AI Penetration Testing
Adversarial testing for LLM- and ML-driven products.
- Outcome
- Red-team your models before an adversary does.
- Timeline
- 4 phases1 week · 3–5 weeks · 1–2 weeks · 1 week
- Mapped to
- OWASPMITRE · NIST · ISO/IEC
- Includes
- Readout + retestFixed criticals and highs re-verified.
Know before you book.
We attack your AI features the way a real adversary would: tricking the model, poisoning what it reads, and abusing the tools it can use.
- You've shipped, or are about to ship, an LLM feature, chatbot or agent
- Your AI reads documents, emails or web pages you don't control
- Your agent can call tools, APIs or take actions on a user's behalf
- A customer or regulator is asking how you've tested AI risk
- You need an AI management system you can be certified againstISO/IEC 42001 Readiness
- Your concern is the surrounding web app, not the model behaviourWeb Application Pen Testing
- Access to the AI feature in a test environment
- The system prompt, tools and data sources it uses
- What the model must never do or reveal
Still not sure? Take the 2-minute check
What you walk away with.
- Reproducible jailbreak + injection payloads, each with a detection rule
- OWASP LLM Top 10 + MITRE ATLAS coverage report
- Agent tool-use blast-radius analysis with a mitigation playbook
- ISO 42001 evidence artifacts your internal audit can use directly
What we cover
Agreed in writing before testing starts.
- LLM-facing endpoints (chat, RAG, agent orchestrators, tool-use loops)
- Prompt injection — direct and indirect (via tools, documents, browsing)
- Jailbreak & policy-bypass against deployed guardrails
- Data exfiltration via outputs, side channels, timing
- Model supply chain — weights integrity, dataset-poisoning risk, dependency review
- Autonomous-agent risk — unauthorized action, chained tool abuse, self-modification
- Reverse-engineering closed-weight foundation models
- Adversarial training / model-poisoning at scale (research engagement, separate)
How we run it.
- 01
Reconnaissance / threat modeling
Data-flow map, trust boundaries, prompt provenance. What can enter the model? What can leave?
- 02
Enumeration
Every guardrail, tool, and integration in the deployed path, catalogued.
- 03
Vulnerability Analysis
Systematic evaluation of each guardrail against ATLAS-mapped tactics; candidate bypasses identified.
- 04
Exploitation
Direct + indirect prompt injection, RAG poisoning, tool-manipulation loops. Reproducible payloads, not one-off screenshots.
- 05
Post-exploitation / blast-radius
For agentic systems: enumerate every tool, quantify what a coerced agent could actually do, measure containment.
- 06
Report + evidence
Findings + reproduction harness + detection rules + ISO 42001 evidence pack.
Technical detail.
The depth behind the engagement, for the engineer or CISO evaluating us.
- Direct and indirect prompt injection
- Data and system-prompt exfiltration
- Excessive agency and unsafe tool use
- OWASP Top 10 for LLM Applications
- MITRE ATLAS techniques
- NIST AI RMF mapping
- Garak and PyRIT for breadth
- In-house harness for multi-turn attacks
- Manual adversarial chains for depth
- Reproducible attack transcripts
- Guardrail and architecture fixes
- Evidence that feeds ISO 42001 controls
What lands in your inbox.
- AI Red-Team Report (technical + executive + reproduction harness)
- Payload library — reproducible test cases for your CI regression suite
- Guardrail-gap analysis mapped to OWASP LLM Top 10 + MITRE ATLAS
- Detection rules for your SIEM / observability stack
- ISO 42001 audit-evidence pack
Defensible under audit.
- OWASP
- MITRE
- NIST
- ISO/IEC
From call to report.
- 01Threat modeling
1 week
- 02Adversarial testing
3–5 weeks
- 03Report + payload delivery
1–2 weeks
- 04Retest after mitigation
1 week
Asked before every engagement.
Do you support open-weight models we host ourselves?
Yes. We test the deployed inference path, guardrails, and orchestration — the model provenance is irrelevant to the attack surface.
Can this satisfy ISO 42001 audit requirements?
The evidence pack is built to feed ISO 42001 AI-system-lifecycle and impact-assessment controls directly. It's designed to be handed to your auditor as third-party assurance.
How is agent testing different from LLM testing?
Agents multiply blast radius by tool count. A prompt injection that's a curiosity in a plain chatbot becomes an unauthorized transaction in a banking agent. We test the whole loop, not just the prompt.
Often paired with.
Ship AI features with confidence.
Scoping call, engagement letter within a week, kickoff within two. Report and payload library delivered end-to-end.