Overview
UK teams are adding assistants, summarisers and agents to customer-facing products at speed. When those features can read account data or trigger actions, a crafted prompt becomes a security problem and, if personal data leaks, a UK GDPR problem too. We test the model wrapper, its retrieval sources and its tool permissions, and report what an abusive user could reach.
Large language models turn text into instructions, which erases the old boundary between data and code. A model cannot reliably tell your trusted prompt from a hostile one hidden in a document, a web page or a user message, so prompt injection is the central risk we test. We assess both direct injection, where a user manipulates the model, and indirect injection, where content the model retrieves carries an attacker's instructions into the conversation.
From there we follow the consequences through your architecture. Where a model draws on retrieval-augmented generation, we test whether it can be steered into surfacing documents or records the current user should never see. Where it can call tools, browse, run code or write to systems, we assess excessive agency: how much damage a manipulated model can do through the permissions you have granted it. We also check insecure output handling, where model responses flow unescaped into a browser, a shell or a downstream query.
Our work is strictly defensive. We identify weaknesses and show their impact with the minimum necessary evidence, clearly labelled as illustrative, and we never publish jailbreak recipes or attack payloads for reuse. Findings are mapped to the OWASP Top 10 for LLM Applications and translated into controls your team can apply: input and output boundaries, least-privilege tool design, retrieval scoping, and guardrails that fail safe.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Architecture reviewWe map prompts, data sources, tools and trust boundaries in your AI feature.
- Threat modellingWe identify where untrusted text can reach the model and what it can trigger.
- Manual testingTesters probe injection, leakage, agency and output handling against the live feature.
- Impact assessmentConfirmed weaknesses are shown with minimal, clearly labelled illustrative evidence.
- Report & debriefFindings map to the LLM Top 10 with defensive controls your team can apply.
What you receive
- Findings mapped to the OWASP Top 10 for LLM Applications
- Illustrative evidence of impact, no reusable payloads
- Assessment of tool and agent permission design
- Defensive control recommendations that fail safe
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP Top 10 for LLM Applications
- OWASP WSTG
- OWASP API Security Top 10
- NIST AI RMF
- MITRE ATLAS
- PTES
- CVSS v4.0
- UK GDPR Art. 32
Frequently asked questions
Can prompt injection ever be fully fixed?
Not by filtering alone. Because a model reads all text as potential instruction, the durable defence is architectural: limit what the model can do, scope what it can retrieve, and treat its output as untrusted. We test those boundaries and recommend controls that hold even when a prompt is manipulated.
Do you test models we did not build ourselves?
Yes. Most organisations use a hosted or open model and build features around it, so we focus on your application: the prompts, retrieval, tools and integrations you control. We assess how your design uses the model rather than the provider's internal training.
Is this testing safe to run against our AI feature?
Yes. The work is defensive and non-destructive. We agree boundaries first, avoid actions that would corrupt data or spam real users, and capture only the minimum evidence needed to prove a finding. We never release jailbreak techniques for reuse.
Can testing run during UK office hours?
Yes. Testing windows are agreed in UK time at scoping. India is 4.5 hours ahead of the UK during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps yours. If you prefer quiet periods, we can also test in your early morning or evening.
Does an application pentest help with UK GDPR?
It can. Article 32 of the UK GDPR expects "a process for regularly testing, assessing and evaluating the effectiveness" of security measures. A dated application test with retested fixes is a clear record of that process for the personal data your application handles.