Service 03

AI Security Assessment

You have LLMs and agents in production. Your existing security program was not built to test them — a web application scanner cannot find prompt injection, and a SAST tool cannot tell you an agent has more authority than its task requires. We assess AI systems against the attack surface they actually have, and hand you a graded report with the control gaps named.

Start the Conversation

The Problem

Your Existing Security Tooling Cannot See This Attack Surface

An LLM application fails in ways traditional testing does not model. Instructions arrive inside data, so a document, a web page, or a support ticket can redirect the model that reads it. A RAG pipeline will happily retrieve and repeat content the requesting user was never authorized to see. An agent given a broad API token does exactly what it was permitted to do, in an order nobody anticipated.

We characterize the system first — trust boundaries, data flows, what the model can reach, and what it is authorized to do without a human present — then threat-model it against the OWASP LLM Top 10 and MITRE ATLAS before running a single test. The assessment targets your architecture, not a generic checklist.

OWASP LLM Top 10 and ML Top 10 threat coverage

ATLAS Threat-modeled against MITRE's adversarial ML matrix

Graded A-F score with every control gap named and ranked

The Assessment

Eleven Test Classes, Run Against Your Live System

We run a full red-team battery: direct and indirect prompt injection, training and retrieval data poisoning, insecure output handling, supply-chain exposure, excessive agency, system-prompt leakage, bias, hallucination under pressure, guardrail bypass, rate limiting, and access control. Each test runs against your deployed endpoint, with findings reproduced and evidenced rather than asserted.

We also review the control surface around the model, which is where most real risk sits: guardrail placement, gateway rate limiting, data handling boundaries, and whether a human is genuinely in the loop on consequential actions or merely nominally so. A model with weak guardrails and a narrow blast radius often outranks a well-tuned model wired directly to production.

11 classes Injection, poisoning, agency, leakage, bypass, and more

Reproduced Every finding evidenced with a working reproduction

Live or design Run against a deployed endpoint or as a design review

Governance

Mapped to the Frameworks Your Board Is Already Asking About

A list of vulnerabilities is not a governance answer. Every finding maps to NIST AI RMF functions, an EU AI Act risk tier, and the relevant ISO 42001 controls — so the same assessment answers your security team's question and the one coming from legal and your board.

You receive an A-F grade with the reasoning shown, a prioritized control-gap list with remediation options and their tradeoffs, and reproductions for each confirmed finding. Where a fix involves a real cost or capability tradeoff, we present the options and leave the decision with you rather than burying it in a recommendation.

NIST AI RMF Findings mapped to Govern, Map, Measure, and Manage

EU AI Act Risk tier assessed against the obligations that follow

ISO 42001 Control gaps named against the AI management standard

Shipping AI you have not adversarially tested?

Tell us what you have deployed. We will tell you how we would attack it.

Talk to the Team