AI & LLM application pentest
Adversarial testing of chatbots, copilots and agents built on large language models, mapped to the OWASP Top 10 for LLM Applications and NIST AI RMF.
- Typical length
- 5–10 testing days
- Approach
- Grey box with prompt and tool access
- Price
- Quoted after scoping
What we test
- Direct and indirect prompt injection
- System prompt and training-data leakage
- Excessive agency in tools and plugins
- Insecure output handling
- Jailbreaks and guardrail bypass
Standards we follow
- OWASP Top 10 for LLM Applications
- NIST AI Risk Management Framework
- MITRE ATLAS
- CVSS 3.1 scoring
Issues we often find
Typical findings from this kind of test, written the way they appear in our reports.
- A crafted message makes the assistant reveal its system prompt
- Instructions hidden in a document make the agent take actions
- The assistant returns another user's data from its context
- Model output is rendered as HTML and runs scripts in the browser
What we need from you
We send this checklist at kickoff so testing starts on day one.
- Access to the chatbot, copilot or agent as a normal user
- A list of the tools, plugins and data sources it can reach
- The system prompt, if you want a white-box review
- Examples of content it must never reveal or produce
How the engagement runs
Scope
We agree on targets, test accounts, rules of engagement and testing windows. You get a fixed quote.
Recon
We map your attack surface: hosts, routes, roles, third-party services and data flows.
Exploit
Testers chain weaknesses the way a real attacker would and confirm impact without harming production.
Report
Findings are rated with CVSS 3.1, with proof, business impact and a clear fix for each one.
Retest
Once you have fixed an issue, we verify it and update its status in the report.
Attest
We issue a signed letter of attestation you can share with customers and auditors.
Get a fixed quote
Tell us what is in scope and we send a fixed quote, usually within one business day.