Assessment
AI Prompt Injection Defense
Adds input and output defences against prompt injection in your AI apps.
Assessment
AI Security Review Assistant
Every pull request, config change or new integration is reviewed for security issues as it happens, before it merges.
Security problems are cheapest to fix before code merges, but busy reviewers miss things. This assistant reads each pull request, config change and new integration as it is opened, checks it against the rules you approve, and posts findings right on the change with severity and a suggested fix. Your reviewers still decide what merges. Nothing is blocked without a person.
- Security findings posted on the pull request before it merges
- Review rules focused on auth, data access, keys and prompts
- A weekly rollup of flagged changes in Slack or Jira
$4,400
20–30 working days
Optional maintenance $249/mo
What it is
AI Security Review Assistant reviews proposed designs, architecture changes and new integrations for security risk, using a simple threat model for each. It also checks the security-relevant pull requests and configuration changes that follow. Findings are ranked by severity, with guidance your team can act on. It does not scan whole codebases or review general code quality.
Why businesses buy it
A security flaw caught in review costs a short conversation. The same flaw found in production can mean an incident, a customer email and a week of cleanup. Most teams know this, but reviewers are stretched and focus on whether the code works. This assistant adds a steady second look at every risky change, in the place your team already reviews. The written scope tells you which repositories, which change types and how many rules are covered before you commit.
Problems this solves
Security issues are found long after the code was merged
The assistant reviews each pull request, configuration change and new integration as it is proposed. Problems can be fixed before they ever reach the main branch.
Senior engineers become a bottleneck for every security review
Routine security checks happen automatically on each change. Senior staff can focus on complex reviews instead of reading every diff for the same common issues.
Risky configuration changes slip through without anyone noticing
Configuration changes and new integrations are reviewed alongside code. A risky setting is flagged on the change itself, where its author will see it straight away.
Developers get vague security feedback they can't act on
Each finding lands on the change, ranked by severity, with guidance developers can act on. They know what to change and why before they merge.
A good fit if
Your team opens pull requests or configuration changes regularly and wants a security pass on each one before it merges.
You want findings attached to the specific change that introduced them, not a separate report disconnected from the code.
You are adding new integrations or third-party connections often and want each one checked as it is proposed.
You want a lighter, change-triggered review rather than continuous scanning of the entire codebase around the clock.
Not the right fit if
You want code and dependencies scanned for known vulnerabilities across the whole codebase on a schedule; see AI Application Security Agent.
You want every pull request reviewed for bugs, style and general code quality, not security design. See AI Code Review Agent.
You want a single comprehensive report covering your systems as they stand today; see AI Security Audit, for a point-in-time review.
Your priority is malicious input reaching your AI models, not code or config changes; see AI Prompt Injection Defense.
You want written policy documents rather than technical review of changes; see AI Security Policy System, for governance and documentation.
How it works
- We connect to your repositories and pull request workflow. Typically GitHub or GitLab, watching for new pull requests, configuration changes and new integration commits as they are opened.
- Review rules are set from your policies. We configure which kinds of changes matter most, such as anything touching authentication, data access, API keys or your AI prompts and tool configurations.
- Each matching change is reviewed automatically. When a pull request or config change touches something in scope, the assistant checks the diff against your rules and known risk patterns.
- Findings post directly on the change. Comments land on the pull request itself, with severity and a short explanation, so the reviewer sees the concern in context, not in a separate report.
- A summary reaches Slack or Jira. Beyond the inline comments, a rollup of what was flagged that week goes to whoever owns security triage, so nothing quietly slips through.
- You get a test report and a working setup at launch. The 60-minute handoff covers how to adjust which changes trigger a review and how to read the findings.
What you provide within 72 hours
Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.
- Written authorization confirming which repositories and systems we may review.
- The list of AI applications, repositories and systems you want in scope.
- Any existing security policies your pull requests should be checked against.
- Read access to your repositories and pull request history, as needed.
- A named IT or security owner who can triage flagged changes after launch.
- Admin access and API keys for every connected system, shared by adding our team as a user or creating a key you control, never by email.
- One decision-maker who can approve the review rules and sign off the launch.
The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.
Timeline
Start
Repositories, scope and review rules confirmed.
Weeks 1–2
Review assistant built and tuned to your change types.
Week 3
Pull request workflow and alerting connections completed.
Weeks 3–4
Documented test scenarios run and results sent to you.
Week 4
Your review and two rounds of changes to the rules.
Go-live
Live, recorded handoff session, 30 days of support begin.
| Option | Delivery time | Price |
|---|---|---|
| Standard | 20–30 working days | $4,400 |
| Express | 15–25 working days | $5,150 |
| Rush | 10–20 working days | $5,950 |
What you receive at handover
- A security review assistant on pull requests, configuration changes and new integrations
- Findings ranked by severity, with guidance, posted on each change
- Up to five controls or policies configured across up to three systems
- A control test log or findings report from testing
- An admin guide, a recorded handoff session and 30 days of post-launch support
Expected benefits and how to measure them
- Issues can be fixed while the change is still fresh.
- Security review can keep pace with development.
- Developers can learn from specific, actionable feedback.
- Findings caught before merge
- Count findings on pull requests each month in your code platform.
- Security bugs found after release
- Track post-release security bugs in your issue tracker, before and after launch.
- Pull request turnaround
- Compare time-to-merge in your code platform for the months before and after.
Before you start: Record recent post-release security bugs and the average pull request review time.
These are things to track, not promised results. Outcomes depend on your data, your team and your market.
Running costs
The build price is one-time. Running the review assistant costs roughly $20 to $300 a month in your own accounts, for hosting, logging and the monitoring tools it relies on day to day.
AI model usage during the build and testing is billed the same way, directly to your accounts, so you keep ownership of every provider relationship involved.
Ask about running costsCustom requirements
If you need something outside the Scope Card, such as review coverage across more than three repositories or systems, add a note at checkout. You get a written Change Quote, and that work only starts once you accept it. Larger or bespoke projects go through the Custom AI request form instead.
Request a custom versionKeep it running
Monthly maintenance covers monitoring and change hours for work such as tuning which changes trigger review or adding a repository. It starts after the 30 days of included support and can be cancelled any month.
$249/mo (the minimum fee, includes 2 change hours)
Optional. Starts after the post-launch support period. Cancel any month.
How maintenance worksHow this compares
| Do it yourself with a SaaS tool | Hire a custom agency | Upmark Labs | |
|---|---|---|---|
| Price | A code review bot charges per seat or per repository, monthly | A security firm quotes after a scoping call | Ours is one fixed price, shown on this page before you buy |
| Scope | A code review bot applies one generic rule set to everything | An agency agrees scope during the engagement | Ours is written on the Scope Card, up to 3 systems |
| Delivery | A code review bot still needs configuration before it is useful | A security firm engagement often takes weeks to schedule | Ours has a fixed delivery time shown before you buy, with faster options |
| Trigger | A code review bot may review every commit indiscriminately | An agency reviews on its own delivery schedule | Ours reviews the pull requests and changes that matter to you |
| Certification | A code review bot does not certify anything on its own | An agency may offer certification as a separate service | Ours is a review and monitoring workflow; no certification is implied |
Questions about this product
What does AI Security Review Assistant actually review?
It reviews proposed designs, architecture changes, new integrations and the security-relevant pull requests or configuration changes that follow. Each is checked against a simple threat model and the rules you approved. Findings post on the change or design document, plus a rollup to Slack or Jira, so reviewers see each concern in context.
How is AI Security Review Assistant different from AI Application Security Agent?
This assistant reviews designs, architecture changes and new integrations against a threat model, plus the security-relevant changes that follow. AI Application Security Agent scans your code and dependencies on a schedule. AI Code Review Agent reviews every pull request for bugs and standards. Many teams pair design review here with scanning from the agent.
How much does AI Security Review Assistant cost to run each month?
Running costs are small and paid in your own accounts: roughly $20 to $300 a month for hosting, logging and the monitoring tools the assistant depends on. The figure stays fairly flat however many pull requests your team opens. We charge nothing per review. The one-time build price, at each delivery speed, is shown in the price panel on this page.
Does it block a pull request automatically if it finds something?
No. It flags concerns with severity and an explanation on the pull request itself, and a person on your team decides whether to merge, fix or discuss it further. We do not give it authority to block or approve changes without a human somewhere in that loop. The goal is to inform your existing review process, not replace the judgment of your reviewers.
How fast does a review happen after a pull request is opened?
Reviews run automatically as soon as a matching pull request or configuration change is opened, typically within minutes, so findings are available before your own team finishes its usual review pass rather than arriving later as a delayed, disconnected report. That speed means findings inform the same review cycle your team already runs, not a separate one.
Can I change which repositories or changes get reviewed later?
Yes. Adjusting which repositories, branches or change types trigger a review fits inside the monthly change hours that come with maintenance. Adding review coverage across more systems than the three included in scope comes through a Change Quote, priced and agreed with you before that work starts. This keeps the assistant useful as your codebase and your team's priorities shift over time.
Who owns the review rules and findings history once it is live?
You do. The review rules, the repository connections and the history of flagged changes all live in your own accounts and tools, such as your GitHub, GitLab, Slack or Jira, not a separate platform we control or hold you to. We keep no separate copy that would lock you into working with us going forward.
Catch the risky change before it merges, not after.
Order AI Security Review Assistant and it starts reviewing your pull requests and config changes, live on a fixed delivery date.
Works well with
Assessment
AI Application Security Agent
Scans application code and dependencies for security issues.
Assessment
AI Security Audit
Reviews your AI applications and agents for common security weaknesses.