Tier 2 · fixed-price engagement
AI security assessment
Prompt injection, data exfiltration and agent authority, tested against the system you actually run, from an offensive security background.
Who this is for
A team running a language model in production, or buying one, that needs the security review done before it ships rather than after.
Fixed price
$6,500
- Duration
- 2 weeks
- Deposit
- $1,200
- Other currencies
- €5,900 · £4,990 · S$8,800
- Catalog
- T2-02
Thirty minutes with the engineer who would run the work, before any paperwork.
The work, stage by stage
In order, with what happens at each stage and what it produces. The timings are the ones the catalog prices, not an estimate written for this page.
Map the attack surface
Days 1 to 2
Every place untrusted text can enter: the prompt, retrieved documents, tool output, user uploads, and anything a previous turn left in context. The map is the report's spine, and most of it is usually undocumented.
Direct injection
Days 3 to 4
Whether a crafted input talks the system out of its instructions, reveals the system prompt, or reaches a capability it was not meant to reach. Run from the test suite this firm publishes, extended with cases specific to your prompt.
Indirect injection
Week 1, remainder
Instructions arriving inside retrieved documents rather than from the user, which is the case most reviews miss because it requires controlling a source the system already trusts.
Exfiltration and authority
Week 2, first half
Whether the system can be made to return data the asker was never entitled to, what the agent is permitted to do without a human, and what leaves the boundary in an outbound prompt or tool call.
Report for two readers
Week 2, second half
Findings with reproduction steps for your engineers, and an impact summary for whoever decides whether to ship, in one document.
Everything that arrives, listed
The contents of the document, and the artifacts that come with it. If something here would not be useful to you, say so before we start and the scope changes.
- The attack-surface map, naming every untrusted input path found
- Each finding with reproduction steps, observed impact and the fix, ranked by exploitability rather than by a severity label
- The test cases used, handed over so your own continuous integration can run them again after a change
- A retest note stating what was fixed and what was accepted, written after remediation if you want one
- An impact summary a non-engineer can act on, in the same document
What this covers, and who takes the rest
Stated up front, because scope is what derails an engagement in week two rather than at the proposal.
Inside this engagement
- Prompt injection, direct and indirect, including injection through retrieved documents
- Data exfiltration paths, and the authority an agent holds without a human
- Tool and function calls the model can reach, and what leaves the boundary
Handled separately
Named so you can plan and budget for it, whether we do it or somebody else does.
- A conventional application penetration test of the surrounding product, which is a different scope
- Remediation engineering, scoped once the findings name what has to change
Start with a call, not a proposal.
Thirty minutes, straight to the engineer who would run the work. We will tell you if a smaller engagement answers your question, or if nothing here does.
Typical reply within one business day · Engagements start at $2,500
Fixed price · 2 weeks