Service
LLM application testing.
Treat the model as a component in a real system: tools, retrieval, identity, and data stores. We test the application around the model, not a chatbot in a vacuum.
What we test
Prompt injection and indirect injection through retrieved documents. Tool abuse when an agent can call APIs, mail, or tickets. Data leaving through completions or side channels. Poisoned retrieval. Auth and tenancy gaps that appear only when the model is the client.
How it differs from a web pentest
Classic app tests still apply — session, access control, SSRF through tools. The extra surface is non-deterministic behavior and over-trusted context. We write cases that reproduce, not one-off jailbreaks that vanish on the next system prompt.
Deliverable
A path from untrusted input to impact, with the control that actually closes it: tighter tools, isolation, output handling, or identity around the agent. Pair it with an AI-augmented pentest when the model sits behind a wider perimeter.