Method & Reporting
Good AI penetration testing is mostly disciplined reconnaissance: find every place untrusted input gets in, find everything the model can do or send out, and connect the two. This page describes how an engagement runs, from the first scoping call to the regression tests you keep after we leave.
Scoping and Rules of Engagement
We agree in writing what is in scope: the application and model, whether the target can take actions, what data it reads, and what counts as a finding. We confirm whether harmful-content testing is in scope at all, arrange separate test accounts so cross-user impact can be proven, and agree on safe environments for consequential actions.
Attack-Surface Mapping
Before attacking anything, we build a complete picture: which model powers the feature, every input you control, every tool and data source the model can reach, every place its output goes, and the defenses in between. This map decides where the testing effort goes, and it is yours to keep.
Systematic Testing
We test the bug classes your map says are present, highest impact first: agency and tools, cross-user data, output handling, indirect manipulation, retrieval integrity, and data egress. Where defenses block a test, we characterize the defense and attempt measured bypasses so you know what protection it actually provides. We always retest, because model behavior is not deterministic and a single attempt proves nothing.
Automation and Coverage
Manual testing finds the first bug; automation proves coverage. We use established open-source tooling (garak, PyRIT, promptfoo) and a multi-model testing pattern that generates attacks, runs them, and scores outcomes, letting us measure resilience across thousands of variants.
Reporting and Follow-Through
Every finding is reproduced, captured with the exact inputs and evidence, and mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS so your teams can triage against shared standards. Fixes are layered and live in code rather than prompt wording. Every verified attack becomes a repeatable regression test you can wire into CI, so a fixed issue cannot quietly return.
Put Your AI Features to the Test
Contact us today to scope an AI penetration test. We will walk you through the realistic attack paths against your deployment and where untrusted input meets something that matters in your application.