AI Agent Security Assessment
Find out what your AI agents can be made to do, before someone else does.
- Typical timeline
- 4 to 6 weeks
- Typical timeline
- Listed below
- 6 deliverables
- Listed below
- No obligation
- Quoted after scoping
- No obligation
Built for
- Security leads responsible for AI agents or AI features that are live or about to go live
- Engineering teams whose agents can read data, call APIs or send messages on their own
- Organisations answering security questions from their own customers about the AI in their product
You recognise this
- Your agents can take actions, not only answer questions
- Nobody has tried to make an agent misbehave on purpose
- You cannot say for certain what an agent could reach if it were manipulated
The problem
An AI agent is a new kind of user: it reasons, chains tool calls and can be talked into things. A conventional penetration test does not cover prompt injection, data leakage through retrieval, over-broad tool permissions or an agent acting outside its intended scope. This assessment tests those paths directly, against your real configuration.
What you receive
- 01
Threat model
A map of each agent in scope, the tools, data and systems it can reach, and the ways those paths could be abused.
- 02
Adversarial testing
Hands-on testing for prompt injection, including injection through documents and web content the agent reads, data leakage, tool misuse, privilege escalation and unsafe actions.
- 03
Permissions review
What each agent is allowed to touch compared with what it needs, with specific reductions.
- 04
Findings report
Every finding with its severity, the evidence, how we reproduced it and the fix we recommend. Written for engineers, with a summary for leadership.
- 05
Remediation session
A working session with your engineers to go through the fixes.
- 06
Retest
A retest of the findings you have fixed, within an agreed window, with the report updated to show what is closed.
Phases and expected timeline
- 01
Scoping and rules of engagement
1 week
We agree what is in scope and what is not, the test environment, when we may test and who to call if something unexpected happens. Nothing is tested until this is signed.
- 02
Threat modelling
1 week
We map each agent, its tools and its data, and decide which attack paths to test first.
- 03
Testing
1 to 3 weeks
Hands-on adversarial testing against the agreed environment, with anything serious reported to you straight away rather than held for the report.
- 04
Report and remediation session
1 week
You receive the findings report, and we work through the fixes with your engineers.
Typical timeline: 4 to 6 weeks
Typical range for a single, well-defined scope. The clock starts once access and the people we need are in place. Your quote confirms the timeline after a scoping call. The retest is scheduled once your fixes are in and is not included in this range.
Before we start
- Written authorisation to test from the owner of each system in scope
- A test or staging environment that matches production, or agreed test windows in production
- Test accounts at each permission level the agents use
- Confirmation that your model and tool providers' terms allow security testing of your deployment
- A technical contact who is available while testing runs
What you can do afterwards
- You know how your agents can be manipulated, with the evidence, instead of assuming they cannot
- Each agent's permissions are reduced to what it needs
- You can answer customer security questions about your AI with a findings report and a record of what was fixed
- Your engineers know how to test for these issues themselves next time
What this work is designed to achieve. Results depend on your systems and your data.
Questions about this package
A penetration test looks at your applications and infrastructure. This assessment looks at the agents: what they can be talked into, what they can reach and what they do with it. The two complement each other, and we can include the infrastructure the agents run on in scope.
We agree the environment and the test windows before we start, and nothing destructive is run against production without your written agreement.
Bulwark is our own product for agent identity, permissions and audit. If it would address a finding, we will say so, and say what else would. Every finding is written so it can be fixed without it.
The assessment tests the behaviour and permissions of your deployment, so it applies whichever model or agent framework you use.
Because the work depends on your systems, your data and how far the scope reaches. After a scoping call we send a written quote that states the scope, the deliverables, the timeline and the cost. Larger enterprise projects are quoted separately, based on scope, integrations, deployment requirements and ongoing support.
Yes. Say so in your enquiry and we will sign one before you share details of your systems.
Yes. For example, an architecture review can lead straight into a build, and we can quote the combined work as one engagement with one plan.
Handover includes the documentation, runbook and working session your team needs to run what we delivered. If you want us to stay involved, ongoing support is quoted separately.
Get a quote for this package
Tell us about your systems and what you need. We reply with questions or times for a scoping call, then send a written quote that sets out the scope, the deliverables, the timeline and the cost.
Larger enterprise projects are quoted separately, based on scope, integrations, deployment requirements and ongoing support.
Prefer email? info@bastionshieldtechnologies.com
Often considered alongside
AI Governance Implementation
Controls around the AI your organisation uses: an inventory, clear policies, human checkpoints and an evidence trail you can show a reviewer.
AI Architecture Review
A second opinion on your AI design before you commit budget to it, with a written report and a prioritised roadmap.