Retainer capacity is full until mid-2027.Fixed-scope projects available on request.
AI Application & Agent Pentesting
Your AI answers questions, and increasingly it takes actions.
We test what an attacker can make it do.
- OWASP AI Testing Guide (AITG-APP)
- EU AI Act mapping
- fixed price after scoping
- from €2,900
This assessment can be booked on its own, or scheduled for you inside the Retained Security Partner retainer at the point where it adds the most.
The Challenge
Why an AI application needs its own test
Your customers ask
Buyers whose data your AI touches ask what testing it has had. One report answers every questionnaire.
security questionnaires · vendor due diligence
Your ISMS ISMS Your information security management system: the policies, risk decisions, evidence and review cycles that keep security running as a managed process rather than a one-off project. already says so
ISO 27001 asks you to test the systems in your scope, and so does NIS2 where it applies. An AI application handling customer data is one of them.
ISO 27001 A.8.8 / A.8.29 · NIS2 Art. 21(2)(e)
The attack is a sentence
An attacker steers the AI with plain text in a chat, a document or an email it reads. Testing for it takes AI-specific cases, which a web pentest scope rarely includes.
EU AI Act Where the EU AI Act sits What the AI Act requires depends on your role and the use case, so we map findings to the obligations that apply to yours. DORA adds threat-led testing duties for some financial entities. · mapped where it applies
One family of attack: injection
Four ways untrusted text reaches the model, the one place it all arrives, and what it costs.
Text the application does not control
User prompt
Direct prompt injection
Retrieved documents
Indirect injection in documents
Tool and API responses
Injection through hijacked tool output
Sub-agent messages
Injection carried between agents
All of it arrives here
One context window
Every source read with the same trust
The attacker's instruction runs
- Another customer's records returned The retrieval boundary fails
- A refund issued, a record changed A tool runs for the wrong person
- An internal API reached from outside Model output executed downstream
A sentence inside a document your customer uploaded is read with the same weight as an instruction from you. That is why each entry point has to be tested where it joins the flow.
Scope
What's in scope
What your AI can do decides which of these apply. We confirm that during scoping.
Data exposure
Cross-customer and cross-session retrieval, and what it gives away about its own prompts, policies and tools.
Poisoned content
Planted documents or agent memory surviving into a later session with a different user.
Privilege escalation
Whether an ordinary user can reach an action meant for an administrator. If your AI can act.
Transaction abuse
Refunds, record changes, outbound messages: who can trigger a tool call, and with what arguments. If your AI can act.
Internal access
Model output reaching an internal API, a database query or a shell in a form that gets executed. If your AI can act.
Cross-agent escalation
A delegated action exceeding the permissions of the agent that asked for it. If agents delegate.
Application layer. The guide's infrastructure, data-pipeline and model categories sit outside this assessment. Model-layer work on a model you trained yourself belongs with a specialist ML security team.
Pricing
Indicative pricing
Assistant
Text in, text out, no tools. We test what it discloses, what it renders and whose documents it can reach.
Agent
It calls tools, functions or an MCP server. We test the tool layer as well, where the most serious findings usually are.
What affects the final price
Tools and integrations
Every tool the AI can call is a separate attack path. More than twelve tools moves the test above the standard price.
Tenancy and data
A knowledge base holding per-customer data needs an account in each of two tenants, and doubles the retrieval testing.
Lead Time saves money
Booking at least three weeks ahead lowers the quote. Urgent engagements carry a premium.
Get started
Scope a test
For regular testing on a monthly fee, see the Retained Security Partner retainer.