Penetration Testing
Manual, objective-driven testing of web applications, APIs, and networks (internal, external, wireless, and physical), built on hands-on consulting experience since 2018, not a scanner with a report template.
Service 01
AI & agentic security assessments
Language models turned every prompt into an untrusted input and every tool call into a privilege boundary. We test AI systems the way an attacker would: by finding the gap between what the model was asked to do and what it can actually be made to do.
Overview
The problem we are solving
Most AI security reviews stop at the model. That is the least interesting part of the attack surface. The real risk lives in the system around it: the retrieval layer that ingests attacker-controlled documents, the tool definitions that let an agent touch production, the session boundaries that leak one tenant's context into another's answer.
We assess the whole pipeline. That means reading your orchestration code and system prompts, mapping every path untrusted text can take into the context window, and then attacking those paths with the same persistence we bring to a network engagement. Findings come with working reproduction steps, not a list of prompts that sometimes misbehave.
Engagements are scoped to your architecture rather than a generic checklist, and they are grounded in the public bodies of work that matter here: the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework.
Coverage
What we test
Scope is agreed up front; these are the areas an engagement typically covers.
- LLM applications & chat interfaces
- Direct and indirect prompt injection, system prompt extraction, jailbreak chains, output handling flaws that turn model text into XSS or command execution downstream.
- RAG pipelines & vector stores
- Poisoned document ingestion, retrieval scope violations, cross-tenant leakage through shared embeddings, and metadata filters that fail open.
- Agentic systems & tool use
- Tool-call abuse, confused-deputy chains, privilege escalation through over-broad function schemas, and loops that let an agent authorize its own next action.
- Model APIs & inference endpoints
- Authentication and tenancy boundaries, rate and cost abuse, unsafe streaming behavior, and side channels that reveal upstream configuration.
- Training & fine-tuning pipelines
- Data supply-chain review, poisoning and backdoor exposure, secrets and PII memorized into weights, and artifact integrity from dataset to deployed checkpoint.
- Guardrails & moderation layers
- Bypass testing against classifiers, filters, and policy prompts, including encoding tricks, multi-turn setup, and delegation through a second model.
- AI-assisted internal tooling
- Copilots and assistants wired into source control, ticketing, or customer data, where an injected instruction reaches systems the user never intended to touch.
Methodology
How the engagement runs
-
01
Scoping & threat modeling
We start with your architecture, not a template. Together we map trust boundaries, identify where untrusted content enters the context window, and agree on what a successful attack would actually look like for your business.
-
02
Architecture & code review
Orchestration logic, system prompts, tool schemas, and retrieval configuration get read directly. Most high-severity findings are visible in the wiring before a single prompt is sent.
-
03
Adversarial testing
Manual, iterative attack work against every identified path (injection, extraction, tool abuse, tenancy violations), with automation used to broaden coverage rather than to replace judgment.
-
04
Exploitation & chaining
Individually minor issues get combined into the realistic worst case. A low-severity retrieval quirk plus a permissive tool schema is frequently a critical finding.
-
05
Reporting & debrief
Every finding ships with severity, business impact, reproduction steps, and concrete remediation guidance. We walk your engineers through it live and stay available while fixes are in flight.
-
06
Validation handoff
Every finding ships with the exact steps to confirm the fix, so your team can verify remediation on its own and close the loop without booking a separate engagement.
Deliverables
What you receive
- Technical findings report with severity ratings, business impact, and step-by-step reproduction
- Executive summary written for a non-technical audience
- Threat model of your AI pipeline, including trust boundaries and data flow
- Prioritized remediation roadmap sequenced by risk and effort
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Live debrief with your engineering team
Aligned to
- OWASP Top 10 for LLM Applications
- MITRE ATLAS
- NIST AI Risk Management Framework
- OWASP Machine Learning Security Top 10
Questions
Frequently asked
Do you need access to our model weights?
No. Most engagements are grey-box against a deployed system plus read access to orchestration code and configuration. If you train or fine-tune your own models we can extend scope to the pipeline and artifacts, but it is not a prerequisite.
We use a third-party model provider. Is there anything to test?
Yes, and usually more than teams expect. The provider secures the model; everything you built around it (retrieval, tools, session handling, output rendering, authorization) is yours, and that is where nearly all exploitable findings live.
How long does an assessment take?
A focused assessment of a single LLM application typically runs one to two weeks of testing. Agentic systems with many tools, or platforms with several integrated surfaces, run longer. Scope and duration are agreed in writing before any work starts.
Will testing affect our production environment?
We prefer a staging environment that mirrors production. When production testing is necessary, we agree on rules of engagement, rate limits, and a direct escalation channel first, and we work inside those limits.
Related
Often scoped together
AI-Assisted Penetration Testing
Agentic AI accelerates reconnaissance, enumeration, and evidence correlation across an engagement, run through isolated infrastructure: Amazon Bedrock in a dedicated environment, or a private model on in-house bare metal when nothing can leave the building.
Get started
Ready to scope ai & agentic security?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 ryan.zagrodnik@infocus-security.com