AI risk underwriting for institutions

Know the AI risk before you take it on.

AetherLab helps institutions evaluate, mitigate and underwrite AI risk. Turn technical findings into actionable evidence, apply controls where needed, and make better-informed risk decisions.

Request an AI risk assessmentLearn about the Evidence Pack
live verdicts →Non-Compliant· threat 0.94Compliant· threat 0.06
1 million+
AI checks per day
60 billion+
tokens screened monthly
Text + image
multimodal coverage
225+
custom policy rules per client
01The bottleneck

Institutions lack the infrastructure to effectively evaluate, mitigate and underwrite AI risk.

Every AI system that touches money, customers, or regulated content has to get past someone responsible for the risk: a merchant-risk team, an underwriter, a procurement review, or an audit. Those teams need to understand the risk, determine what can be mitigated, and decide what they are willing to take on.

3 majors
AIG, Great American, and W. R. Berkley have filed to exclude AI related liabilities from standard corporate policies, with new ISO exclusions for generative AI effective January 2026
Financial Times, 2025 ↗
Only 1 in 4
organizations report a fully implemented AI governance program
AuditBoard, 2025 ↗
Top barrier
regulatory compliance ranks among the top obstacles to scaling generative AI
Deloitte, 2024 ↗

The result is a queue: AI products waiting on payment approval, insurance coverage, procurement sign-off, or an audit, with no shared standard of evidence between the builder and the institution. AetherLab is the infrastructure that clears that queue.

02How it works

Scan. Guard. Prove.

One workflow from AI risk assessment to underwriting evidence. AdversarialScan identifies what breaks, Guardrails mitigate and control the risk, and Evidence Pack turns the findings into evidence institutions can use to make underwriting decisions.

Scan, Guard, Prove workflow01 · SCANAdversarialScanbreak it the way an adversary would02 · GUARDPromptGuard + MediaGuardcontain failures in production03 · PROVEEvidence Packassessment tied to business impactRISK TEAMdecisionApproveRemediateMonitorReject
03The platform

Three products. One underwriting workflow.

04The closed value loop

Turn AI risk into underwriting decisions.

Most AI security tools stop at a list of findings. AetherLab connects each finding to its economic impact, the protection that contains it, and the measured lift after deployment. Finance can read the loop, and so can risk.

Closed value loop01 · RISK ASSESSMENTwhat breaks, found first02 · BUSINESS IMPACTmeasured in business terms03 · MITIGATIONcontained in production04 · UNDERWRITINGEVIDENCEimprovement, measuredCLOSED VALUE LOOPFind it. Measure it. Control it. Prove it.

Risk assessment

Identify the failures and vulnerabilities that matter.

Business impact

Translate technical risk into exposure, consequence and severity.

Mitigation

Apply controls against the risks that can be addressed.

Underwriting evidence

Document the risk, mitigation and remaining exposure for the underwriting decision.

05Who it's for

Built for institutions taking on AI risk.

Payment ecosystems, insurers, enterprise procurement, AI builders facing enterprise reviews, and platforms with real content risk. Different seats, one shared need: evidence.

Something else?

If your team evaluates, deploys, or answers for AI systems, the same workflow applies. Tell us what you are reviewing.

Talk to us →
06Why AetherLab

Depth where it counts, and receipts.

Evidence built for risk decisions

Each finding connects technical risk, business impact and the controls that address it, giving underwriting teams evidence they can use in real risk decisions.

Image and multimodal red teaming, treated as first class

AdversarialScan tests what image models generate and what vision models understand, with the same rigor it brings to text and conversation. These are the failure modes that decide payment and platform approvals.

Your break-goals, not a generic checklist

Every engagement starts from the failures that would be a business problem for you, whatever they are. Findings come back severity-scored by exploitability and exposure, so your team fixes what matters first.

Bespoke policy at scale, on flat pricing

Customers run 225+ custom policy rules, and pricing stays flat at any count. Thorough policy should not be rationed.

A proprietary world-model attack engine

AdversarialScan is driven by an engine we built and keep building: it models the system under test and generates adaptive attack campaigns toward your break-goals. We do not publish the methodology. Adversaries read papers too.

Every verdict is explained

Each production check returns a threat score and a written rationale, where fast classifiers return a bare number. Your logs answer "why was this blocked" before anyone has to ask.

In the field

A top 10 high risk payment processor requires AetherLab Guardrails for designated AI merchants. Customers have chosen AetherLab over Amazon Bedrock Guardrails and Hive AI.

Operating record

  • ·Served production traffic every hour for the last 90 days
  • ·Customers configure 225+ custom policy rules
  • ·Every verdict ships with a threat score and a written rationale

Built by

  • Published adversarial-ML research (IEEE, 2019)
  • PhDs in physics, statistics, and computer science
  • Alumni of BCG, McKinsey, and Gemini
  • Production AI risk systems in payments and fintech
  • Advised by a former CISO of Twitter, CrowdStrike, and F5 and a former Lloyd's Syndicate 1200 active underwriter
07Robustness

Built to be hard to break.

Verdict infrastructure sits in the critical path of customer traffic. Ours is engineered for the bad day, not the demo.

A jury, not a judge

Each check is adjudicated by multiple models. No single model failure, provider outage, or bad response decides a verdict on its own.

Degrades in layers

Redundant components back each other up. When a dependency has a bad day, checks continue on the remaining layers instead of failing all at once.

Continuity, on the record

AetherLab has served production traffic every hour for the last 90 days. We state that as a measured record, not as an SLA.

Severity-graded, on any data

The question is never whether a system can break. It is how badly. Findings are severity-graded, and policies are enforceable on any data that flows through your product, AI-generated or not.

08For engineers

One policy surface, scalar and batch.

Guardrails are one pip install aetherlab away. Use check_prompt and check_media for scalar checks, or post simple items plus shared settings to the guardrail-specific batch routes for server-side bulk moderation and backfills.

Read the docsPyPIGitHub
prompt_batch.shREST · recommended
curl -sS -X POST \
  https://api.aetherlab.co/v1/guardrails/prompt/batches \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "items": [
      "historical text to screen",
      "a second prompt to review"
    ],
    "settings": {
      "blacklisted_keyword": "guaranteed returns",
      "reasoning_mode": "medium"
    }
  }'
09Research & Blog

Latest thinking on AI risk.

Personal AI agent interacting with a financial institution's digital systems, illustrating identity, authorisation, behavioural testing and operational risk.
PAYMENTSOct 14, 2026 · 14 min read

The Personal Agent Protocol Is Taking Shape. What Does It Mean for Financial AI Risk?

Sierra and Meta's Personal Agent Protocol is introducing a common framework for interactions between personal AI agents and businesses. With financial institutions participating in its development and an early mortgage-related demonstration, the initiative raises a critical question: how can institutions evaluate the behaviour of agents operating within legitimate permissions?

AetherLabRead →
View all articles →

Put evidence behind your next underwriting decision.

Tell us what you're evaluating. AetherLab will assess the AI risk, identify what can be mitigated, and provide evidence your risk team can act on.

Request an AI risk assessmentHow engagements work

Ask about the Evidence Pack

Leave your email and we'll walk you through what an Evidence Pack contains for your use case: severity-scored findings, business-impact mapping, and the approval record.