Customer records
Can a support chatbot show one user another customer’s record or an internal document? Validate data flows and access permissions with evidence.
AI SECURITY / 8 TEST MODULES
AI REDTEAM.
Your AI assistant has data and authority. Validate its trust boundaries in practice.
CYBER-BRO assesses how misuse of a chatbot, LLM application, RAG knowledge base or tool-connected agent affects your business. Business owners receive risk priorities; engineers receive verifiable evidence and actionable remediation tasks.
BUSINESS DECISION
Turn AI risk into an actionable task.
Assess the effect on the real business workflow, not just an unusual response. Scope follows the actual functions and permissions of your system.
Actions for the company
Can an agent modify CRM data, send email or refund a payment? Establish the authority and approval required for significant actions.
Cost and availability
Can one request extend an agent loop or increase API spend? Findings lead to limits, budget alerts and safe-stop requirements.
ASSESSMENT SCOPE
From the model to the business workflow.
Foundation or fine-tuned LLMs, customer chatbots and internal copilots; RAG indexes and document sources; agent tools for APIs, CRM, email and files; authentication, application, cloud and integrations. Review access, data flows and trust in external content at each layer.
8 DISTINCT MODULES
What we assess and how we help you fix it.
Coverage goes beyond a jailbreak checklist. Each module connects practical risk, a defensive control and a business outcome. A layer absent from your environment is not marked as assessed.
Prompt Injection
- Assessment
- Test direct user input and indirect instructions carried by documents, web content or tool output. Trace trust boundaries from retrieved RAG content to the agent’s subsequent action.
- Technical remediation
- Recommend separation of external content and instructions, source access checks, server-side tool argument validation and explicit operation allowlists.
- Business outcome
- Establish whether customer-supplied text can cause an unauthorised action in the company’s name.
Jailbreaks & guardrail bypass
- Assessment
- Evaluate multi-turn conversations, role changes and context shifts that pressure the model beyond its safety controls. Compare permitted and prohibited responses in Uzbek, Russian and English business scenarios.
- Technical remediation
- Recommend guardrail policy adjustments, independent checks and regression tests. Record false refusals of legitimate customer requests separately.
- Business outcome
- Assess whether the assistant makes inappropriate commitments or bypasses company policy.
Sensitive information disclosure
- Assessment
- Check for disclosure of system prompts, PII, internal documents, conversation history and training data. Assess user and tenant isolation using test accounts and agreed canary records.
- Technical remediation
- Provide tasks for retrieval ACLs, user-context authorisation, PII minimisation and removing secrets from model context. A system prompt is not an authorisation boundary.
- Business outcome
- Identify exposure of another customer’s or the company’s confidential records. Training-data leakage is concluded only with verifiable evidence.
Insecure output handling
- Assessment
- Trace model responses into HTML, Markdown, URLs, SQL and executable code. Assess XSS, SSRF and code-execution risks in downstream handling rather than assuming model text alone is exploitable.
- Technical remediation
- Recommend context-specific output encoding, JSON Schema validation, URL allowlists, parameterised queries and sandbox boundaries. Treat model output as untrusted input.
- Business outcome
- Close paths where AI-generated output can affect a customer browser, internal server or connected service.
Excessive agency & tool abuse
- Assessment
- Review agent permissions across CRM, email, files, payments and other APIs. Assess user authority, tool arguments, approvals and audit trails; model unauthorised actions using test accounts.
- Technical remediation
- Recommend least privilege, narrow OAuth scopes, read-only operation, human approval for significant actions and server-side authorisation on every tool call.
- Business outcome
- Validate that an agent cannot independently exercise authority to refund payments, delete files or send messages.
Data & model poisoning
- Assessment
- Assess how altered training, fine-tuning or retrieval records influence model decisions and RAG responses. Review indexing, document approval, embeddings and versioning; training pipelines are tested only where available and authorised.
- Technical remediation
- Provide tasks for data provenance, approval workflows, index-write permissions, dataset/model versions and rollback procedures.
- Business outcome
- Clarify who can modify AI source data and how a harmful change can be detected and reversed.
Model denial of service
- Assessment
- Assess resource exhaustion and cost attacks. Measure long contexts, repeated agent loops, tool calls and parallel requests against token usage, latency and billing within agreed limited-load boundaries.
- Technical remediation
- Recommend per-user and per-tenant quotas, token/step limits, timeouts, concurrency caps, budget ceilings and circuit breakers.
- Business outcome
- Measure whether one user can spend the AI budget excessively or occupy service capacity needed by other customers.
Supply chain & plugin risks
- Assessment
- Review model providers, libraries, plugins, MCP servers and external connectors. Assess versions, token storage, tool descriptions and trust in returned data; verify component findings against actual usage.
- Technical remediation
- Recommend dependency pinning, an SBOM, integration permissions, secret rotation and a third-party component replacement plan.
- Business outcome
- Identify which AI suppliers and integrations can access business data and operations.
ENGAGEMENT PROCESS
Agreed scope. Controlled testing. Verified findings.
Architecture and criteria
Identify model/provider, RAG, tools and data flows. Agree prohibited actions, protected records and success criteria.
Test environment
Agree test accounts, synthetic data, written scope, token/cost budgets and stop conditions. Production impact is agreed in advance.
Evidence and analysis
Combine automated coverage with analyst validation. Record the model response, tool invocation and actual downstream effect separately.
Remediation and retest
Specify the responsible layer, remediation task and acceptance criteria. Agree retesting and regression coverage for subsequent model/prompt/tool changes in the project plan.
DELIVERABLES
A clear decision for leaders. An executable plan for engineers.
- Business conclusion: affected data or operation, potential impact and remediation priority.
- Technical finding: agreed test conditions, reproduction checks and evidence with sensitive data redacted.
- Engineering tasks: specific access, retrieval, output-handling or integration fixes and acceptance criteria.
- Coverage map: OWASP LLM Top 10 and MITRE ATLAS categories, passed/failed checks and assessment limitations.
An assessment covers an agreed version and scope. No findings does not guarantee absolute security; changes to prompts, models, data sources or tools require updated coverage. Training pipelines, load and data-write tests require available access and written authorisation.
Agree a test plan for your AI system.
Briefly describe the AI product, the records it can access and actions it can take. Scope, timing and pricing are set in the proposal based on the model/provider, integrations and launch stage.
Discuss your AI project ↗