An agent running on Claude inside another vendor's tool deleted a company's production database and its backups in nine seconds. It had found an unscoped API token sitting in an unrelated file.
SourceSecurity for AI adoption
Your engineers are already using Claude. Your security team has not signed off.
We assess how safely your teams are using it, implement the controls your security team needs, and hand you the evidence your auditors ask for. All within weeks, at a fixed price, in your environment.
We start with Claude. The same controls cover GitHub Copilot, Cursor and the other coding agents your engineers use.
- Certified Claude Services Partner
- Okta partner
- Mapped to OWASP, NIST AI RMF and ISO/IEC 42001
- Certified Claude engineers on every project
Two incidents, 2026
Neither of these was a model failure
Researchers at Black Hat showed that three major coding agents, Claude Code Action among them, could be tricked by text written inside a GitHub issue into leaking CI credentials. The workflows were on default settings.
SourceBoth were configuration. A token with too much reach. A workflow that trusted outside input. An approval step that did not exist. All three are things you can fix this quarter.
The problem
Buying the seats was the easy part
- 01
Nobody knows if it is working.
Most companies cannot say how many of the Claude seats they pay for were used last week, or whether anything shipped faster because of them.
- 02
Security has not said yes.
The controls exist. Turning them on is a project, and nobody on your platform team has a spare month for it.
- 03
There is no evidence.
Ask whether an action in your logs came from an agent or a person. Most teams cannot answer, and neither can their auditors.
How it runs
Four steps, in order
- Step 1
Assess
One week. We score you against 32 controls using your own data, and give you a costed plan.
- Step 2
Contain
Three to four weeks. We implement the controls, and your security team signs off.
- Step 3
Govern
Standards, approvals and monitoring in place, and your developers actually adopt the tools.
- Step 4
Scale
Engineers create, copy and tear down cloud environments through Claude, safely.
Who we work with
We work best where the evidence matters
Our maturity model puts most mid-size software companies at level 2 as a twelve month target. Regulated organizations belong at level 3 across all five domains, because their auditors will ask and the evidence pack is the answer. That is the work we are built for.
Healthcare.
Your developers want Claude. Your auditors want evidence.
Financial services.
Your engineers want Claude. Your examiners want evidence.
We also work with mid-size software companies answering customer security reviews, typically 50 to 300 developers on AWS or Azure, already paying for Claude.
Questions
Questions security teams ask us
DIGU secures AI coding agents inside engineering organizations. We assess how your teams use Claude Code and other agents against 32 controls, implement those controls in your environment, and hand you the evidence your auditors ask for. DIGU is Certified in the Claude Partner Network and is an Okta partner, with certified Claude engineers on every project.
No. We start with Claude, because DIGU is Certified in the Claude Partner Network. The same 32 controls cover GitHub Copilot, Cursor and the other coding agents your engineers use. The risks are the same; only the settings that close them differ by platform.
Configuration, not the model. In April 2026 an agent deleted a production database using an unscoped token it found in a file. In August 2026 researchers showed coding agents leaking CI credentials through text in a GitHub issue. Scoped agent identity, gated workflows and attributable logs close both paths.
The assessment takes one week and makes no changes to your environment. Security Hardening then takes three to four weeks to put the controls in place and produce the evidence pack. Every engagement is a fixed fee against a fixed list of deliverables.
Every engagement is one fixed fee against a fixed list of deliverables, never an hourly rate. Ask for the price list and the full fee schedule arrives by email, with no call in between. The assessment fee is credited in full against any engagement signed within thirty days.
No one can certify you compliant for using AI. Certification is the work of an accredited auditor. We implement controls mapped to OWASP, the NIST AI Risk Management Framework and ISO/IEC 42001, and produce the evidence your auditor expects, so the answer already exists when they ask.