AI red teaming for banks and regulated enterprises
Borzone continuously tests your applications, application programming interfaces (APIs), internal network and AI agents the way a motivated adversary would, on open-weight security models that run inside your own network. Nothing leaves. Every step is scoped, approved and evidenced.
Early access · taking a small number of design partners
Zero outbound traffic in air-gapped mode
sealed in, Borzone makes no outbound connections
Every step scoped in software
rules of engagement enforced by the harness, not the model
Evidence built for DORA & RBI programmes
Digital Operational Resilience Act (DORA) · Reserve Bank of India (RBI)
Three things changed at once. Together they ask for a different kind of security testing than a periodic engagement can give.
A capable adversary probes continuously and chains small weaknesses into a real path. Most testing is still a once-a-year engagement, so the window between tests is where the risk lives.
The most sensitive systems and the models that reason over them can't be handed to a rented, hosted model. Testing that depends on sending your traffic to someone else's cloud is a non-starter in a regulated environment.
The Digital Operational Resilience Act (DORA) in the European Union sets out threat-led penetration testing (TLPT), and the Reserve Bank of India (RBI) requires regular vulnerability assessment and penetration testing (VAPT). Borzone is built to produce the evidence these programmes ask for.
The Borzone engagement console shows what is in scope, what the agents are testing, what they have found, and what is waiting for a person to approve.
scope: staging only
An agent wants to take the next step on a finding. It waits here until a person decides.
Rules of engagement are agreed up front and enforced in software. What is in scope, what is off limits, and what needs a person's sign-off are set before anything runs.
Borzone maps what is actually exposed across your applications, interfaces, internal network and AI agents, so testing works from the real surface rather than a stale diagram.
Agents look for weaknesses and connect the ones that matter into a real path. Any step that could change data stops and waits for a person to approve it.
Every finding comes with replayable evidence and fix guidance, so your team can confirm it and act, not take a report on trust.
When a fix ships, Borzone retests it and closes the loop, so you know the weakness is gone and stays gone.
outer zones secured · one path to the core
Real incidents cross boundaries. Borzone tests across them instead of treating each layer on its own.
The surfaces your customers and partners reach, tested for the weaknesses that let an outsider in or let one account reach another.
What an adversary can reach once they are past the edge: flat segments, exposed consoles and paths that should not connect but do.
The settings that quietly widen the blast radius: over-broad roles, open storage and services reachable from further than intended.
The newest surface: assistants and agents that read untrusted input and can act. Borzone tests whether they can be steered past their intended bounds.
Reads the code behind the surface to find what black-box testing alone would miss, and to point a fix at the right line.
Borzone is self-hosted by design. You choose how tightly it is sealed in.
Run Borzone air-gapped, with zero outbound connections. Nothing about your environment leaves the perimeter it is testing.
Prefer a cloud account you control? Deploy Borzone into your own private cloud, under your own identity and network rules.
The security models are open-weight, fine-tuned on your environment, and they stay yours. No rented model sees your traffic.
The controls live in the harness, not the model — scope, approvals and logging are enforced by the software around the model, not left to the model to honour.
Borzone is built on work Velofy already does in the open and in production.
Velofy's multi-agent harness, with sandboxing and approval gates built in. It is proprietary and available by invitation.
Proprietary · by invitationAn open-source browser that agents attach to, with safety rules enforced by the browser itself rather than trusted to the agent.
Open source, MIT · troy.velofy.co →A Python client for the web with its own TLS 1.3 stack, so traffic is shaped and controlled from the socket up.
Open source · PythonAn open-weight security model Velofy is building to run inside the customer network. It is in development.
In developmentA tool that probes your own systems has to be safe to run. These are design principles, not boasts.
Designed so that every step an agent takes is recorded and attributable, with nothing happening off the record.
Designed so that a person can stop everything at once, immediately, without waiting for a step to finish.
Designed so that, sealed in, Borzone makes no outbound connections and nothing about your environment can leave.
Designed so that the rules of engagement are enforced by the harness, not left to the agent to respect.
We are taking on a small number of design partners in early access. A briefing is the place to start.
Book a briefing