Surelio is listed in the OWASP GenAI Red Teaming Landscape

The OWASP GenAI Security Project has published its AI Security Solutions Landscape for AI and Agentic Red Teaming for Q2 2026, and Surelio is listed in it. OWASP is one of the most established open-source communities in software security, and its GenAI Security Project has become a reference for practitioners and organizations trying to address the specific risks of deploying large language models and autonomous agents. Inclusion in this landscape is community-driven and capability-based, not commercial. That is what gives it weight as a signal of credibility in the field.

Nine categories, from design to governance

The landscape maps providers across nine categories that follow the full lifecycle of an AI system. Surelio is listed across six of them.

	Lifecycle category	Surelio
1	Scope & Plan	listed
2	Augment & Fine Tune Data	listed
3	Develop & Experiment	listed
4	Test & Evaluate	listed
5	Release	—
6	Deploy	—
7	Operate	—
8	Monitor	listed
9	Govern	listed

Expert coverage across the full lifecycle

This breadth reflects how Surelio actually works. Every engagement starts with a structured inspection phase: understanding the system’s architecture, data flows, integration points, and risk surface before any testing begins. From there, the team moves into adversarial behavioral testing, generating empirical evidence of how the system behaves under real-world attack conditions, including prompt injection, agent escalation, data leakage, and misuse scenarios specific to the client’s context. The outputs are always structured and reproducible, producing artifacts that teams can use for ongoing monitoring, governance reporting, and evidence-based decision-making.

Concretely, the listing in Scope & Plan, Augment & Fine Tune Data, and Develop & Experiment reflects the inspection and threat modeling work that opens every engagement, starting before a system reaches production. Test & Evaluate maps directly to our adversarial behavioral analysis. And our presence in Monitor and Govern reflects the recurring assessment cycles and structured evidence artifacts that feed into risk registers and board-level reporting.

The three categories where Surelio does not appear (Release, Deploy, Operate) correspond to infrastructure and production operations, activities that belong to the client’s engineering team or their technology partners. Surelio deliberately operates upstream and downstream of those phases: we define what needs to be verified before a system goes live, and we evaluate how it behaves once it does. This separation is not a gap. It is what guarantees the independence of our assessments.

Most providers in this landscape are specialized tools or automated platforms built to address a single phase. Surelio’s coverage across the lifecycle reflects a different model: a team of scientists, security researchers, and practitioners working together on each engagement, from the first scoping conversation through to the final deliverable.

What this means if you are deploying AI

The risks of a GenAI system do not appear only at go-live. They exist from the moment the system is designed, they shift as the model is fine-tuned or connected to new tools, and they continue to evolve in production. Addressing them seriously requires expertise that spans the full lifecycle, grounded in the specific architecture and use case of each system.

Being listed in the OWASP landscape across six lifecycle categories is an external, community-based confirmation of that scope of expertise. It means that when an organization engages Surelio, they are working with a team that the field itself recognizes as relevant at every stage of making an AI system trustworthy.

The full landscape is available at genai.owasp.org.