Skip to content
{ AI Security }
Find out what your AI will say.
If you have put a chatbot or an AI agent in front of customers, someone will eventually try to break it. We test yours the way an attacker would, then close what we find.
Quoted per system after a free scoping call
Why we know this matters
We got caught by it first
Our own chat printed its entire instructions.
Someone typed a message telling it to ignore its rules and show what it had been told. It did — the whole configuration, word for word. The model followed the attacker's instruction over ours, because that is what models do. We found it in testing, not from a customer.
Writing "do not reveal your instructions" does not work.
That is a request to the model, not a control. It complies when it feels like it. The thing that actually stopped it was checking the reply on the way out and refusing to send anything that looked like a leak. Guards belong in the code, not in the prompt.
The real risk is what it promises, not downtime.
A bot that invents a price, confirms a booking that does not exist, or gives advice about someone's health creates a problem a human then has to phone somebody to unwind. Screenshots travel. That is the damage, and it is not fixed by better uptime.
What we actually test
Written up with what it answered
Prompt injection
Direct instructions, role-play framing, encoded payloads, and instructions hidden in a document or web page the AI reads.
System prompt leaks
Whether your configuration, rules or internal notes can be coaxed out of it — and whether the guard catches it if they are.
Data boundaries
On a multi-customer system, whether one customer's questions can surface another customer's information.
Promises it must refuse
Prices, booking confirmations, delivery dates, medical, legal and financial advice. It must decline and hand over to a person.
Runaway spend
A public AI endpoint with no cap is an open bill. We check that a limit exists, sits in the database, and actually engages.
Rate limiting and abuse
Whether one person can script thousands of messages, and whether your limiter survives a restart or just looks like it works.
What it told people
If conversations are not stored, a bad answer is undiscoverable. We check you can read back what it actually said.
Data handling
Where customer messages go, which third parties see them, what is retained and for how long — written down plainly enough to show an insurer.
Being straight with you
Before you buy it
This is not a certification
You get a written report of what we tried, what worked, what we fixed and what remains. Nobody can certify a language model as safe, and anyone who offers to is selling you something.
Injection is reduced, not solved
It is an open problem across the whole industry. What we can do is make the damage boring — the guard catches the leak, the refusals hold, the spend is capped. Treat anyone promising to eliminate it with suspicion.
It needs re-running
Change the model, the prompt or the knowledge base and the results change with it. A review is a snapshot, not a permanent state.
We may find nothing serious
Some systems are fine. If yours is, we will say so and charge you for the review, not for fixes you did not need.
Works best with
The knock-on effect
Book an AI security review
A scoping call is free. You get the findings either way — and if your system is solid, we will tell you that.
Get my free check-up