AI / RAG security assessment
Security assessment for AI, RAG, and agents
We test how an AI system handles instructions, private data, retrieval, tools, and actions in realistic misuse scenarios.
Prompt-injection and model testing is tied to application controls: authorization, data isolation, output handling, logging, and confirmation of sensitive actions.
01 / Coverage
What we test
We confirm boundaries and critical journeys before testing so the work reflects your business risk.
Instructions and prompt injection
Direct and indirect instructions, system-rule priority, external content, and guardrail bypass.
RAG and data access
Retrieval authorization, tenant isolation, sensitive chunks, indexing, citations, and data provenance.
Tools and agency
Tool authority, action confirmation, server-side checks, call chains, and unsafe trust in model output.
Application and operations
APIs, sessions, secrets, browser or downstream rendering, limits, logging, and incident response.
02 / Method
An assessment you can defend to engineers and auditors
We combine manual investigation, tooling, and evidence control. A specialist validates every reported finding.
- 01
Model the threats
Record assets, roles, knowledge sources, tools, trust boundaries, and the actions with the highest plausible impact.
- 02
Design safe scenarios
Define testable misuse cases and success criteria without destructive payloads or bulk data extraction.
- 03
Test the full chain
Observe the model, retrieval, orchestration, APIs, and server controls; repeat variants where behavior is nondeterministic.
- 04
Reduce risk and retest
Separate immediate guardrails from structural fixes, then rerun the agreed scenarios.
03 / Outputs
Material built for decisions and remediation
The report explains risk to leaders and gives engineers reproducible steps without scanner noise.
PENTEST.RED / AI / 06
AI system threat model
Assets, roles, instruction sources, trust boundaries, tools, and paths to impact.
Tested scenario register
Preconditions, safe steps, observed result, confidence, and reproducibility constraints.
Control improvement plan
Changes to authorization, retrieval, output handling, tool permissions, approvals, logging, and monitoring.
Executive brief and retest
Prioritized risks, product-owner decisions, and the result of validation after remediation.
04 / Buyer fit
When this assessment is a good fit
The right format follows the decision you need to make and the test environment you can provide.
RAG or AI assistant before launch
Test data boundaries, retrieval, tools, and model actions before exposing the system to real users.
Enterprise copilot using private data
Assess tenant separation, source permissions, answer leakage, and trust in externally supplied content.
Agent with tools and automation
Test which actions the model can initiate, which need confirmation, and where server-side authorization must hold.
05 / Boundaries
What is in scope — and what needs separate approval
Before testing, we record authorized systems, roles, environments, and constraints. Untested areas remain explicit in the report.
Usually included
- Agreed models, system instructions, RAG sources, roles, connectors, tools, and observable interfaces.
- Prompt injection, data separation, retrieval authorization, unsafe output handling, excessive agency, and resource abuse.
- A threat model, safe test scenarios, observation log, control recommendations, and a focused retest.
Requires separate agreement
- A guarantee against hallucinations or every unwanted response; conclusions are bounded to the tested scenarios and constraints.
- Training data, model weights, provider supply chain, and SaaS internal controls without agreed access.
- Autonomous destructive actions, bulk data extraction, and load testing without specific written authorization.
06 / Engagement estimate
What shapes scope and pricing
We estimate after scoping. These factors drive effort; we do not quote a fixed figure without understanding the environment.
AI architecture
The number of models, RAG indexes, sources, tenants, agents, tools, and external connectors.
System authority
Read and write access, action execution, financial operations, and required human approval points.
Roles and scenarios
User types, data sensitivity, languages, channels, and prioritized misuse cases.
Observability and change
Access to traces and logs, response reproducibility, provider limits, and the rate of prompt or model changes.
07 / Evidence and planning
Prepare the scope and inspect the output
Use the open scope planner, synthetic report example, and relevant research before speaking with a provider.
Example pentest report
A synthetic example shows the executive summary, a safe finding description, remediation plan, and retest acceptance criteria.
View examplePentest scope planner
Build a draft brief in your browser covering assets, access, purpose, and the evidence you expect.
Prepare scopeRED JOURNALWhat a useful pentest report contains
A good report helps different teams make a decision, reproduce the issue, fix its cause, and confirm that the risk has actually been addressed.
Read articleRED JOURNALContinuous pentesting and point-in-time audits: how they work together
A practical look at what a scheduled assessment reveals, why changes need recurring checks, and where manual security work remains essential.
Read articleIs this a normal application pentest?
Partly. We test web and API controls, then add threat modeling and scenarios specific to RAG, prompt injection, tools, and nondeterministic behavior.
Can you guarantee protection from every prompt injection?
No. The assessment validates agreed scenarios and helps contain impact. Resilience depends on server-side authorization, least privilege, action approval, and observability rather than a single system prompt.
Do you need access to prompts and logs?
They improve diagnosis but are not always required. We agree available interfaces, traces, model versions, and provider constraints before testing.
How do you retest nondeterministic output?
We define acceptance criteria in advance, repeat an agreed scenario set, and verify actual access to data and actions as well as the text response.
Next step
Get a scoped assessment plan
Tell us about the system, timing, and reason for testing. We will clarify scope and recommend an engagement with no obligation.