AI Governance
Someone has to actually try to break it
Adversarial testing of LLM and agent deployments against the OWASP Top 10 for LLM Applications and the 2026 agentic list.
No integration performs this work. A compliance platform can confirm that a control exists; it cannot try to defeat it. Red teaming is adversarial work done by a person who is trying to make your system do something it should not.
For LLM and agent deployments the attack surface is genuinely different from conventional application security. The input is natural language, the trust boundary is blurry by design, and the system was built to be helpful — which is a liability when the instruction is hostile.
We test against the OWASP Top 10 for LLM Applications and, for agentic deployments, the OWASP Top 10 for Agentic Applications published in December 2025, which names risk classes that do not exist in non-agentic systems.
What we test
The agentic attack surface
Scoped to what you have actually deployed. A retrieval chatbot and a tool-calling agent with write access deserve very different engagements.
Prompt injection, direct and indirect
Direct injection is a user typing something hostile. Indirect is the harder problem: instructions hidden in a document, email or web page the agent reads while doing its job. Any agent that consumes untrusted content is exposed by design.
Exfiltration through the retrieval layer
Can we make the system surface a document the requesting user has no right to see? This is the failure that turns a helpful assistant into an access-control bypass, and it is common wherever retrieval was bolted on beside the permission model instead of inheriting it.
Tool misuse and excessive agency
Excessive agency has been a named OWASP risk since the 2025 LLM Top 10. The 2026 agentic list decomposes it into identity and privilege abuse, tool misuse, and unexpected code execution. We enumerate what the agent can reach and test what happens when it is persuaded to use it.
Agent goal hijack and memory poisoning
Can an attacker change what the agent is trying to do, or plant something in its memory or context that changes its behaviour on a later run? Persistence turns a single successful injection into an ongoing compromise.
Human-in-the-loop as an attack surface
OWASP catalogues overwhelming the human in the loop as a threat, and human-agent trust exploitation as ASI09. We test whether your approval gate is a control or a formality — including by measuring how many approvals a day it actually generates.
Jailbreaks and guardrail bypass
Whether the safety behaviour holds under adversarial pressure, and what happens when it does not. The interesting question is rarely whether a guardrail can be bypassed, but what is reachable once it is.
Questions
Frequently asked
How is this different from a penetration test?
Conventional pen testing targets infrastructure and application logic; the inputs are structured and the trust boundaries are drawn. LLM red teaming targets a system whose input is natural language and whose defining feature is following instructions. Both are worth doing and they find different things. We would not propose this as a substitute for a pen test.
What do we get at the end?
A findings report with reproduction steps for every issue, severity rated against exploitability and blast radius rather than novelty, and remediation guidance mapped to the relevant OWASP entries. Where a finding maps onto a HITRUST, SOC 2 or ISO/IEC 42001 control, we say which — that is the part that saves you work at assessment time.
Will this satisfy a HITRUST or SOC 2 requirement?
It contributes evidence rather than automatically closing a requirement. Recent HITRUST CSF versions map to the OWASP Top 10 for LLM Applications, so testing against that list produces evidence in a shape an assessor recognises. Whether it closes a specific requirement depends on your assessment scope — and since our parent company is a HITRUST Authorized External Assessor, we can tell you how an assessor will actually read it.
We have not deployed anything yet. Is this premature?
Probably, and we would rather scope it later. Red-teaming a system that does not exist tests nothing. Start with the readiness assessment — it will tell you what is worth testing and when.
More from AI Governance
Want to know where you actually stand?
We will tell you what is in scope, what an assessor will accept, and what you do not need.