AI Security
Adversarial testing for the systems that matter most
Our security teams probe models the way real adversaries do — before they can. From LLM and agentic AI security to model supply chains, we surface the failure modes others miss.
What this covers
Four security capabilities
Threat coverage
Mapped to the OWASP Top 10 for LLM Applications
The 2025 edition of the OWASP list is our baseline taxonomy for language model application testing, extended with MITRE ATLAS techniques for the wider AI attack surface.
- LLM01
- Prompt injection — direct, indirect, and multimodal. Instructions and data share one channel, so content the model reads can become content the model obeys.
- LLM02
- Sensitive information disclosure — training data, system context, and connected records surfacing through model output.
- LLM03
- Supply chain vulnerabilities — compromised weights, adapters, datasets, and the packaging around them.
- LLM04
- Data and model poisoning — manipulation of training, fine-tuning, or retrieval corpora to change behaviour on chosen inputs.
- LLM05
- Improper output handling — downstream systems treating model output as trusted input.
- LLM06
- Excessive agency — permissions, tools, and autonomy exceeding what the task requires.
- LLM07
- System prompt leakage — disclosure of instructions, and of the secrets teams put in them.
- LLM08
- Vector and embedding weaknesses — retrieval poisoning, cross-tenant leakage, and inversion of embedded content.
- LLM09
- Misinformation — confident, well-formed output that is wrong, and the operational reliance built on it.
- LLM10
- Unbounded consumption — cost, capacity, and denial-of-service exposure through unconstrained inference.
Agentic systems
When the model can act, a finding is no longer theoretical
An agent with tool access converts a prompt injection into a transaction, an email, a code commit, or a deleted record. We test the whole loop — planner, tools, memory, and the permissions that sit under all three.
- Tool and permission boundary testing
- Memory and context poisoning
- Multi-agent trust assumptions
- Sandbox and code execution escape
- Human-in-the-loop bypass
- Blast-radius and rollback analysis
Engagement model
How a security engagement is run
-
Rules of engagement
Written authorisation, scope boundaries, data handling terms, escalation contacts, and a defined stop condition — agreed before the first request is sent.
-
Reconnaissance and modelling
We map the actual attack surface: interfaces, tools, retrieval sources, trust boundaries, and the humans who can be persuaded.
-
Adversarial execution
Manual and automated testing against defined objectives. We chase impact, not volume — one demonstrated path to consequence outranks fifty low-severity observations.
-
Impact validation
Every finding is reproduced and its business consequence established, so remediation is prioritised by what it prevents.
-
Report and retest
Findings with reproduction steps, evidence, and severity. Retesting confirms fixes actually hold rather than merely being deployed.
Related capabilities
Find it before someone else does.
Commission an adversarial assessment of your highest-exposure AI system.