Security review of LLM and AI agent infrastructure
We review the architecture and configuration of language models, AI agents, and RAG systems, whether you built them in-house or adopted them, against the OWASP LLM Top 10.
Which systems
Where the model sees company data
The review is for systems in which a language model has access to company data or company systems.
Language models
Applications built on language models that summarize, search, classify, or process documents.
RAG systems
The model searches the company knowledge base and builds its answer from the documents it finds.
AI agents
An agent also calls tools: it sends email, reads files, and calls APIs. So a single faulty or hijacked step already triggers a real action.
What we examine
The areas we review
The OWASP LLM Top 10 is a community list of the most common security risks in applications built on language models. During the review we look at the following areas.
Architecture and data flows
What data the system sees, how sensitive that data is, and whether it leaves the organization. If it does, which provider it goes to.
Permission model
An internal assistant often reads the file share through a single service account, and that account typically sees everything. We check whether the model accesses data on behalf of the user and with the user's permissions. If a junior employee asks about the managing director's salary, the correct answer is that the system has no access to it.
Tool access
What the model can do beyond answering, and which actions require human approval.
Prompt injection
In indirect injection, the malicious instruction is hidden in a document, web page, or email that the model processes. We check how the system handles this.
Logging
Whether you can later trace who asked what and when, which sources the answer came from, which tool the model called with which parameters, and what the output was.
Deliverables
What you get at the end
items handed over
- Review of the architecture and data flows
- Assessment of permissions, tool access, and logging
- Risk report and hardening recommendations
- Implementation of the fixes, on request
Related services
What goes with the review
The review assesses an existing system. If the recommendations call for new development or a security tool, these services carry the work forward.
Secure AI solution development
Custom AI solutions, from an internal knowledge base search to an AI agent, designed with permission management and logging.
Local (on-prem) AI deployment
Model and hardware selection, installation, access management, and logging on the organization's own infrastructure.
AI security controls deployment
Vendor solutions that give you visibility into and control over the use of AI services, and filter out malicious instructions.
Frequently asked questions
The questions we hear most
Does the review include a penetration test?
No. The review assesses the architecture and the configuration. We do not attack the system.
Can prompt injection be fully prevented?
No. A language model cannot reliably tell an instruction from data, because both are text. Protection therefore focuses on limiting the impact: input has to be kept strictly separate from instructions, the model's output has to be checked before anything is executed, and the model may call only the tools it strictly needs.
Does a locally hosted model still need a review?
Yes. A local deployment stops data from being sent to a third party, but prompt injection and permission issues remain wherever the system is installed. We covered this in detail in our article on the security risks of enterprise AI adoption.
