Khasm · Pitch Deck
Cybersecurity · AI RED-TEAMING
Khasmخصم
The adversary you choose, testing every AI system before a real one does.
neuriya.ai — Sovereign, Arabic-first enterprise AI
Problem
Every LLM copilot shipped this year has never been attacked on purpose
- Saudi banks, government agencies, and hospitals are shipping LLM-backed copilots, chatbots, and increasingly agentic assistants faster than any team can manually probe them for safety failures.
- Classic penetration testing checks web, API, mobile, and network surfaces — it was never built to test whether a chatbot can be talked into leaking another user's data or an agent can be talked into calling a tool it shouldn't.
- Prompt injection, jailbreaks, and tool-misuse are now a named, ranked risk category (OWASP's LLM Top 10), but most organizations have no running programme testing against it — only whatever the model vendor claims to have done.
- A single successful jailbreak or data-leakage incident on a regulated system is a compliance event, not just a bug report, and regulators are starting to ask what continuous testing looks like for AI systems specifically.
Solution
A findings register for AI systems, not another pen-test report
Product
Khasm in action
How it works
From first touch to outcome
Scope
Register the LLM apps, copilots, and agents in scope, along with their tool and data access.
Attack
Automated adversarial campaigns run continuously against each system, no engagement scheduling required.
Triage
Every successful bypass logged as a finding with its full transcript and severity.
Remediate & re-test
Findings route to owning teams with an SLA clock; a fix triggers an automatic re-test before closure.
Market
Sizing the opportunity
- TAM — $1.4B. Global AI/LLM security testing & red-teaming software market, GCC-weighted
- SAM — $180M. Saudi enterprise and public-sector AI red-teaming and AI-security-assessment spend
- SOM — $12M. 3-year obtainable share via design-partner LLM and agentic-AI deployments
SDAIA's national AI push and Vision 2030's government-service AI rollout are putting LLM copilots and agents into production across banking, healthcare, and government faster than manual review can keep pace, while NCA and SAMA are both extending existing controls frameworks toward AI-specific risk. OWASP's LLM Top 10 is fast becoming the reference auditors reach for, giving a testing platform built specifically around it a natural place in the same compliance conversation as SAMA's FEER programme.
Business model
How Khasm makes money
Per-system subscription
Priced by the number of LLM copilots, chatbots, and agentic assistants registered for continuous attack campaigns.
Findings-register seat license
Recurring per-seat pricing for security and AI product teams working findings in the register.
Onboarding & attack-library configuration fee
One-time fee to register a system's scope, tool access, and guardrails, and tune the attack library to it.
Revenue streams
Where the revenue actually comes from
Competition
Where we win
Our edge
- Purpose-built for agentic tool-misuse, not just bad text — testing whether an agent with real tool access can be coaxed into an unauthorized action, which generic prompt-injection scanners don't cover.
- Findings are reproducible transcripts by default, not a severity score alone, cutting remediation time the same way proof-of-concept evidence does in classical pen-testing.
- Sovereign hosting for attack transcripts and model outputs — an organization's most sensitive AI behavior data — as a default, not an add-on.
- Founding team combines hands-on offensive-security engineering with production LLM/agent-system experience, so the attack library reflects how these systems actually fail, not a generic OWASP checklist.
Traction
Early validation, built for pilot readiness
- Full platform experience designed and built end-to-end: attack-surface dashboard, campaign log, findings triage board, and per-finding transcript detail with remediation SLA tracking.
- Attack library and reporting pre-aligned to OWASP's LLM Top 10, with architecture scoped against SAMA FEER and NCA ECC-2 reporting patterns already proven in adjacent offensive-security work.
- Actively selecting design-partner teams running LLM copilots or agentic AI in production for a first pilot cohort.
Go-to-market
Land on one production LLM system, expand to the full AI estate
- 1Land with 2-3 design-partner teams, starting with one production LLM copilot or agent already live and carrying real user or tool access.
- 2Prove finding volume, time-to-fix, and re-test turnaround over a pilot campaign against that one system.
- 3Expand across an organization's full AI estate — additional copilots, chatbots, and agents — then into SAMA-regulated and NCA-regulated enterprise networks more broadly.
Team
Built by operators, not just builders
The ask
Raising a seed round to reach first design-partner AI red-teaming pilots
We're raising to fund the attack-library engineering for prompt-injection, jailbreak, and agentic tool-misuse testing, OWASP LLM Top 10-aligned reporting, and the core team through first-revenue pilot deployments.