ekeraA safe and verifiable architecture AI
Plugging an AI into a company’s tools raises two problems that demos tend to skip: the content of those tools can hijack it, and it can invent figures with total confidence. For a CIO or a CISO, either one is a deal-breaker. Ekera was designed around both risks.
The problem
A map of an information system is built from sources nobody fully controls: a server name in the inventory, a ticket description, an architecture document, a free-text field in the directory. Any one of these strings can hide an instruction aimed at the AI. This is indirect prompt injection, ranked first among the risks of large language model applications by OWASP. The second risk is confabulation: a model confidently produces false information, such as a loss in euros or a compliance score.
Filtering suspicious instructions or asking the model to be careful reduces the risk without removing it. Ekera starts from a different principle: make these errors impossible by construction, and prove it with measurements.
Four innovations
1. A console that does not read your data
When a CIO asks a question about the map, the AI picks read operations from a closed repertoire and decides their order, without ever seeing the map’s content. An ordinary program runs those operations and writes the sentences of the answer. An instruction hidden in a server name therefore never reaches the model: it stays data. Missing and unknown information is always stated, so an empty search never passes for evidence.
2. No figure without a calculation, no fact without a source
Ekera’s figures (expected annual loss, blast radius, NIS2 score) come from a deterministic calculation engine, not from the model. Before a report or an answer goes out, every figure is recomputed on the final map, and every statement about the information system must cite its source, checked word for word. If a single check fails, the report is not produced: Ekera says it cannot establish the answer and lists what is missing.
3. Nothing is written in your tools without validation
Ekera can propose changes in the customer’s tools: a ticket, an inventory update, a compliance proof. Each write is validated by a freshly authenticated person, and the platform recomputes what it is about to write instead of trusting the screen that asks for it. What is written is exactly what the person saw, once, and everything is logged. Nothing is ever deleted: a mistake is fixed by a compensating operation.
4. No inbound door on your network
To read tools installed inside the customer’s network, a small collector only makes outbound connections: it opens no port, only reads, and only contacts the machines the customer has authorised for each source. Passwords stay in the customer’s vault: neither Ekera nor the browser ever sees them.
The state of the art, and what Ekera adds
Separating the component that plans from the one that reads untrusted data was formalised by Google DeepMind researchers in 2025 (“Defeating Prompt Injections by Design”, known as CaMeL). Ekera applies this principle to a particularly demanding domain: the full map of an information system, made of thousands of strings from heterogeneous tools. Ekera adds writing by code rather than by the model, a duty to state what is missing, and systematic recomputation of figures by an independent engine. The ANSSI and NIST guidance on generative AI points the same way: do not trust a model’s output without control.
The method: measure, and don’t fool yourself
- Ten complete fictional companies, from a few dozen to a few thousand employees, across varied sectors (manufacturing, food, healthcare, transport, mutual insurance, hospitality, distribution, civil engineering). Each one comes with ground truth: the exact map, architecture flaws planted on purpose, and what only the CIO knows.
- A test bench that compares the map produced by Ekera with the truth, family by family, and counts critical errors.
- Held-out worlds: three companies are used only to measure, never to tune. No threshold, rule or instruction is chosen by looking at them, and automated tests check it. One of them is even kept outside the code repository by the evaluation role alone.
- Open models hosted in France: no customer data goes through a US model. Measurements can be replayed.
- An independent security review of every sensitive change, by a role that did not write the code.
Measured results
- Held-out worlds (independent evaluation, 20 October 2026): average bench score of 0.81 to 0.83 depending on the model, with no critical error on any of the three companies.
- Tuning worlds: 16 measurements out of 21 reach at least 80% with no critical error using an open model hosted in France; critical errors fell from 15 to 2 between two versions.
- Citations: every retained citation is exact, word for word.
- CIO interview: when the documents are fully read, a few well-chosen questions bring the expected annual loss, blast radius and NIS2 score exactly to the truth on the four companies measured; questions with no effect on the calculation are not asked.
- Security: over 1,100 automated tests, security checks on every change, and blocking findings of each review fixed before merging.
At least 30% of every subscription is set aside for research, quality and security: a budget shared by all customers that funds a test bench of hundreds of fictitious companies, then audits and penetration tests as the customer base grows (see details).
Ekera and cybersecurity firms
Ekera tests the accuracy of its own AI, secures its own code and will have its security checked by outside providers. It does not run penetration tests for its customers: it targets them, then monitors between two campaigns (see details).
Limits, and what comes next
- Reading the documents is still the weak link: some fictional companies with poor documentation are still read badly without a model.
- The query console has been designed and reviewed by security; it is under development.
- These results are on fictional companies. The decisive test is the first customers, and an external security audit is planned before the self-service offer.
Ekera’s own innovations, developed and tested by the team; detailed file available under non-disclosure agreement on request at contact@ekera.ai.
Sources
- Google DeepMind, “Defeating Prompt Injections by Design” (CaMeL), March 2025
- OWASP, “LLM01:2025 Prompt Injection”, Top 10 for LLM applications, 2025
- ANSSI, “Security recommendations for a generative AI system” (in French), 29 April 2024
- NIST, AI 600-1, “Generative Artificial Intelligence Profile”, July 2024