Xabier Muruaga

I shape production AI and GenAI from value framing to deployable architecture, with security, assurance, and compliance readiness built in. The objective is simple: capture material value with controlled ownership, auditability, and unit economics.

In large organizations, GenAI stalls for predictable reasons. Fast prototypes do not survive scale when decision rights are unclear, controls fragment across teams, and accountability is reconstructed after the fact. Security and assurance then become reactive.

I make scale deliberate by defining the reference architecture, decision boundaries, and acceptance criteria teams must follow. Security and assurance are built into runtime and release gates, so controls and evidence do not have to be rebuilt on every release.

When systems are already live, I run security and assurance assessments for governance and audit sampling. This includes threat modeling and adversarial testing for GenAI misuse risks such as prompt injection, data leakage, and unsafe tool or permission boundaries.

The case studies reflect this lifecycle: value selection, architecture at scale, secure GenAI by design, independent assessment, compliance readiness, and governed agent autonomy.