How MAIA uses the GObugfree platform for audits

At a glance

• MAIA has its AI platform externally tested for vulnerabilities at least twice a year.
• The GObugfree platform captures the full history of each finding, from validation and assessment through to remediation.
• For audits, MAIA can directly demonstrate which findings were identified, how they were assessed and how the company handled them. maia-reviewed-updated

Mathias, what exactly does MAIA do?

MAIA is, put simply, a GenAI solution for enterprise knowledge and AI adoption. So far, our main focus has been on mechanical engineering and MedTech. These industries work with large volumes of complex technical information: product data, formulas, figures, relationships and a great deal of knowledge that has been documented over the years or remains in employees’ heads.

We make this knowledge accessible and usable. Various data sources can be integrated, and individual agents can also be built. What matters to us is high answer quality and traceable results. maia-reviewed-updated

Why is security particularly important for you?

Our customers work with highly sensitive information. Product information, product development, technical know-how and intellectual property can, for example, be particularly attractive targets for industrial espionage.

Because we offer a cloud solution, trust in the secure handling of this data is essential, especially for industrial companies. External security tests are therefore simply part of what we do. We carry out pentests at least twice a year. maia-reviewed-updated

How did you use the GObugfree Bugtest?

GObugfree assessed our platform as part of a five-day Bugtest. After the test, we received the findings together with the corresponding evidence and could work through them directly in the platform.

The external security test helps us meet certain requirements while also giving us an independent assessment of the security of our platform.

What additional value does the GObugfree platform provide?

The platform gives us the full history: what was found and when, how the finding was demonstrated, how we assessed it and what we did about it.

That is particularly valuable for our ISO process. During an audit, we can open the platform and directly show which findings were identified and how we handled them. The entries have timestamps, and the findings have been validated by GObugfree.

For an audit, we therefore have the evidence directly in the platform without having to gather the information separately

How do you handle findings?

We do not automatically adopt the initial classification of a finding one-to-one. A CVSS score does not always fully reflect the actual relevance to our specific environment. We therefore assess findings internally as well, based on likelihood and potential impact.

We can document this assessment directly in the platform, along with the decision to remediate a finding or consciously choose not to implement a change. That keeps the reasoning behind each decision traceable.

What did the latest test find?

No critical vulnerabilities were identified, and there was nothing that required an immediate hotfix. There were several medium-level findings, which we subsequently reviewed and addressed.

For us, that is a good result: a security test needs to uncover relevant vulnerabilities. Volume is not a measure of quality. maia-reviewed-updated

How is AI changing security testing from your perspective?

This is something we think about a lot because we work extensively with AI and agentic coding ourselves and see how rapidly AI is accelerating software development.

AI is also shaping the other side of security testing. We regularly receive emails with supposed security findings that appear to have been generated by AI. Some of them look very credible at first glance even though there is no genuinely relevant finding behind them. So far, however, the effort involved remains manageable for us. We can validate such reports quickly using an agent.

What did you like about working with GObugfree?

From the kick-off onwards, it was clear what GObugfree needed from us and what we would receive in the end. After that, the team worked independently, carried out the test thoroughly and explained the results well. That made the collaboration very straightforward and stress-free for us.

Would you recommend GObugfree to other companies?

Yes. The collaboration was professional, reliable and straightforward. With a security test, it is valuable to know exactly what you will receive and to be able to rely on it being delivered properly.