Two questions your board will ask
about AI this year
Can our own AI be turned against us — and can we survive an attacker who is using AI against us?
They are different tests, and they need different tooling. Most programmes only run the first.
Inward
The seven layers I test in your AI stack
Mapped to the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications and the OWASP MCP Top 10 — the first standards that treat the harness and tool layer, not just the model, as the attack surface.
Model & provider
Jailbreak resistance, refusal consistency, model and version pinning, provider data-retention terms.
Unpinned models silently change behaviour; free-tier terms permit training on your data.
Prompt & context
Direct and indirect injection, system-prompt extraction, context-window smuggling.
Payloads hidden in PDFs, tickets, emails and web pages the assistant later reads.
Agent harness
Goal hijacking, loop and cost controls, planner manipulation, human-approval bypass.
Agents pursue a rewritten objective; approval gates exist but are trivially satisfied.
Tool & MCP layer
Tool poisoning, schema and description injection, shadow servers, unauthenticated endpoints.
An MCP server with no auth, over-scoped tools, and a rug-pull update path nobody monitors.
Data, RAG & PII
Cross-tenant retrieval, embedding inversion, PII in logs and vector stores, retention.
One user's records surfacing in another's answer; PII copied permanently into embeddings.
Identity & privilege
Agent service accounts, delegated scopes, secret handling, blast radius of a compromised agent.
A single over-permissioned token shared by every agent, with no revocation path.
Governance
Acceptable-use policy, shadow-AI inventory, human-in-the-loop rules, incident runbook, audit trail.
No inventory of what AI is deployed; no logs to reconstruct what an agent did, or why.
Outward
Your attacker already automated the expensive parts
Reconnaissance, pretext writing, voice cloning and payload adaptation were the labour that made targeted attacks uneconomic against a small organization. That labour is now free. The question is not whether you are a big enough target — it is whether your controls were designed for this speed.
Automated recon
Org chart, tooling fingerprint, supplier map and language style assembled from public sources.
Synthetic pretext
Personalized phishing in your staff's own idiom, plus cloned-voice vishing against finance and the help desk.
Adaptive access
MFA-fatigue and consent-phishing flows that rewrite themselves when a first attempt is refused.
Agentic movement
Autonomous enumeration and privilege-path discovery at machine speed once inside.
Extraction
Targeted identification and staging of the data that would actually hurt — including via your own AI tools.
Voice & video pretexting
Cloned-executive calls to finance and the help desk — consent-gated, scripted, and stopped at proof of compliance rather than at an actual transfer.
Detection & response
Whether your MSP, EDR or SOC generated an alert, how long it took, and whether anyone acted. Most environments produce the alert and nobody reads it.
AI as the entry point
Where the two sides meet: using your own public-facing chatbot or agent as the initial access vector. This is where the two halves of the engagement meet.
What you actually receive
A finding you cannot reproduce is an opinion. Everything below is built so your own team can re-run it.
Executive verdict
One page, no jargon. Two ratings — your AI systems, and your resilience to AI-enabled attack — with the three findings that matter and what they would cost to exploit.
Evidence pack
Every finding ships with the exact prompt, transcript, request or recording that produced it. Reproducible by your own team, not taken on trust.
Control mapping
Findings mapped to OWASP LLM / Agentic / MCP, NIST AI RMF and ISO 42001 clauses — usable directly in insurer and enterprise questionnaires.
Costed remediation
A prioritized plan with effort estimates, split into what your team can fix and what I would fix. No ambiguity about who owns what.
Engagement models
AI Exposure Assessment
Automated sweep of the model, prompt, tool and MCP surface. Shadow-AI inventory across the organization, external AI attack-surface sweep, governance gap review.
About a week
Full AI Red Team
Everything above, manually driven and extended — plus adversarial simulation, agent and MCP exploitation to proof-of-impact, and detection-and-response measurement.
3–4 weeks
Continuous AI Assurance
Re-test on every model, prompt or tool change. Continuous shadow-AI and MCP discovery, quarterly adversarial campaign, named responder for AI incidents, board-ready reporting.
Ongoing retainer
Rules of engagement
Scope, targets, windows and named approvers are signed before any activity begins. Voice and video pretexting requires separate, explicit written authorization. Social engineering stops at proof of compliance — never at an actual transfer, credential use or data exfiltration. Every action is logged and timestamped so anything I did can be separated from anything I did not.
Worth knowing before an incident
A short call is usually enough to tell whether the exposure sits in the model, the harness, the tool layer — or in the fact that nobody has an inventory of what is deployed.
Book a Call