Agentiv Labs home
AI Security Testing

Test the AI your organization uses, hands-on.

Not only a review on paper. Agentiv tests your assistants, agents, chatbots and AI tools with the techniques attackers use, on its own testing range, and writes up what it finds.

  • Hands-on testing
  • OWASP Top 10 for LLM Applications
The tests

Six tests, one evidence pack.

Each test uses the security field's own terms, with a plain-English line under each.

Talk to Agentiv

  • AI Assistant Check

    After a Copilot or Claude rollout, a test of what the assistant will do and what it will show.

    What we test
    • Direct prompt injection: typed instructions that try to make it ignore its rules.
    • Indirect prompt injection: instructions hidden in a file or email it reads.
    • Jailbreaking: attempts to talk it past its safety settings.
    • Sensitive information disclosure: data it reveals that it should not.
    • Oversharing across clients: one client's files showing up for another.

  • Agent and Connector Test

    For AI wired into email, files or the CRM.

    What we test
    • Indirect prompt injection through incoming email and documents: an outsider steering the agent.
    • Excessive agency: what the agent can send, change or delete.
    • Zero-trust boundaries: whether the agent treats what it receives as untrusted and has each tool call checked, rather than trusting it by default.
    • Data exfiltration through connectors: data leaving through the tools it is connected to.
    • AI threat modeling: mapping where an attack could get in.

  • Workspace Handover Test

    An independent attack on the AI Secure Workspace's guardrails before handover, retested once the fixes are in.

    What we test
    • Prompt injection: whether the guardrails hold against hidden or typed instructions.
    • Data poisoning: whether a planted document can change the answers.
    • Oversharing: whether each person sees only their own client areas.

  • Chatbot Test

    For a chatbot on your website or in client intake.

    What we test
    • Jailbreaking: getting it to break its rules.
    • System prompt leakage: getting it to reveal its hidden instructions.
    • Prompt defense: how well its protections hold.
    • Off-brand or unsafe answers: replies your firm would not want to give.

  • Knowledge Base Review

    For AI that answers from your own documents.

    What we test
    • RAG security: how the AI finds and uses your documents to answer.
    • Data poisoning: planted or altered documents that change its answers.
    • Who can add documents: who is able to put content in front of the AI.

  • Hands-on Vendor Test

    A test of an AI tool during its trial, before you commit to it.

    What we test
    • AI reconnaissance: what the tool exposes and what it connects to.
    • AI supply chain: the models, plugins and services it depends on.
    • Model file tampering: whether a model file has been altered.

  • Test Evidence Pack

    Available with any test: the results written up as evidence your organization can use to answer client, regulator and insurer AI questionnaires. It includes a MAESTRO threat model of the system tested, so you can see where an attack could get in, and findings scored with the OWASP AI Vulnerability Scoring System (AIVSS), so you can see how serious each one is.

The benchmark

Tested against the OWASP Top 10 for LLM Applications.

The 2025 edition. These are the categories the tests cover.

The OWASP list on genai.owasp.org

Categories covered

  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM03 Supply Chain
  • LLM04 Data and Model Poisoning
  • LLM06 Excessive Agency
  • LLM07 System Prompt Leakage
  • LLM08 Vector and Embedding Weaknesses

Ready to get started?

Start with a conversation about the AI tools you want tested.

For your organization

Talk to Agentiv.

Email us.

Contact
Also

AI advisory.

AI risk assessment and compliance readiness.

Explore