0
Model scans
AI Security Testing
Shipped AI fast. Tested by us.
Everyone shipped it. Almost no one tested it.
The pace of AI adoption has outrun the pace of security review, and the exposure is sitting in production right now.
0%
of organisations already run AI agents in production
Source: SailPoint
0%
have a formal policy governing what those agents are allowed to do
Source: SailPoint
0
build their AI systems in-house, outside vendor security review
Source: Team8
That gap, fast deployment, no adversarial testing, is where AI incidents are actually coming from. Closing it takes the same rigor you already apply to infrastructure and applications, pointed at prompts, agent tool-calls, and retrieval pipelines instead.
What you get isn't a report. It's receipts.
Every finding follows the same chain, from the attack we ran to proof it's closed.
01
The exact attack input
The literal prompt, payload, or tool-call sequence that got through: reproducible, not paraphrased.
02
Captured impact
The logged response, action, or data the system actually produced: what an attacker walks away with.
03
Framework mapping
Every finding is tagged against the taxonomy your team already reports against.
04
A fix path
A specific mitigation for this system and this finding, not a generic recommendation copied across every report.
05
Re-test
Once the fix ships, we run the same attack again and confirm it holds. Closed means closed.
attack_input = "..." (redacted, reproducible prompt / tool-call chain) system = customer support agent, tool-use enabled captured_impact = agent invoked internal refund tool outside policy limits mapped_to = OWASP LLM06 · Excessive Agency / MITRE ATLAS AML.T0053 fix_path = scoped tool permissions + human approval over threshold re-test = PASSED, 2026-xx-xx
Independent Research · September 2026
We tested ten models against ourselves before we tested anyone else's.
We evaluated open-weight models on hardware we controlled, using a 124-probe battery mapped to OWASP LLM Top 10 2025, OWASP Agentic, MITRE ATLAS, and NIST AI 100-2. The run produced raw detector findings for analyst review, the same method we bring to client engagements.
0
Probe attempts
0
Raw findings
0
Probes per battery
Open-weight models we probed
OpenAI
gpt-oss-20B
Qwen
Qwen 2.5 · 3 · 3.5
Microsoft
Phi-4
Meta
Llama 3.1 · 3.2
Mistral AI
Mistral 7B
Google
Gemma 3 4B
Controlled model-level testing on hardware we controlled, not an intrusion into any provider's service. Results are specific to the tested versions, prompts, runtime, and harness, and are not universal model rankings.
Three ways to start.
Every engagement starts with the same 20-minute call: it's how we scope which one fits.
01
Screening Assessment
One model / agent, one sprint
A focused adversarial pass on a single production model, agent, or RAG pipeline. Fast enough to run against something you're shipping this quarter.
Scoped on the callFixed scope, fixed timeline
02
Focused Engagement
Full AI surface, mapped report
Adversarial testing across your full AI surface (models, agent tool-use, and retrieval) delivered as a report mapped to OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS.
Scoped on the callPriced per surface tested
03
Continuous Red-Teaming
Tied to your release cadence
Re-testing on a cycle that matches how often your models and agents actually change, so new releases don't quietly reopen closed findings.
Scoped on the callRetainer, billed quarterly
Before we begin.
Straight answers to what teams usually ask before the call.
01 What do you need from us to scope this?
Which model(s) or agents are in scope, how they're deployed, and what "in production" means for your team. We work out the rest on the call.
02 Do you need access to our model weights or infrastructure?
Depends on scope. Some engagements run entirely against your live endpoints, black-box. We agree the access model before any testing starts.
03 Will you tell us what you found before you tell us how to fix it?
No. Every finding ships with a fix path in the same report. We re-test after you patch to confirm it holds.
04 How is this different from a general penetration test?
A general VAPT covers your applications and infrastructure. This is adversarial testing aimed specifically at models, prompts, agent tool-use, and retrieval: a different attack surface with different failure modes.
05 How fast can you start?
We normally reply within one business day of the screening call, with a scoped proposal to follow.
The next move is yours
Find out what an attacker gets.
Twenty minutes. Tell us what you've shipped, and we'll tell you honestly whether this is worth testing right now.
Book a 20-minute screening call
contact@aricatech.com · +91 70911 75596