Assessments
AI System Testing
AI red teaming and LLM security testing guided by the OWASP LLM Top 10, prompt injection and jailbreaks, prompt and data leakage, AI-endpoint access control, and agent and tool-use abuse across RAG and agentic systems.
Scope
- Prompt injection and jailbreaks via direct and indirect (retrieved or tool) inputs
- Prompt and data leakage: system prompt, context, and RAG or training source exposure
- Access control on AI endpoints: authentication, authorisation and tenant isolation
- Agent and tool-use abuse: unsafe actions, excessive permissions, pivots into backend systems
- Output handling: insecure rendering, downstream injection, unsafe code or command execution
Method
Manual adversarial testing of the AI system as deployed, the model, its prompts, retrieval pipeline and the tools and APIs it can reach, guided by the OWASP LLM Top 10. We test with agreed accounts against agreed environments and never trigger destructive actions or runaway cost without explicit sign-off.
Deliverable
A written report with reproducible findings (exact prompts, inputs and affected endpoints), rated by real impact, with guardrail, architecture and configuration changes your engineers can apply directly. A retest of fixed findings is included when agreed in scope.
Approach
How we work
01
Scope
Every engagement starts with a scoping conversation and ends that conversation with a written agreement: your target framework or the systems and environments in scope, what is explicitly out, which accounts and data we will use, and the timeline.
02
Assess
We measure where you stand: a gap assessment against your target framework, a review of controls, policies and risk, and hands-on testing where it matters. The work is manual and methodical, guided by how the system is actually used and what an attacker would actually want from it. Tooling supports the work; it does not replace it.
03
Explain
You receive a written report and a walkthrough call. The executive summary is written for people who were not in the room; each finding carries evidence, reproduction steps, business impact and a concrete fix.
04
Verify
When your team has remediated, we retest the affected findings and issue an updated report stating clearly what is resolved, what is partially resolved and what remains open. For a certification programme, we prepare the evidence and stand beside you through the audit, then help you keep it current.
Frequently asked questions
- What kinds of AI systems do you test?
- LLM-powered features, chatbots, RAG pipelines and agentic, tool-using systems, the model, its prompts, retrieval layer and the tools and APIs it can reach.
- Which framework do you follow?
- Testing is guided by the OWASP LLM Top 10, prompt injection and jailbreaks, prompt and data leakage, access control on AI endpoints, and agent and tool-use abuse.
- Can testing break our model or run up costs?
- No. We test with agreed accounts against agreed environments and never trigger destructive actions or runaway cost without explicit sign-off.
Related reading
Other assessments
Engagements are fixed-scope and fixed-price once agreed. If you are not sure which service fits, whether that is certification readiness, GRC advisory or a penetration test, describe your situation and we will recommend a scope, including telling you honestly if you do not need us yet.