The practice
AI and LLM assessments, application and cloud testing, and red-team readiness — delivered by operators who finish the chain. We do not sell a platform.
Pressure-test the model and its product surface. Direct and indirect prompt injection, multi-turn and encoded jailbreaks, system-prompt extraction, guardrail bypass, PII and tenant regurgitation, model extraction attempts, and resource / denial-of-wallet abuse.
Typical duration: 2–3 weeks for a single production assistant. Longer where tools, RAG, or multiple models are in scope.
Agents that can call tools are privileged users. We test function-calling, MCP servers, plugins, browser and code interpreters, multi-agent orchestration, goal hijacking, and excessive agency. Aligned to the OWASP Top 10 for Agentic Applications.
Includes replayable tool-call transcripts showing how a prompt becomes a side effect.
Treat every retrieved chunk as attacker-controlled. Indirect injection via documents, email, tickets and web pages; corpus and embedding poisoning; connector over-permission; cross-tenant retrieval; and context-window smuggling.
The AI feature never lives alone. We test the surrounding web and API estate: authentication, object-level authorisation, business logic, output handling, and the places model text is executed, stored, or rendered. Classic OWASP risk chained with LLM failure modes.
GPU clusters, model registries, vector databases, inference gateways, secrets, isolation patterns, and trust boundaries. For organisations whose AI stack sits on AWS, Azure, GCP, or private GPU estates.
Fine-tune and training-data poisoning, CI/CD gate tampering, model provenance, dependency risk, insecure-by-design infrastructure, and secrets left in notebooks, weights, and prompt stores.
Multistep adversary emulation against the AI pipeline. OSINT, spear-phishing of DevOps and MLOps, cloud pivots to model artefacts, data exfiltration, and extortion scenarios. Purple-team variants work live with your detection staff. Tabletop drills expose runbook gaps for AI incidents.
A structured review of how the system is designed and governed: model and tool deployment, data flows, human-in-the-loop, acceptable use, vendor risk, and control coverage against NIST AI RMF, ISO/IEC 42001, and the EU AI Act evidence you will be asked for.
AI estates change weekly. A named operator retains scope over your assistants and agents, retesting after releases, and keeping an attack library current. Equivalent intent to a continuous testing programme — sized for a house, not a factory.
Where source is available we read it. System prompts, tool schemas, retrieval filters, output parsers, and the glue that turns a completion into an action. Source access shortens time-to-finding and raises confidence.
How engagements are sized
One assistant or agent. OWASP LLM baseline, injection sweep, and a written verdict on whether you can ship. For launches and diligence.
Full-stack assessment: model, RAG or tools, application, and cloud perimeter. Exploit-validated findings and a retest window.
AI red team plus purple team. Lifecycle and human layers in scope. Board brief and detection-gap register.
