Citizen data at stake
Portals for tax, health, and permits hold identity records for entire populations.
For Government & Public Sector
Penetration testing and security audits for the public sector
AI security assessments for citizen portals, internal platforms, and the services between agencies: static analysis, dynamic testing, API audits, and AI security in one run. Validated findings and audit-ready evidence in hours, not weeks.
Why the public sector needs security testing
Citizen portals hold identity, tax, and health data, and agencies connect to each other and to private partners more every year. A flaw in one service can reach many, and NIS2, procurement rules, and audits increasingly require proof that you test.
Many doors between agencies
Shared platforms, partner integrations, and legacy systems widen the path to a single record.
Rules that require evidence
NIS2, audits, and tenders now ask for testing reports, not plans to test later.
Evidence for audits and tenders
Assessment reports carry validated findings, retested fixes, and structured evidence for audits and procurement. AISafe Labs does not certify compliance; it supplies the technical testing behind it.
NIS2
Article 21 requires risk controls to be tested for effectiveness, although it does not prescribe a pentest.
GDPR
Article 32 requires regular evaluation of security measures, but it leaves the testing method risk-based.
ISO 27001
Auditors use testing evidence to assess technical vulnerability management and security testing controls.
NIST 800-53
CA-8 explicitly covers penetration testing when that control is selected for the system.
What we test
Pick the depth that fits your systems. Every assessment reports only validated findings.
Source Code Audit
Identify all the vulnerabilities throughout your application, including business logic flaws, authorization weaknesses, architectural issues, insecure data flows, and implementation errors directly from the source code.
White-Box Pentest
Combine source code analysis with testing against a live environment to uncover vulnerabilities, execute real exploits, validate impact, and identify attack paths that only emerge in running systems.
Black-Box Pentest
Assess your application from an attacker's perspective by discovering, and chaining vulnerabilities in a live environment, including permission bypasses, authentication flaws, and privilege escalation paths.
Security testing across public sector systems
One assessment covers citizen-facing services, the platforms behind them, the APIs that connect agencies, and the AI added on top.
Static analysis (SAST)
Reads source without running it. We audit application and integration code for hardcoded secrets, injection, unsafe deserialization, and broken authentication, including in procured and legacy code.
Dynamic analysis (DAST)
Tests the running service. Citizen portals and internal web apps get authenticated testing for injection, XSS, broken access control, and session flaws.
API and integration security testing
The APIs between agencies, identity providers, and partners are tested for IDOR, excessive data exposure, and weak authorization, the flaws that let one citizen read another record.
AI security testing
We test the AI in public services, chatbots, document processing, and decision support, for prompt injection and data leakage. AI agents run the assessment itself.
Integrations
Point AISafe at your repositories and trackers. Assessments start from the workflow your team already runs.
- GitHub
- GitLab
- Bitbucket
- Jira
- Linear
- Slack
- Microsoft Teams
- Google Workspace
Works best with
The clouds, runtimes, and identity layers public services usually sit on are the ones our agents test every day.
- AWS
- Microsoft Azure
- Google Cloud
- Docker
- Kubernetes
- Keycloak
- PostgreSQL
- Redis
- Java
- .NET
- Node.js
- Python
Software our assessments are built to secure
Examples of the products our assessments target. We name them to show the kind of software we test; they are not customer references.
International public-sector platforms
- Palantir
- ServiceNow
- Salesforce
- Microsoft Azure Government
- AWS GovCloud
Romanian public digital services
- e-Guvernare
- Ghiseul.ro
- ANAF online services
Popular Romanian tech
- Siveco Romania
- UiPath
- Bitdefender
Security that holds after the report
The threat model built during the assessment keeps working once the code starts changing.
Pull Request Review
New code is evaluated against the threat model established during the assessment, preventing changes that weaken permissions, break trust boundaries, or violate critical security invariants.
Endpoint Monitoring
Endpoints, permissions, and trust boundaries discovered during the assessment are continuously validated, ensuring security controls remain enforced as applications evolve over time.
Frequently Asked Questions
Yes. Scope the web applications, APIs, and integrations you approve, from citizen portals to internal case-management platforms. We test exactly those systems and nothing else.
NIS2 requires security testing and evidence of it. Our reports contain validated, reproducible findings and retested fixes that feed the audit. AISafe Labs does not certify compliance with NIS2.
All data, including source code and findings, is stored encrypted. Assessments do not need citizen records, and you can permanently delete any data from the platform at any time.
You set the scope and the assessment starts right away. Results arrive in hours instead of weeks, and you can run it again after fixes, before the next audit or release.
Each fix can be retested in the same scope. The report then shows the full cycle: finding, fix, and confirmation, which is what auditors and tender committees ask to see.
Connect GitHub, GitLab, or Bitbucket and start an assessment from the code you already ship. Findings can flow to Jira or Linear and alerts to Slack or Microsoft Teams, so fixes stay in the tools your team uses.
Can't find your answer here? Get in touch