AI & LLM Application Testing

Penetration testing for AI-enabled applications

Manual penetration testing for AI chatbots, assistants, RAG systems and agents. We test prompt injection, data exposure, agent permissions, and the application and API around the model.
Get a Quote Book a Scoping Call

Accreditations and memberships

CREST member company, accredited for penetration testing CREST-accredited penetration testing Cyber Essentials certified UK Cyber Security Council member

AI Security Testing

What AI and LLM application testing covers

AI features introduce attack paths that conventional application testing may not fully cover. Prompt injection can influence model behaviour, retrieval systems can expose information across access boundaries, and agents can misuse connected tools if permissions are not enforced correctly.

We test how these risks affect your application in practice, alongside the conventional web application and API vulnerabilities that could expose or amplify them.

AI-enabled systems we test

  • Chatbots & assistants
  • Retrieval (RAG) systems
  • Agents with tool & API access
  • AI features inside products

Why test AI features?

Input validation and access control patterns built for conventional software don't map neatly onto model behaviour. An application can look secure at the application layer while the model can still be steered into leaking data or taking actions it shouldn't.

Who Needs This

Who needs AI and LLM application testing?

Any organisation that has put a language model in front of users, data or other systems.
Get an AI Application Test

Teams shipping AI features to customers

Chatbots, assistants and generative features are exposed to every user, including those who will try to misuse them. Testing before launch finds weaknesses while they are cheap to fix.

Organisations connecting a model to data or tools

Retrieval systems and agents link the model to documents, databases and actions. Each connection adds a way for an attacker to reach data or trigger actions through the model.

Suppliers asked about AI in customer reviews

If a buyer asks how your AI features have been tested, a penetration test report and an attestation letter answer it. See penetration testing for customer security reviews.

Scope & Coverage

AI pentest scope

Scope depends on how your AI feature is built, and we confirm it during scoping. We test against the OWASP Top 10 for LLM Applications and MITRE ATLAS, and use the OWASP WSTG and ASVS for the application and API around the model.

  • Prompt injection and jailbreaks

    Direct and indirect prompt injection, attempts to bypass guardrails, and exposure of system prompts and hidden instructions.

  • Data leakage and retrieval access control

    Whether users can reach other users' data or documents through the model, including through retrieval systems that answer from company data.

  • Agent and tool abuse

    What the model can call or do on a user's behalf, and whether those actions can be abused to reach data or systems.

  • The surrounding application and API

    Conventional testing of the product around the model. See our web application and API penetration testing services.

  • What is not included

    Model training and training data poisoning, model extraction and theft, the model provider's own infrastructure, and bias or output safety evaluation. We test your application and how it uses the model.

Our Methodology

How we test AI-enabled applications

Testing starts from what the AI feature can see and do, then works outwards to how an attacker could misuse it.
01

Scoping & Rules of Engagement

We agree the AI features, models, data sources and tools in scope, the test accounts we need and the testing boundaries. If your model provider has a usage policy that applies to adversarial testing, tell us and we will reflect it in the rules of engagement.
02

Mapping the AI attack surface

We work out what the model receives, what it can retrieve, what it can call, and where it trusts content it shouldn't, so testing follows the real paths through your system.
03

Testing the model interface

Manual attempts to inject instructions, bypass guardrails and extract hidden prompts or data, using direct input and content the model retrieves.
04

Testing retrieval and tools

We test access controls on retrieved data and on tool calls, and look for ways to make the model act beyond what the user is allowed to do.
05

Testing the application and API

Conventional web application and API testing of the product around the model, including authentication, authorisation and business logic.
06

Reporting & Debrief

Findings are documented with reproduction steps, severity scoring and remediation guidance, with an executive summary alongside the technical detail, followed by a debrief call. Focused retesting of remediated findings is included.

Pricing

Flexible scope. Fixed-price proposal.

AI security testing can be added to a conventional web application pentest, or can be a standalone, AI-focused assessment. Tell us the following in your quote request and we'll reply within one business day to confirm the scope.

  • The application or API

    What it is, how many user roles it has and whether it is already due for testing.

  • The AI features

    Which features use a model, what data and tools they can reach, and whether the model is hosted by you or a provider.

  • Your context

    Any customer review, compliance driver or launch date behind the testing.

Common Questions

AI and LLM application testing: frequently asked questions

The cost depends on the scope of the assessment. AI security testing can be added to a web application or API penetration test, or scoped as a standalone assessment where appropriate. The number of AI features, the data and tools they can access, and the surrounding application determine the effort required.

We confirm the scope before providing a fixed-price proposal. See our penetration testing pricing guide for prices across our other services.

No. Our testing is manual and consultant-led, and we don't pass your data, findings or testing artefacts into third-party AI systems at any stage.

Our AI policy explains how we address each of the CREST principles for AI-enabled activities, and our article on AI penetration testing risks covers the questions to ask any provider.

We test your AI-enabled application: how the model is used, what it is connected to and what an attacker can make it do. We don't cover model training and training data poisoning, model extraction and theft, the model provider's own infrastructure, or bias and output safety evaluation.

We test against the OWASP Top 10 for LLM Applications and MITRE ATLAS, and use the OWASP Web Security Testing Guide and Application Security Verification Standard for the web application and API around the model.

Model providers publish usage policies, and some restrict adversarial testing. Check yours and tell us during scoping, and we will reflect the relevant terms in the rules of engagement.

In most cases, yes. We prefer to test a staging environment with synthetic data, and where production has to be in scope we agree rules of engagement in advance that set out excluded functionality and what happens if real data is encountered.

Yes. Focused retesting of remediated findings is included, as it is for our web application and API testing, and we confirm the arrangements in your proposal.

You can request a quote using the form on our quote page. Describe the application or API, the AI features and the data and tools they can reach, and your preferred timing.

We reply within one business day to confirm your scope, then send a fixed-price written proposal.

Ready to scope your AI application test?

Tell us what your AI features do and what they can reach, and we'll agree a scope and a fixed price.
Get a Quote