AI and LLM application penetration testing
AI and LLM penetration testing attacks the features you built on top of language models: chat assistants, retrieval over company documents, and agents that call tools or APIs. The core risk is prompt injection, where instructions hidden in a message, document or web page make the model leak data or act for the attacker. ITovio tests for it by hand and proves the impact.
Enterprise only. Cyber security is the one service ITovio offers at enterprise level: established companies and enterprises with production systems worth attacking properly. We do not sell low-budget scans or small-business security packages.
- Companies shipping a customer-facing assistant or copilot.
- Enterprises connecting language models to internal documents, email, tickets or databases.
- Products with agents that can browse, send messages, call APIs or run code.
- Teams integrating tool servers and plug-ins, such as Model Context Protocol servers.
Definitive results, not maybes
Proven, not suspected
Every finding in the report is exploited by hand and shipped with a working proof of concept, reproduction steps and evidence. No unverified scanner output, no "potential" issues padding the page count.
Ranked by business impact
Severity is scored with CVSS and then argued in plain language: what an attacker reaches, which data, which customers, what it would cost you.
Closed means closed
After you fix, we attack the same issue again. The retest report states, per finding, whether it is closed, partly closed or still open.
A clean result is still a result
If a target holds, the report says exactly what was attacked, how and for how long, so "nothing exploitable found" is evidence you can hand to a customer, auditor or board.
What we test, mapped to the OWASP Top 10 for LLM Applications
| Risk | How we attack it |
|---|---|
| Prompt injection | Direct jailbreaks, and indirect injection through documents, emails, web pages, file names and tool output the model reads |
| Sensitive information disclosure | Extraction of other users' data, internal documents, credentials and personal data through the model |
| System prompt leakage | Recovery of hidden instructions and the secrets or business rules that should never have been in them |
| Improper output handling | Model output that reaches a browser, a database query, a shell or an email unescaped: XSS, injection and SSRF through the model |
| Excessive agency | Agents and tools with more permissions than the task needs, actions taken without confirmation, cross-user tool access |
| Vector and embedding weaknesses | Retrieval that ignores document permissions, poisoned content in the knowledge base, cross-tenant leakage |
| Supply chain | Third-party models, plug-ins and tool servers trusted without verification |
| Unbounded consumption | Cost and resource abuse through long prompts, loops and recursive tool calls, demonstrated without running up your bill |
The model is not the perimeter
A language model cannot reliably tell instructions from data. Any document, email or page it reads can carry instructions, so safety has to come from the system around it: what the model can see, which tools it can call, with whose permissions, and what is checked before an action happens.
Our reports therefore focus on the architecture, not only on the prompts that worked: which permission, which tool, which missing check turned a strange answer into a data leak, and how to fix that for every prompt rather than this one.
Asked before most engagements
Is this different from red-teaming the model?
Can prompt injection be fixed completely?
Do you test agents that act on our systems?
Which models do you test?
Reviewed by the ITovio security team on 3 November 2026.
Related
Web application penetration testing
Read itServiceAPI penetration testing for REST and GraphQL
Read itGuideWhat attackers exploit in 2026, and what we test for
Read itServiceRed team and objective-based attack simulation
Read itAll specialist testing: Web application testing, API testing, Cloud testing, Network and Active Directory, Mobile app testing, Red team and attack simulation.
Find out what an attacker would find first.
A 30-minute scoping call, then a written scope with targets, depth, windows and deliverables before you commit. Enterprise engagements only.
