source evidence trails, payloads, transcripts, and business impact
- Remediation mapped to framework coverage including OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, EU AI Act, SOC 2, and GDPR
- Explicit rules of engagement scoped to each organization's architecture and testing boundaries