Both. A secure model in an insecure application is still a risk, and vice versa. We assess the model’s behaviour, the application logic, the data pipelines, any connected tools or agents, and the supporting infrastructure, giving you a complete picture.