Inventory
Every model, agent, assistant and connector in use, including the ones adopted without a ticket, and the identity each one borrows.
Practice 04 — AI Security
The model is not the risk. The harness is.
What it can read, which tools it can call, whose identity it borrows, and what it does when a web page tells it to do something else. Almost every real incident lives in that layer, not in the weights.
What sets the estimate
- Models and providers
- Agents and autonomy
- MCP servers and tools
- Data the agent can reach
- Actions it can take
Scoped on the call, quoted in days, in writing.
Scope an AI security review
A short call to understand what your agents can reach, and to explain how we would test and constrain it.
Times in
Loading available times…
Why teams call
You already suspect at least one of these.
- An agent holds a token nobody has scoped or rotated.
- MCP servers were added because they were useful, not because anyone read them.
- Your retrieval index does not know which user is allowed to see which document.
- Agent output is written straight into something that executes or renders it.
- If an agent did something costly last Tuesday, you could not reconstruct why.
- Teams are using models you have not inventoried.
What you get
The deliverables.
Review
- Configuration review of deployed models, assistants and agents, and the permissions they inherited
- MCP connector review: requested scopes, token handling, tool descriptions and server provenance
- Agents treated as non-human identities — scoped, owned, attributable, revocable
- Retrieval boundaries: access control on indexed data, and resistance to a poisoned context
- Prompt-injection testing, direct and indirect, against the tools the agent can actually reach
- Shadow AI inventory — what your teams are already running without telling you
Respond
- Logging of prompts, tool calls and outcomes detailed enough to reconstruct an incident afterwards
- Tuned prompts and triage harnesses for zero-day response — the harness is the moat
- Guardrails and eval suites that function as tested security controls rather than marketing
How it runs
Test the harness
Injection attempts routed through the tools the agent can genuinely reach, so the finding is what an attacker gets rather than whether the model can be made to say something.
Instrument and sequence
Logging that would survive an incident review, guardrails with evals behind them, and a 90-day order of work your team owns.
QuestionsBefore you
Before you
book the call.
We only use a vendor assistant. Is there anything to review?
Usually yes, and it is the permissions rather than the model: what it was connected to, which identity it acts as, and who approved that. Those decisions are yours regardless of whose model it is.
Do you need our prompts or training data?
Prompts and tool definitions, yes, because that is the attack surface. Training data, rarely. We will ask for the least that makes the review real and say why each item is needed.
Is this red teaming the model for harmful outputs?
No. Safety evaluation of model outputs is a different discipline. We test what the surrounding system lets an attacker do — reach data, call tools, escalate — which is where the loss actually occurs.
What do you mean by "the harness is the moat"?
Model capability is converging and rentable; the scaffolding around it is not. The prompts, tools, retrieval and guardrails you build are both your advantage and your attack surface, which is exactly why they deserve review.
Next step
Scope an AI security review.
Thirty minutes, no obligation. We will tell you what is worth doing, including when the answer is less than you expected.