- AI that searches internal documents
- When you need to verify that the retrieval and use of RAG-connected documents respects user permissions.
- Agents that carry out business tasks
- When introducing or extending AI capabilities that call APIs or change data.
- Chatbots that process external inputs
- When you need to test whether instructions in user messages or uploaded documents bypass the AI’s security restrictions.
AI security assessment
We assess the potential for information leaks and misuse of permissions when AI is introduced and operated,
and recommend improvements aligned with personal data processing and internal security requirements.
What we assess
Reports and remediation recommendations
- Threat scenarios and assessment scope
- We document threat scenarios and assessment scope based on the model, RAG and agent architecture.
- Evidence of inputs, responses and tool calls
- We organise records from attack inputs through to responses and tool execution to provide the basis for our findings.
- Repetition conditions and improvements
- We document the model, settings, number of repetitions, observations and assessment limitations, and recommend improvements to permission, data and tool controls.
Detailed assessment scope
OWASP AITG guides our review of the connections and permissions across models, RAG and agents.
- Direct and indirect prompt injection
- We examine how user inputs, as well as external documents and content read by AI, may be interpreted as instructions.
- Information disclosure and permission separation
- Using test data, we check whether documents, internal information or system prompts are exposed without authorisation.
- Tool calls and repeated testing
- We check whether tool execution exceeds user permissions or the permitted scope. We repeat the same scenarios and record response differences and the conditions for success and failure.
Indirect prompt injection test scenario
This example assumes an AI system with internal document search and business API calling capabilities. We test each stage, from external input to execution results.
- 01 / INPUT
External document
We examine how the AI handles malicious instructions embedded in retrieved documents.
- 02 / OBSERVE
Responses and tool calls
We check whether the AI uses material it is not authorised to access in its answers or calls APIs outside the permitted scope.
- 03 / RECORD
Repetition conditions and evaluation
We record the model, settings, inputs, number of repetitions and response differences, then evaluate the results against predefined criteria.
- 04 / RETEST
Remediation and retesting
After document access permissions and tool execution controls have been improved, we retest under the agreed conditions.
Items recorded in the report
Input and document identifiers / Model and settings / Responses and tool calls / Number of repetitions / Evaluation evidence / Recommendations
Project information
- Preparation
- We review the AI’s purpose, the connections between the model, RAG and tools, user roles and test accounts. Test data is prepared instead of real customer information.
- Scope, schedule and quotation
- We prepare a proposal after discussing the functions, data and tools in scope, the number of tests and the cost limit.
- Execution controls
- We test within the authorised environment and scope. Permissions for data changes, external transfers and paid tool calls, as well as stopping criteria, are agreed in advance.
- Results briefing
- We review records from inputs through to answers and tool execution with the developers responsible and discuss where controls should be applied.
- Retesting
- We agree on the remediation items, schedule and repetition conditions. If the model or settings change, we first establish the conditions under which results can be compared with earlier findings.