Engagements

Five rungs. Each one ends with something you keep.

Start free. Stop at any rung with something in hand.

Runs beside your current system. Nothing to rip out.

01 Launch Fraud Review Free, in writing
Private attack tree of the new flow

Exit: Keep it. No obligation.
02 Shadow test 14 days, free
Scores and reasons on your own traffic, next to your current results

Exit: Keep the report. No obligation.
03 Architecture sprint 10 days
Written review of your fraud surface, scoped to one number we name with you first

Exit: Plan in hand.
04 Pilot 30 days
Engine live in parallel on one flow, measured against that number

Exit: Go or no-go on evidence.
05 Production Ongoing
Real-time scoring API sized to your traffic

Exit: Quoted on request.

The rungs, step by step

What happens on each rung.

Stop at any rung. Each one stands alone.

Launch Fraud Review

Free, in writing

A private attack tree of the new flow, before it goes live.

Tell us what you are launching.
Company, work email and two lines on the new rail, product or market.
We draw the attack tree.
How the flow gets abused, what it could cost you, and which three controls matter most.
You get it in writing.
Signed by Amir Shachar, then a private page with each item tagged Observation or Hypothesis.

You get: Private attack tree of the new flow.
Exit: Keep it. No obligation.

Get a Launch Fraud Review

Shadow test

14 days, free

Scores and reasons on your own traffic, next to your current results.

Share a sample.
Historical or mirrored traffic for one flow. We agree the fields first.
We score it in parallel.
For 14 days, with nothing in your decision path.
You check the analysis yourself.
The report and the raw scores, so your team can verify every number.

You get: The report, the raw scores and the reasons.
Exit: Keep the report. No obligation.

How a shadow test works See a sample report

Architecture sprint

10 days

A written review of your fraud surface, scoped to one number we name with you first.

Name the number.
Loss rate, approval rate or review-queue size, agreed before work starts.
Map the fraud surface.
Every path money and accounts can take through the flow, written down.
Test the controls against it.
Which controls hold on each path, and which do not.
Hand over the written plan.
What to change first, in the order that moves the number.

You get: A written plan.
Exit: Plan in hand.

Pilot

30 days

The engine live in parallel on one flow, measured against that number.

Settle the number.
The same number named in the sprint, or one agreed now.
Run the engine in parallel.
On one flow, beside your current system.
Measure against the number.
Results reported the way you already report it.
Decide on the evidence.
A go or no-go, with the data behind it.

You get: A measured result on one flow.
Exit: Go or no-go on evidence.

Production

Ongoing

Real-time scoring API sized to your traffic. Quoted on request.

Size it to your traffic.
Volumes and peaks agreed with your engineers.
Connect the scoring API.
Real-time scores and reasons, beside your current system.
Keep measuring.
Against the same number the pilot used.

You get: A live scoring API.
Exit: Quoted on request.

Fixed-scope assessments

Fixed-scope assessments, by buyer problem.

Start from the problem you have. Each assessment has a fixed scope and a written result.

Prove your AI agents and models are safe

For banks, insurers and fintechs putting AI into claims, onboarding, servicing, fraud and AML work, and for the model-risk teams that must sign off on it.

AI Agent Incident Tabletop 3-hour session or on-site half dayAn AI agent fails overnight, for example an onboarding agent passing hundreds of synthetic identities, and nobody has rehearsed who decides what when the regulator and the press call.
Agent Blast Radius Statement 1 to 3 weeks, set by how many tools the agent holdsNobody can say, in money terms, how much damage a production AI agent could do if it were fully hijacked.
Held-Out Model Validation Exam Agreed on a short call, set by the model and the use caseYour bank's model-risk team must validate an LLM before go-live, and the public benchmarks it was scored on may already sit in its training data.
AI Investigator Proving Ground Agreed on a short call, set by the agent and the case typesYou want AI agents to work fraud and AML alerts, but you have no case file where the right answer is known in advance.

Impersonation, deepfakes and social engineering

For fintech, payments and finance teams whose people, and whose AI agents, can be talked into moving money. Every drill runs only with written consent.

Scam-Script Test for AI Chat and Voice Agents 3 to 4 weeksScammers will try to talk your customer-facing AI agent into resetting access, changing details or moving money.
Deepfake Executive Drill 3 to 4 weeksA fake CEO built from public video and audio asks finance, treasury or payroll to pay, or to change bank details.
Vendor Bank-Change Drill 2 to 3 weeksPayment-redirect fraud works when accounts payable changes a vendor's bank details without calling the number on file and getting a second approval.

Payments, scams and platform abuse

For banks fighting authorised push payment scams, for acquirers and PSPs that do not want to process scam money, and for usage-priced platforms losing revenue to abuse.

Scam Warning Lab 3 weeksYour scam warning screens exist, but you do not know whether they stop a customer who is mid-scam.
Scam-Merchant Trace 2 to 3 weeksDeepfake celebrity ads for fake supplements and crypto get paid through merchant accounts that looked clean at onboarding.
Payout Fraud Audit 2 to 3 weeksPlatforms that pay out to thousands of payees lose money to fake and duplicate payee accounts, takeovers that change where payouts go, and mule payees who cash out fast.
Signup and Credit Abuse Audit Fixed scope; the length is agreed on a short call and set by the log period you shareFree-credit farming, multi-accounting, key resale and metering gaps quietly drain usage-priced AI and API platforms.
Detection Rules Proving Ground Agreed on a short call, set by the rule set and the schemes in scopeYour transaction monitoring and card fraud rules raise alerts every day, but nobody can say how many launderers, mules and fraudsters they let through.

Lending and collateral fraud

For factoring companies, asset-based lenders and private-credit funds whose collateral is only as real as the invoices behind it.

Pre-Funding Invoice Check A pilot on one batch; size agreed on a short callDouble-pledged invoices and redirected bank details are found after the advance has already gone out.
Collateral Book Exam First exam on a fixed scope; monthly afterwards if you chooseField exams sample a handful of invoices, and fraud hides in the rest of the book.

Fraud vendors and third-party AI

For fintechs and banks that depend on one outside fraud vendor, and for vendors whose AI feature has to pass a bank's or insurer's review.

Fraud Vendor Exit Plan A scan first, then an optional build; timeline agreed on a short callYour fraud defense depends on one outside AI vendor, and you have never tested what happens if it goes away.
AI Feature Attack Test for Bank Review Testing window agreed on a short call after written permissionA bank or insurer reviewing your AI feature wants proof it resists prompt injection and data leakage, and written answers stall the deal.

Full product catalog

Riskernel sits beside your current vendor or in-house team, not instead of it, until the evidence says otherwise.

Start with the free rung.

A Launch Fraud Review is free, in writing, and yours to keep.

Get a Launch Fraud Review Talk to Amir

Runs beside your current system. Nothing to rip out.

Tell us what you are launching.

We draw the attack tree.

You get it in writing.

Share a sample.

We score it in parallel.

You check the analysis yourself.

Name the number.

Map the fraud surface.

Test the controls against it.

Hand over the written plan.

Settle the number.

Run the engine in parallel.

Measure against the number.

Decide on the evidence.

Size it to your traffic.