Company
Products. Engineering. Accountable AI.
BMI2 develops TestPulse, Fiduciary, and A&R, with AIM supporting the management and monitoring of AI applications. Alongside product development, we offer contract engineering for AI systems, software testing, platform automation, and vulnerability scanning and remediation automation.
What we do
Our founder spent two decades in system integration, automation and site reliability engineering — and now AI engineering — before and through starting BMI2. The pattern he kept running into was the same one in every environment: tools that flag problems confidently, and no way to check whether the confidence was earned. Every product here is a response to that.
Products
Evidence-gated AI
Software we build, licence and support. Each one refuses to reach a conclusion the underlying evidence doesn't support.
- TestPulse — 802.1X, RADIUS, EAP-TLS and TACACS+ root-cause diagnosis from real packet capture. Free download.
- Fiduciary — an air-gapped AI coworker for capital-investment operations, with scoped permissions and human countersignature. Private preview.
- A&R — governed AI for music-industry Artists & Repertoire and artist development: intake, vendor coordination, session-invoice reconciliation, release readiness, rights and clearance. Suggests-only; every scheduling, payment and clearance decision remains a human's. Design partners only.
Services · scanning and remediation
Scanning and remediation automation
We run Qualys vulnerability scans against your estate and automate the fixes, rather than handing you a PDF of findings and leaving.
- Qualys vulnerability scanning, scheduling and triage
- Remediation automation with Ansible, Terraform and the Redfish API
- Scan evidence and remediation records packaged for your auditor, QSA or ASV process
- Baseline hardening for PCI DSS and NIST 800-171 control families we can actually verify
Contract engineering
Contract engineering with Tarik Riley
Engage Tarik for domain-specific AI architecture, AI-assisted SDLC pipelines, evaluation and test automation, governance controls, observability, and infrastructure integration.
What we don't do
Security buyers get told yes to everything. Here is the list of things we will say no to, so you can rule us out fast instead of slowly.
We are not a managed security provider
No SOC, no 24/7 monitoring service, no incident response retainer, no threat hunting. Engineering monitoring capabilities into applications is distinct from providing a managed monitoring service.
We do not certify PCI DSS compliance
We are not a QSA and not a PCI-approved scanning vendor. We run Qualys scans and produce the remediation evidence your assessor asks for. The attestation comes from your QSA, not from us.
We do not offer HIPAA or SOC 2 audit services
Our automation work can supply technical evidence toward those programmes. It is not an audit, and we won't describe it as one.
We do not do penetration testing
Vulnerability scanning and penetration testing are different disciplines with different qualifications. We do the first.
We are a small team
Support on the free TestPulse Pro is one person reading email. Enterprise engagements get a written SLA; the free edition does not, and we won't imply otherwise.
Why the products look the way they do
Twenty years of remediating other people's findings produces a strong opinion: a finding is worth very little without the evidence that produced it and a record of who signed off. That belief is why TestPulse won't return a verdict without a captured frame to back it, why it grades itself against faults it can't see the answer to, and why Fiduciary and A&R stop at the signature line instead of executing on their own judgement.
It's also why this page has a boundaries section. The same standard has to apply to how we describe ourselves.
Talk to us
Contract engineering, product questions, a scanning engagement, or a preview of Fiduciary — same inbox, and it reaches a person who works on the thing you're asking about.
Monday to Friday · 09:00–17:00 Central