Research we actually runin production.

Five papers on the hard problems in AI-native managed services. Each one maps to a product we ship or a control we operate. No gated downloads, no prophetic marketing.

Request the PDFsSee the Academy instead
Black-and-white silhouettes of colleagues by a skyline window
Developer workstation with code on two monitors
papers
5
internal codebases audited
24
products the research backs
17

The papers

The Compliant AI Gateway

Multi-tenant LLM governance for regulated MSPs

Enterprise LLM spend reached $8.4B in 2025 and essentially none of it is governed at the MSP layer. This paper lays out the control plane a managed service provider needs to resell LLM access safely: per-tenant virtual keys and budgets, model routing, regional egress, prompt caching, audit logs, and PII redaction — with EU AI Act and HIPAA paths designed in from day one.

Key findings →
  • Cloudflare AI Gateway has no RBAC; Portkey sells enterprise-direct, not through the MSP channel.
  • Per-tenant spend visibility cut one client's LLM bill 38% in the first month.
  • PII redaction before the model call is the only pattern that survives a HIPAA audit.
  • A shared prompt cache across tenants is a data-leak primitive. Isolate by default.
Request the PDFRead the full page →

Synthetic Identity Risk

Avatar and voice agents, and the rise of consent-archived AI

Voice deepfake fraud rose 680% year over year in 2025. EU AI Act Article 50 watermarking became fully applicable on 2 August 2026; Tennessee's ELVIS Act and Texas's TRAIGA require consent ledgers with multi-year retention. This paper is a practical guide for any firm deploying voice or avatar agents: provenance, watermarking, consent capture and 7-year archival, and the vendor questions that matter.

Key findings →
  • Consent must be captured per voice, per use, and retained 7 years to satisfy ELVIS/TRAIGA.
  • Watermark every generated output; assume it will be screenshotted.
  • Voice-cloning vendors without a provenance API are an uninsurable risk in regulated verticals.
  • Internal voice agents need the same disclosure as external ones.
Request the PDFRead the full page →

Continuous Audit as a Service

Monthly multi-repo scans, objective-aligned

Point-in-time audits certify the past. This paper describes the pipeline we run across every shipped repository: automated security, quality, UX, accessibility, dependency, infrastructure-as-code, and competitive-intelligence scans, with findings persisted, classified against each project’s stated objectives, and reported — with humans gating every merge.

Key findings →
  • Monthly cadence catches dependency drift that annual pen tests structurally miss.
  • Objective-aligned classification cuts false-positive triage time substantially.
  • The same evidence feeds SOC 2 CC7 and CC8 controls automatically.
  • Running it on our own internal codebases first is the only way to trust it on a client’s.
Request the PDFRead the full page →

Vendor-Agnostic Building Intelligence

50-year-old controls meet modern AI

The building management market is locked behind controller vendors — WebCTRL, Niagara, Trane — each with its own data model and professional services moat. We show how an analytics layer can extract fault detection and optimization insight from any of them without rip-and-replace or field hardware.

Key findings →
  • Active faults routinely surface in week one that the incumbent BAS vendor never flagged.
  • HVAC energy reductions in the double digits are achievable with zero hardware spend.
  • LL97 compliance dashboards can be live on day one of a BAS overlay.
  • MSPs already own the network and identity layer in these buildings; BMS analytics is adjacent revenue.
Request the PDFRead the full page →

US AI Compliance for Regulated SMBs

NIST AI RMF, SEC, FINRA, HIPAA, NYDFS, FTC — the audit pack regulators and insurers actually want

For 50–300 person firms in finance, healthcare, legal, and insurance, AI obligations arrived faster than the guidance. This paper maps the current US landscape and gives a 90-day plan to ship an audit pack built on NIST AI RMF as the affirmative defense.

Key findings →
  • Substantial NIST AI RMF compliance is the affirmative defense under several state AI statutes; document it first.
  • Cyber-insurance renewals increasingly include at least one AI-governance question.
  • An AI inventory (tools, data touched, decisions influenced) is the one artifact every regulator asks for.
  • The 90-day pack: inventory, risk assessment, policy, human-oversight log, vendor attestations, incident procedure.
Request the PDFRead the full page →

The hard problems

Four claims. Each maps to something shipped.

01

RAG retrieves the wrong document a meaningful share of the time

And the model answers confidently anyway. Faithfulness, citation coverage, and semantic drift are the binding metrics; stale vector indexes fail silently. We ship citation-bound retrieval and freshness monitoring, with per-tenant index ownership.

02

Billions in enterprise LLM spend, none governed at the MSP layer

Multi-tenant gateways need per-client quotas, model routing, regional egress, audit logs, and PII redaction. We run our own AI Gateway on exactly this control plane.

03

AI compliance exposure is already enforceable

EU AI Act Article 50 has been in effect since 2 August 2026; several state statutes carry per-violation fines. Watermarking, provenance, and multi-year consent retention are mandatory in regulated verticals.

04

Most MSPs sell AI; few run on it

Our platform runs under the same systems we ship to clients: continuous audit, multi-tenant, single pane. That's the proof behind every paper above.

Want the PDFs?

Tell us which paper and we'll send it with the engineer who wrote it copied in.

Request papers