Wardkey is an offensive security firm. We find the vulnerabilities in AI products and multi-tenant SaaS that automated scanners and checklist audits miss, and we help engineering teams close them before a customer, an auditor or an attacker finds them first. Our work covers three areas. AI applications and agents. LLM-powered features, retrieval pipelines, autonomous agents and MCP integrations. We assess how untrusted input can steer a model into real actions, how data can cross tenant boundaries through retrieval and memory, and whether an agent's permissions match the user it acts for. Voice AI. Phone agents that book, change or disclose information on a caller's behalf. We test them over real calls: caller verification, access to recordings and transcripts, tool authorization and abuse of telephony features. Multi-tenant SaaS. Authorization and tenant isolation in modern stacks such as Next.js, Supabase and Firebase, including row-level security, roles, SSO and integrations. These are the controls enterprise buyers and SOC 2 auditors ask about first. Every engagement is led by a certified tester. Findings are reproduced and evidenced, remediation is delivered as pull requests your engineers review, and every fix is independently retested. Reports map to OWASP, MITRE ATLAS, SOC 2 and ISO 27001 and close with a signed attestation letter you can share with your customers. Wardkey is a brand of Meridal Group LLC.