We attack your LLM features and agents the way a real adversary would: prompt injection, tool abuse, data leaks. Every finding comes with the steps to reproduce it.
Two founders and no middle layer: the people who scope your test are the ones who run it and sign every finding. We work in English and Spanish, remotely, and we publish what we can as open source.
“The team is helping us integrate AI safely, not only into our integrations and platforms, but into the way we bring AI into our own workflows.”
“A key contribution to our AI architecture. It helped us define an implementation model we now repeat with our clients.”
Startup, enterprise or public body: we join where your systems are being built and adapt to your pace. Security enters the architecture, not the last week.
We add depth in AI, architecture and secure development, from a one-off investigation to an implementation for one of your clients.
Instructions hidden in what the model reads: user input, documents, web pages, emails.
What the model can be made to reveal: other users' data, secrets, its own instructions.
Agents that call tools they should not, with more access than the task needs.
Content planted in your knowledge base or memory that steers later answers.
Model output that reaches your product unchecked: scripts, queries, commands, links.
Servers, plugins and third-party APIs your agent trusts by default.
FromUS$5,000
A fixed price, in writing, before we start.
We need from you: a staging app or agent, its tool list and one technical contact.
One AI application or agent
An LLM feature, a RAG assistant or an agent, with up to 5 tools, integrations or MCP servers.
Two weeks of testing
All six attack surfaces, on staging and an agreed, authorized scope.
Report and live walkthrough
Reproducible evidence for every finding, mapped to OWASP LLM, Agentic Top 10 and MITRE ATLAS, with an executive summary for leadership.
Test cases for your pipelines
An engineering solution for your delivery process, with the tests we ran, automated.
Review within 60 days
We test your fixes. A finding closes only when it holds.
Architecture, data flows and trust boundaries, written so your whole team can follow, not only security.
You getA map of the system as it is really used.
A request anyone on your team can repeat. If it cannot be reproduced, it is not a finding.
You getReproducible evidence for every finding.
Findings sorted by impact and effort. Every finding ends in a decision, not in a PDF.
You getWhat to move first, and why.
We check every fix. A finding closes only when it is fixed.
You getA review report and controls for the next cycle.
Written scope first
Nothing is tested outside what we agreed, and every change is agreed again.
Systems, never people
No one is named in a finding. Team issues are talked through before they circulate.
Your data stays yours
Client data never goes into external AI tools without a signed agreement.
A person signs each finding
AI helps us work, but it never writes a finding or sets a severity.
Can an account see or do what it should not, or chain small weaknesses into a real path? Authorization, business logic and payments, with reproducible evidence and a review of every fix.
More on pentestingDescribe your model, data, agents and tools. Get the risks mapped to OWASP, ATLAS and NIST, the controls and owners, and what a pentest should prove when you are ready for one.
More on the toolWhat we find, how it works and how to fix it. Written for the engineers who have to fix it.
All notesTell us what you are building and what you need to decide.
You tell us what you are building
Four short questions, or a plain email. No deck needed.
A person reads it and replies
With an honest first view and the questions we need answered to scope it.
A 30-minute scoping call
Live or async, as you prefer. We agree on what is in scope and you get the fixed price in writing before any work begins.