AI security

We assess the AI features you build into your product and the AI tools your people use: what they can reach, what they can leak and who controls them.

Ask about this service All services

Who it is for

  • You have shipped, or are about to ship, a feature built on a large language model.
  • Your teams use AI assistants and you are not sure what data goes into them.
  • Customers have started asking about AI in their security questionnaires.

What you get

  • An inventory of the AI systems and tools in use, and the data each one touches
  • Test results for prompt injection, data leakage and unsafe tool use in your AI features
  • A review of who and what can reach your models, keys and data
  • An AI use policy and governance plan, if you do not have one

How it runs

  1. Inventory

    We find where AI is built, bought or used, and what data flows through it.

  2. Test

    We test your AI features against known attack patterns, including the OWASP Top 10 for LLM applications.

  3. Review

    We review access, logging, vendor terms and how changes to models and prompts are approved.

  4. Plan

    Findings, fixes and a governance plan, in priority order.

Typical length
Two to three weeks. Lengths are typical. We confirm them when we agree the scope.
What we need from you
A test version of your AI features, the prompts and integrations behind them, and someone who knows how they were built.

Frameworks it helps with

  • ISO/IEC 42001
  • NIST AI RMF
  • DPDP Act 2023

The findings give you a starting point for AI governance standards, and show where personal data reaches AI systems, which matters under the DPDP Act.

Tell us what you need, and we will suggest a scope.

Ask about this service