Google Cloud Next 2024 put artificial intelligence and public sector security in the same conversation. Agencies came to Las Vegas to hear how models could help them work faster. The harder question followed them home: who decides what those systems are allowed to do?
Bendings, a cybersecurity firm founded in 2013, has built its business around that question. The company works with banks, asset managers and government agencies in the United States and the Gulf Cooperation Council states. It runs continuous red and blue team testing inside scopes each client approves.
The company is deliberately private. It works by referral and does not publish client names. A client that hires Bendings does not become a case study.
Bendings says its current tools include Bendings Gauge, the firm’s AI model, and Bendings Frame, its operating system. Frame places cameras, access control and sensors in the same picture as a client’s networks. Gauge runs on Frame.
The firm’s research arm, Scopertos, publishes findings on intrusion patterns and testing methods.
The model does not have unrestricted authority, according to the company. A Bendings operator approves risky steps before they happen. A named person on the client’s side can halt Gauge at any time. Every action is logged, and the client receives the complete log. Bendings says a client’s data is never used to train the model.
Those controls are the point. For agencies considering AI for security work, the question is not only whether a model can find a problem. It is who can authorize an action, who can stop it and what evidence remains afterward.
Bendings’ testers work under contracts that specify what they may touch. The firm’s approach to AI follows the same logic. Gauge can run continuously, but only inside boundaries a client has approved. It does not expand its own authority because a test has been running for a long time. A person still decides whether a risky step should proceed.
The firm is equally deliberate about the information it sees. Client data is not used to train Gauge, according to the company. The client receives the complete log of what the model did.
Bendings does not publish client names, and its claims about Gauge have not been independently verified. The company says its approach is designed to keep human judgment in the loop.
For agencies and financial institutions weighing AI in security operations, those questions are older than the technology: who approved this, who can stop it, and what record will exist when it is done.
Those are the controls Bendings says it uses.
