Login AI
AI security audit
We test the AI system for prompt injection, data leaks through tools, and excessive rights; the result is a prioritized list of findings with concrete fixes.
We check that the agent stays within its rights and resists an injection.
Pricing
from ₽500,000
per project
This is the lower bound of a project. We scope the exact quote after a brief: it depends on volume and the number of integrations.
Capabilities
Prompt injection
We test whether a document or a user can steer the agent off task and make it do something extra.
Tool rights
The agent must not reach what its task does not need: we check the rights scope and the accounts.
Leaks through output
We check whether the model returns other users' data or reveals the system prompt.
Prioritized report
Findings with a risk rating and a concrete fix, not a generic "consider improving" list.
From request to result
1
Perimeter review
We map the agent, tools, sources, and data: what it reads, what it writes, and what it can reach.
2
Threat model
We fix attack scenarios: injection through a document, a leak through a tool, privilege escalation.
3
Tests
We run the scenarios on the staging rig and in production by agreement, and record reproducible findings.
4
Report and fixes
We deliver prioritized findings and verify the fixes with a repeat run.
Check if it fits you
Good fit
The agent uses tools
The more actions the agent can take, the more the rights boundary matters.
External sources in context
Documents and web pages in the prompt are the main injection channel.
Not a fit
A chat with no actions
If the bot only answers with text and calls no tools, the risk is lower and a deep audit is unnecessary.
No logs
Without tracing and logs the attack path cannot be reconstructed, so we add observability first.
What you get
3
critical findings closed before release
After the audit we closed the agent's access to extra tools and added incoming-document checks.
What the delivery includes
A perimeter map
A perimeter map shows the tools, sources, and data the agent can reach. Excess rights are flagged separately so they stay visible.
A threat model
Attack scenarios are written so the team can reproduce them. A threat model makes the risks clear through concrete steps.
Reproducible findings
Each finding carries reproduction steps, a risk rating, and a concrete fix. Reproducible findings rest on a repeatable scenario.
A prioritized fix plan
A fix plan splits findings by priority: what to close before release and what can wait without risk. The order of work is visible to the team ahead of time.
A summary for management
A short summary shows how many findings there are and which are critical. Management sees the scope without reading the full report.
A repeat run
A repeat run after the fixes confirms the closed findings stopped reproducing. What is left is recorded as a separate list.
Checks before kickoff
Prompt injection through data
A malicious instruction hides in a document, an email, or a form field and tries to make the agent take an extra action. We pass such data through the agent and see whether it steps outside its task.
Rights boundaries
The agent reaches only the data and tools its task needs, even when more is technically available. We check that excess rights cannot reach another tenant's data or trigger irreversible actions.
Leaks between users
A user's answer carries only their own data, with no fragments available to another role or tenant. We test isolation from different accounts and roles.
System prompt disclosure
System instructions and internal rules stay inside and do not reach the answer. We separately test attempts to pull the prompt out through rephrased questions.
How the system is built
Reproducing a finding
We run each scenario as a test: set the input, the expected extra behavior, and the actual result. A finding enters the report once we can reproduce it again on demand.
Risk assessment
For a reproduced finding we estimate the risk: which data opens up, which actions become possible, and whether the attacker must be inside the perimeter.
Fix priority
We rank fixes by priority: what to close before release, what can wait for the next sprint. Each item carries a concrete fix, and the team sees the order up front.
Verifying the fix
After the fixes we verify the fix with a repeat run and confirm the finding now stays closed. What remains goes into a separate list with a rating.
Where the solution pushes back
- 01
Guarantees are bounded
New attack scenarios appear all the time, so an audit gives a snapshot at the test date. Guarantees are bounded, and the test is repeated after major changes.
- 02
Tracing for reproduction
Without tracing some findings can only be described in words. Tracing gives reproduction: we turn on logs first, then hunt the cause.
- 03
Production by agreement
The full run happens on staging, while production tests are sampled and run by agreement. That keeps production under your team's control.
- 04
AI-layer audit is separate
An AI-layer audit checks injections, rights, and leaks, while an infrastructure pentest is a separate job. Teams often order them together.
When to call an audit
When to call an audit
Before releasing an agent that reaches internal data or tools.
After a major change: a new tool, a model swap, a rewritten system prompt.
After an incident: the agent took an extra action or returned another tenant's data.
Before a security review or a regulator request that needs a documented result.
Technologies
The technologies we use in our work and their role in a project.
Loop and observability
Tests rely on Langfuse tracing, rights in Keycloak, Kubernetes configuration, and logs in PostgreSQL.
Cost calculator
This is an indicative range, not a quote. We scope the exact estimate after a brief: it depends on volume and the number of integrations.
AI systems
Review depth
Compliance package
Retest
Service
AI security audit
The estimate covers our team's work. Hardware, third-party service licences and travel are added on request.
Estimated cost
₽740,000
Timeline
3 wk
Frequently asked questions
Do you break production?
Production tests run only by agreement and on separate accounts. The bulk happens on the staging rig.
Is this a pentest?
This is an audit of the AI layer itself: injections, tool rights, and leaks, not a general infrastructure pentest.
What is in the report?
Reproducible scenarios, a risk rating, a concrete fix, and the result of a repeat run.
How often should it be repeated?
After major changes to the agent, prompts, or the tool set.
Do you need the source code?
No, most tests only need access to the agent, its tools, and the logs. Code matters only where we check input filters and validation.
What if there are no findings?
Then the report records the scenarios and boundaries that held. That is a result too: you show it at a review and to an external auditor.
What teams add to this service
Ready to discuss your task?
Leave a request – we'll get back with a proposal and a preliminary estimate.
Contact us