Scope
Agree the system boundary, threat model, attack goals, hard limits, and data-handling rules before anything is touched.
AI RED TEAMING
Find where your
AI product fails
under adversarial pressure
Human security experts attacking your AI product by hand, augmented by our own AI tooling for scale. Not an automated scan. Reproducible findings you can act on.
- Human-led, AI-augmented
- Reproducible findings report
- OWASP Top 10 for Agentic Applications
- EU AI Act & ISO 42001 aligned
- Optional defensive follow-up
What we attack
Six attack surfaces covering how AI products actually get broken, aligned with the OWASP Top 10 for Agentic Applications.
Prompt injection & jailbreaks
One-shot and multi-turn jailbreaks, plus indirect injection through retrieved content and tool results.
System prompt & data leakage
Coaxing the model to reveal instructions, PII, credentials, financials, and proprietary data.
Agent abuse
Tool misuse, memory and context poisoning, goal hijack, privilege escalation, unsafe code execution.
RAG & knowledge poisoning
Malicious documents planted in your index, retrieval-time injection, forged source attribution, poisoned grounding.
Evasion & prompt brittleness
Repeat trials, perturbed payloads, stochastic outputs: the prompt that fails once, then works on the tenth try.
Resource & cost exhaustion
DoS, token thrash, quota drain, rate-limit bypass, and denial-of-wallet attacks.
Humans attack. AI scales the attack.
Automated scanners find the attacks everyone already knows about. The findings that matter come from a person who understands your product and wants to break it.
Experts run the engagement
Real security engineers read your system, build a threat model, and go after it the way an attacker would.
- Attack chains built around your business logic
- Multi-turn exploits that need patience and judgement
- Every finding hand-verified before it reaches the report
AI tooling widens the net
Our own tooling takes the attacks our team designs and runs them at a volume no human could cover by hand.
- Thousands of payload variants and mutations
- Repeat trials that expose stochastic, flaky failures
- Broad surface sweeps, so experts spend time on depth
Why a scanner alone is not enough
Tool-only testing is cheap for a reason. It cannot reason about what your product is actually worth breaking.
- Generic payloads your guardrails were tuned against
- False positives nobody triaged
- No sense of business impact or severity
How an engagement runs
Four steps from scope to verified fix.
Attack
Our experts attack by hand while AI tooling widens coverage. Realistic, multi-turn attacker scenarios mapped to the OWASP Top 10 for Agentic Applications.
Report
Every finding documented with reproduction steps, severity rating, impact, and ranked remediation.
Re-test
After you remediate, we return and re-run every finding. Each one leaves marked fixed or still open.
The findings report
One document your engineers can fix from and your auditors can read. Every finding reproducible, rated, and tied to a concrete business impact.
Sample extract
AI Red Team Assessment: Support Agent
-
Critical RT-001
Indirect prompt injection via retrieved ticket attachment triggers refund tool
Instructions hidden in a customer-uploaded document reach the agent as trusted context and drive a refund without human approval. Attacker-controlled payout, no operator in the loop.
1. Upload attachment with hidden instruction block 2. Ask agent to summarise ticket #4471 3. Agent calls issue_refund(amount=...) unprompted -
High RT-004
System prompt and tool schema recovered over a multi-turn role-play chain
Full instruction set and tool signatures leak after six turns, handing an attacker the map needed to build targeted bypasses.
-
Medium RT-007
Guardrail is stochastic: blocked payload succeeds on repeat trials
The same jailbreak passes 9 times in 100 attempts. A single manual test would have recorded this as safe.
What every finding carries
- Reproduction steps, exact prompts, and observed output
- Success rate across repeat trials, not a single lucky hit
- Severity with the reasoning behind the rating
- Business impact in your terms: money, data, trust, downtime
- Concrete remediation, ranked by effort against risk removed
- Mapping to OWASP Top 10 for Agentic Applications and our AI risk taxonomy
And alongside it
- Executive summary: what an attacker can do today and what it would cost you
- Coverage map: what was attacked, what held, and what stayed out of scope
- Walkthrough session: live with your engineering team, questions answered
- Evidence pack: transcripts and artefacts usable for EU AI Act and ISO 42001 files
- Re-test addendum: after remediation, each finding marked fixed or still open
Then, if you need continuous cover
The red team surfaces the gaps. If you need continuous protection, add Stihia Sense as the real-time detection layer.
One-time / periodic
Red team assessment
Find where the product fails under adversarial pressure.
Continuous
STIHIA Sense
Real-time detection across prompts, tools, and agent actions.
Find out what an attacker would do to your AI product.
Tell us what you are building and we will scope the assessment on a half-hour call. No obligation past that.