AI red and purple team agents. On-premises, air-gapped, and auditable.
Dr Andrea Tassi · Founder · An independent, founder-led venture.
Defence, intelligence, critical infrastructure and regulated operators need exactly this capability, yet cannot send their source, specifications or attack surface to a third-party cloud.
The capability exists. The trust envelope to deliver it on their terms does not.
Nova closes that gap: the same capability, on the client’s terms.
Delivered as a bespoke engagement on a fixed, inspectable pipeline: Nova deploys a red and purple team agent system inside the client’s own environment, grounds every finding in the client’s own specifications, manuals or documented code, and hands each finding to a cleared human to sign. Purple agents reproduce red’s leads by running their test cases in a sandbox with no network. No specification corpus is required. Given a published advisory, it answers the question a client actually asks: is our code affected? It reads Python, Go and Rust today, with C and C++ in progress.
Fully on-premises and air-gappable. No client source, spec, finding or model weight ever leaves the environment.
Offline by construction: nothing calls out. The only traffic permitted is to the authorised target ranges, and licences are verified locally.
Client-chosen open-weight models behind one uniform endpoint. None is enabled without a passing, measured behavioural passport.
The authorisation boundary lives in the sandbox, policy and tooling, not a prompt. Humans approve every agent and sign every finding.
A single finding traced from source to signed release, and the four gates that can stop it. Scroll to follow it through the pipeline.
A specification, manual or the code’s own documented intent defines expected behaviour; the implementation is diffed against it.
Every chunk carries its release or source revision, clause and content hash, so a reviewer can resolve the citation in their own checkout.
The operator declines the drafted agent; it never runs.
Source-to-sink paths come from the code property graph, queried, not guessed by the model.
Denied by the policy gate and logged; the sealed agent has no network to reach anything else.
The citation does not support the claim, or the graph finds a guard; the finding is withheld with its reason and never reaches a reviewer.
The reviewer, never the engagement’s operator, declines; the finding is not released.
Built from small, inspectable engines. The boundary holds independently of the model, whatever it has been told and however it has been tuned.
Each agent runs in a gVisor sandbox with no network interface, a read-only root and dropped privileges. Its only channel to the host is a size-limited broker pipe.
Every tool call is checked against declarative, version-controlled policy: target within authorised IP ranges, code within authorised paths, tool per persona, time window and clearance. If the policy engine fails, agents halt.
Every tool sits behind one gateway, uniform across agents and personas. Denied calls fail closed, and every decision is written to a hash-chained, tamper-evident audit log.
Outbound traffic is allow-listed to the authorised target ranges by IP, with no DNS resolution. Nothing else leaves the environment.
An adversarial scope-escape suite of 27 probes (out-of-scope and adjacent addresses, loopback and cloud-metadata pivots, DNS names, IPv6, path traversal, privilege escalation, prompt injection, escapes from sandboxed test code, a licence check that phones home, and a failed policy engine) runs in CI and at install as a release-blocking gate.
Nova never claims a model is “clean”, a claim nobody can prove. It proves what it can measure: each model is scored on the exact serving stack it will run on, a modified model is compared with its own unmodified baseline, and no model is enabled without a passing passport.
Every delta carries a 95% confidence interval. Deploy only when the client’s go / no-go thresholds are met.
* Illustrative example only.
Nova drafts; people decide. Every step leaves evidence a client, auditor or regulator can check.
Nova aims each agent at specific code: where a published advisory points, an entry point where untrusted input reaches a sensitive operation, or the directories an operator chooses, grounded in the requirement that governs it.
No drafted agent runs until an operator has inspected its objective, tools, budget and citations, and approved it.
Whoever runs an engagement cannot sign off its findings. Sign-off is a cryptographic signature over the finding’s content.
Each finding cites the exact clause and release, and the exact code line and source revision, so an independent reviewer can check it.
SARIF 2.1, STIX 2.1, NIST OSCAL, ECS for SIEM, CSV and a readable report, with ISO/IEC 27001, NIST SP 800-53 and UK MoD Def Stan profiles.
At the end of an engagement, working keys are destroyed and working data with them. The signed audit trail and deliverables are kept.
Runs entirely on client-owned hardware and their on-prem GPUs.
Docker or Podman Compose, rootless Podman Quadlets, or Kubernetes, all generated from one topology.
A full TUI over SSH, like a modern coding agent, with no heavy console.
Signed licences verified locally, with seats bound to named people. An expired licence never locks you out of your own data.
A dependency-minimal core and open-weight models; no proprietary black box the client cannot audit.
Deploy, resize and retire model pools on the client’s cluster from the terminal, or attach an OpenAI-compatible engine the client already runs inside the enclave.
Organisations that are simultaneously high-value targets and forbidden from cloud security tooling.
Classified systems that cannot touch a third-party cloud.
Energy, transport and industrial control operators.
Specification-heavy stacks where findings map to exact 3GPP clauses.
Proprietary code under strict data-residency regimes.
Sensitive data with hard sovereignty requirements.
Autonomous testing platforms do valuable work at cloud scale. Nova is built for the environments they are not allowed into.
Design, integration and tuning of the pipeline to the client’s stack, knowledge base and clearance model.
Time-limited licensing of the whole platform on the client’s own hardware, verified locally, with seats bound to named people.
Updates delivered offline, new-model onboarding and passports, and continued red and purple team operation.
Optional: hand-curated knowledge bases for the highest-value targets. Every engagement is authorised, scoped in writing and enforced by the platform itself.
Former Chief Engineer at Samsung Research UK and an IEEE Senior Member, bringing hands-on command of the spec-driven, high-assurance systems Nova is built to test.
Loading the booking calendar. If it does not appear, open cal.com/agentnovauk/30min.
Engagements are scoped directly with the founder, under authorisation, on your hardware.