- Home
- VAPT Services
- AI Pentesting
VAPT
AI Pentesting
AI features introduce new attack surfaces: prompts that override instructions, models that leak data, and agents that take actions they shouldn't. We test your AI applications against these risks alongside conventional web and API testing.
Why teams choose Adiroha
- Manual-first testing, not scanner dumps
- OSCP, OSWE and CEH certified testers
- Findings mapped to ISO 27001, SOC 2 and PCI DSS controls
- Retest and closure letter to prove fixes
Scope
What we cover
- Direct and indirect prompt injection
- Sensitive data and system-prompt leakage
- Insecure tool, plugin and agent permissions
- Retrieval (RAG) data poisoning and access control
- Output handling and downstream injection
- Alignment to OWASP Top 10 for LLM Applications and MITRE ATLAS
Deliverables
What you receive
- AI-specific findings with reproduction prompts
- Guardrail and architecture recommendations
- Mapping to OWASP LLM Top 10
- Retest and closure letter
How we work
Discover. Assess. Remediate. Validate.
Discover
Agree scope, assets, test windows and rules of engagement. Every project gets a unique audit code for tracking.
Assess
Manual-first testing aligned to recognised standards, with critical issues flagged to you immediately.
Remediate
Findings ranked by business impact, with clear fix guidance and a walkthrough with your engineers.
Validate
We retest your fixes, update the report and issue a closure letter you can share.
FAQ
Common questions
Do you test the model itself?
We focus on how the model is integrated into your application — prompts, data, tools and permissions — which is where most exploitable risk sits.
Which AI platforms do you cover?
Applications built on major hosted models and open-source models alike. The testing approach is platform-independent.
What is prompt injection?
An attack where crafted input makes an AI system ignore its instructions — for example, revealing confidential data or taking actions it shouldn't.
Do you test AI agents that can take actions?
Yes. Agents with access to tools, APIs or data are a priority, because a successful attack can lead to real-world actions, not just bad output.
Should we test AI features before launch?
Yes. Testing before launch lets you fix architecture and permission issues while they're still cheap to change.
Related
Related services
Medical Device Security Testing
Security testing for connected medical devices and their software, supporting FDA and IEC regulatory submissions.
Learn moreDatabase Penetration Testing
Security testing and hardening review of Oracle, SQL Server, MySQL, PostgreSQL and MongoDB databases.
Learn moreEmbedded Device Penetration Testing
Hardware and firmware security testing of embedded devices — debug interfaces, boot security and firmware analysis.
Learn moreTalk to a specialist about AI Pentesting.
A free 30-minute consultation to understand your scope and timeline. We follow up with a fixed proposal.