Australian consultancy Parabellum launches offensive AI capability

Australian offensive security consultancy Parabellum has launched Otis, a proprietary AI capability its consultants will use to deliver penetration testing engagements.

Otis runs in an isolated environment in AWS ap-southeast-2 in Sydney, with model inference on Amazon Bedrock, which is IRAP assessed at the PROTECTED level.

Client data is processed in Australia and is never sent to a third-party model provider, and no client data is used to train any model.

The capability was designed, developed and tested in-house by the company's security researchers and offensive security experts, including consultants holding advanced offensive security certifications and Australian government security clearances.

Stuart Shanahan, director of technical services at Parabellum, said the most sensitive thing produced in a penetration test isn’t customer data, it’s the map of how to attack.

"If your provider is calling a commercial AI service, that map is being processed by a third party, usually offshore. For anyone with APRA or SOCI obligations, that should be a procurement question, and until now it has been a difficult one to get answered," he said.

Shanahan said that the company built for autonomy first and the results were disappointing.

"Given a fixed budget the agents went wide and shallow, then declared themselves finished at roughly the depth where the interesting work starts," he explained.

"Remove the budget and the compute cost just keeps climbing. Something or someone [must] decide where the depth gets spent, and that call is about what would actually hurt the client, not about security technique. Two findings can look identical on paper and only one of them matters, and knowing which is which takes a senior consultant who understands the environment."

Otis-augmented delivery is available now for external network, wireless, web application, mobile application, thick client, API and cloud security testing, with findings validated by a qualified senior consultant before delivery.

Parabellum is accredited by CREST International and is a signatory to the CREST AI Charter. The firm is also ISO 27001 certified, with clients including Australian Government agencies, Defence Primes, Fortune 500, ASX 100 and critical infrastructure organisations.