Secure your AI agents, LLMs and RAG.
The AI feature you shipped has a new attack surface — prompt injection, data leakage, agents with too much access. We red-team and harden the AI you run, so it passes the security review and holds up in production. We build these systems, so we know where they break.
Six layers we secure.
An AI feature inherits a new set of security boundaries around your existing product. We test every one of them — not just the model.
LLMs & prompts
The model boundary itself: jailbreaks, system-prompt leakage, insecure output handling, and the guardrails that are supposed to hold when a user gets creative.
RAG pipelines
Retrieval and vector stores tested for poisoning, context manipulation, data leakage, and whether tenant identity survives every retrieval and inference boundary.
AI agents & tool-use
The riskiest layer: agent identity, least-privilege authorisation, scoped credentials, tool allowlists, and a human checkpoint before any high-stakes action executes.
Data & PHI
Every pathway patient or customer data takes through the system — including third-party model APIs, tracing and logging tools that quietly capture it in traces.
AI supply chain
Model provenance, fine-tuning data, embeddings and third-party dependencies — the places a backdoored or tampered component enters without anyone noticing.
Cloud, secrets & identity
The infrastructure the AI runs on and reaches into: secrets handling, API permissions, MCP servers and the blast radius when one credential leaks.
Scope to secure, in five steps.
A fixed-scope assessment that ends in findings you can act on — and, if you want, the fixes implemented by the team that builds these systems.
A scoping call
We map what you've deployed — models, agents, retrieval, the systems they touch — and agree exactly what's in scope and what success looks like.
Attack-surface map
We trace data flow, trust boundaries and privilege boundaries across your real architecture, and build a threat model specific to it — not a checklist.
Adversarial testing
We construct attack paths that follow your application's actual execution: untrusted input → model context → agent decision → tool → business action.
Fix & harden
Findings graded by severity with a prioritised remediation plan — and, if you want, we implement the fixes, since we build these systems too.
Keep it secure
Runtime guardrails, eval regressions and continuous monitoring through Managed AI Operations, so security holds as prompts, tools and models change.
The ways AI systems actually break.
Derived from the OWASP LLM Top 10 and mapped to your architecture — the risks every AI deployment shares, tested adversarially.
Prompt injection — direct & indirect
Instructions hidden in a document, email or web page the AI reads, obeyed as commands. The highest-risk variant in healthcare: injection via clinical notes.
Sensitive-data disclosure
The model handing back secrets, internal details or another tenant's data — the mistake that has exposed whole chat histories and API keys.
RAG & embedding poisoning
Tampered or malicious content in the knowledge base that bends what the system retrieves and says, or exfiltrates data through the retrieval path.
Excessive agency & tool misuse
An agent with more access than its task needs, tricked into turning “summarise this ticket” into “export the customer table and email it out.”
System-prompt leakage
The hidden system prompt — rules, logic, sometimes keys — coaxed out of the model, handing an attacker the map to bypass every guardrail.
Insecure output handling
Model output piped straight into a browser, shell or database, turning a response that carries a script or query into a classic injection in your own app.
Model & supply-chain risk
Backdoored models, compromised dependencies and third-party integrations — reviewed for provenance and the risk they actually execute in production.
Cross-tenant isolation
Whether a user authenticated for one tenant can reach another's data once the request crosses an embedding, inference, agent-tool or downstream-API boundary.
Evidence your reviewers accept.
We test and document to the standards your customers and auditors ask about — and state what is actually in place, not what sounds good.
HIPAA-aware & SOC-2-path.
We test and build to the controls your review expects — HIPAA-aware for healthcare, SOC-2-path for SaaS — with data kept on your own infrastructure.
Audit trails on every agent action.
Input, tools called, data accessed, output — logged so you can replay exactly what an agent did and defend any decision a review challenges.
Mapped to the frameworks auditors cite.
Aligned with the OWASP LLM Top 10, NIST AI RMF, ISO 42001 and EU AI Act expectations — the standards your customers and auditors are now asking about.
You see the price before you commit.
The AI Security Assessment is from $12,000, fixed, over 2–4 weeks. Larger or multi-system scopes are quoted in writing before work starts.
AI Security Assessment
Threat-model and red-team the AI you ship — agents, LLMs and RAG pipelines — for prompt injection, data leakage, excessive agency and supply-chain risk, with a graded report and a remediation plan.
Ongoing protection
Runtime guardrails, monitoring and eval regressions through Managed AI Operations — so security holds as prompts, tools and models change.
What moves the price
Scope drives the cost of an AI security assessment far more than the vendor does. These are the factors a quote turns on, and the written quote names each one before work starts.
| Factor | Why it adds work | Effect on the quote |
|---|---|---|
| AI features and agents in scope | Each model boundary, agent and workflow is its own attack path to map and test. | The biggest driver. One feature sits at the entry price; several systems are quoted. |
| Tools and actions an agent can take | Every tool, API and write permission is a place excessive agency turns into a business action. | Read-only assistants cost less to test than agents that send, pay, delete or deploy. |
| Retrieval and data sources | Each knowledge base, vector store and connector is a poisoning and leakage path, and tenant isolation has to hold across all of them. | More sources and more tenants mean more test cases. |
| MCP servers and third-party integrations | Tool descriptions, servers and dependencies are supply-chain inputs the model trusts. | Each integration is reviewed for provenance and what it can execute. |
| Evidence your reviewer needs | A customer questionnaire, a HIPAA review or an auditor wants findings mapped to named controls. | Mapping to OWASP, NIST AI RMF or ISO 42001 expectations adds documentation, not new testing. |
| Implementing the fixes | We build these systems, so we can close what we find rather than hand it over. | Optional, and quoted separately from the assessment. |
What you get for it
A threat model of your real architecture, adversarial testing along the paths an attacker would take, and findings graded by severity with a prioritised remediation plan. If you want the fixes implemented, the team that builds these systems can do it, quoted separately. Before you sign with anyone, ask whether a retest of the fixes is included and what the report maps to: a list of prompts tried is not the same as findings your reviewer will accept.
What other firms publish
Most AI security vendors publish no price. These are the published figures we found, each read on the firm’s own page on 22 October 2026. Ranges are theirs; scopes differ, so compare what is tested, not the headline.
| Firm and offer | Published price | Scope as published |
|---|---|---|
| GigabitAI Security Assessment | From $12,000 · fixed | 2–4 weeks; threat model, red-team, graded findings and a remediation plan |
| HELXLLM penetration test | €4,250 fixed, excl. VAT | Five days of testing; chatbot, RAG, agents or integrations, scoped together |
| Bluefire RedteamAI / LLM security testing | $6,500–$15,000+ (their typical range) | AI-powered apps, RAG, API-connected AI workflows |
| Pentest Testing CorpAI pentest, Starter | $9,500+ | A single chatbot or assistant on a third-party model API |
| Pentest Testing CorpAI pentest, Professional | $15,000–$35,000 | Permission boundaries, agent abuse, indirect injection via retrieved content |
| Pentest Testing CorpAI pentest, Enterprise | $35,000–$75,000 | Advanced adversarial testing plus the infrastructure around the AI layer |
Pentest Testing Corp labels its tiers illustrative (article dated 28 June 2026). Bluefire’s figure is the typical range in its pricing table. HELX’s price excludes VAT and offers 15% off for small businesses and non-profits.
What the questionnaire asks, and what answers it.
Customers and auditors now send AI-specific security questionnaires, most of them built on the OWASP Top 10 for LLM Applications. Here is how the assessment maps to them, including the two rows it does not cover.
| The question | OWASP LLM Top 10 (2025) | How the assessment answers it |
|---|---|---|
| Can untrusted input or retrieved content change what the model does? | LLM01 Prompt Injection | Direct and indirect injection tested along the real path from input to tool call. |
| Can the AI reveal personal data, secrets or another customer's data? | LLM02 Sensitive Information Disclosure | Sensitive-data disclosure and cross-tenant isolation tests. |
| Where do your models, embeddings and AI dependencies come from? | LLM03 Supply Chain | Model and supply-chain review, including MCP servers and third-party integrations. |
| Could someone tamper with the data the AI learns from or retrieves? | LLM04 Data and Model Poisoning · LLM08 Vector and Embedding Weaknesses | RAG and embedding poisoning tests; tenant identity checked at every retrieval boundary. |
| Is model output validated before it reaches a browser, shell or database? | LLM05 Improper Output Handling | Insecure output handling tested in your own application. |
| What can the agent do without a human, and with whose permissions? | LLM06 Excessive Agency | Agent identity, least privilege, tool allowlists and approval before high-stakes actions. |
| Could the system prompt or hidden rules be extracted? | LLM07 System Prompt Leakage | System-prompt leakage tests. |
| How do you catch wrong or invented answers, and cap runaway usage? | LLM09 Misinformation · LLM10 Unbounded Consumption | Not in the standard test set. Answer quality is an evals question; if your questionnaire asks, we scope it in or tell you it is out. |
Agentic systems add questions on agent identity, delegated permissions and tool misuse, which the OWASP Top 10 for Agentic Applications groups separately; the agent tests above are where those answers come from. Source: OWASP Top 10 for LLM Applications 2025.
We are not a traditional pen-test shop bolting an AI checklist onto a network scan, and not an MSSP. We build production agents, RAG pipelines and LLM features — so we test them the way they actually break, and we fix what we find. Where identity verification or specialist tooling is the right answer, we integrate it and say so, rather than over-claiming.
From the field notes
AI agent security framework: the 3Cs and beyond
AI security review vs a pentest: what each one covers
HIPAA compliant AI: what it takes, which vendors sign a BAA, and what to check
When should an AI agent stop and ask a human?
The production AI agent stack: what we actually deploy
What to measure in an AI agent eval suite
Questions security and engineering teams ask
Written to be quoted by the assistants your buyers ask.
What is AI security?
AI security is the practice of protecting the AI systems you run — large language models, RAG pipelines and autonomous agents — from the ways they can be manipulated or leak data: prompt injection, sensitive-data disclosure, excessive agency, and model or supply-chain compromise. It covers both the AI-specific attack surface and the application, data and cloud layers the AI connects to.
How is AI penetration testing different from a traditional penetration test?
A traditional penetration test covers network, application and infrastructure vulnerabilities. It does not test the LLM-specific attack surface — prompt injection, jailbreaks, RAG poisoning, tool-use abuse or system-prompt leakage. AI security tests those adversarially, following the agent's real execution path from untrusted input through a tool call to a business action. Most teams shipping AI need both; we focus on the AI layer and the application around it.
What does an AI security assessment cover?
We map your AI attack surface, build a threat model for your specific architecture, then red-team it: direct and indirect prompt injection, data exfiltration, RAG and embedding poisoning, excessive agency and tool misuse, system-prompt leakage, insecure output handling, model supply-chain risk and cross-tenant isolation. You get findings graded by severity and a prioritised remediation plan.
How much does AI security cost?
The AI Security Assessment is a fixed price from $12,000 over 2–4 weeks; larger or multi-system scopes are quoted up front before work starts. Ongoing runtime protection — monitoring, guardrails and eval regressions — runs through Managed AI Operations from $3,000/mo. We name the number before you commit; there's no "contact us."
What does an AI security assessment cost elsewhere?
Published prices we checked on 22 Oct 2026 run from €4,250 for a five-day LLM penetration test (HELX) through $6,500–$15,000+ for AI and LLM security testing (Bluefire Redteam) to $9,500+ for a single chatbot and $15,000–$75,000 for RAG, agent and enterprise scopes (Pentest Testing Corp). Most firms publish no price at all. Compare on scope, not the headline: the number of AI features, the tools an agent can use and the evidence your reviewer needs move the price more than the vendor does.
How long does an AI security assessment take?
2–4 weeks. It runs in five steps: a scoping call, an attack-surface map and threat model, adversarial testing, then findings graded by severity with a prioritised remediation plan. The written quote fixes the scope and the timeline before work starts.
Will the assessment help us answer a customer's AI security questionnaire?
Yes, for the risks it tests. Findings are mapped to the OWASP Top 10 for LLM Applications, so you can answer questions on prompt injection, data disclosure, supply chain, poisoning, output handling, excessive agency and system-prompt leakage with evidence rather than assurances. Misinformation and unbounded consumption are not in the standard test set; if your questionnaire asks about them, we scope them in or tell you they are out.
Can you secure AI agents and RAG pipelines, not just a chatbot?
Yes — that is the core of it. Agentic systems are the hardest to secure because the model can choose tools and take multi-step actions. We test agent identity, least-privilege authorisation, scoped credentials, tool allowlists and high-risk-action approval, and we secure the retrieval layer against poisoning, context manipulation and cross-tenant leakage. Reasoning can decide an intended action; authorisation decides whether it can execute.
Is this HIPAA and SOC 2 compliant work?
We build and test to the controls your review expects — HIPAA-aware for healthcare, SOC-2-path for SaaS — with audit trails on every agent action and data kept on your infrastructure. We align with the OWASP LLM Top 10, NIST AI RMF, ISO 42001 and EU AI Act expectations, and sign the NDAs and, for regulated work, BAAs that your security review requires.
Find what's exposed before an attacker does.
Bring the AI feature, agent or pipeline you're putting in production. We'll red-team it, grade what we find, and hand you a plan to close it — at a fixed price, named up front.