Security scanning
From US$3,490 per engagement
Find exploitable weaknesses in your AI assistant, agent or knowledge system, with verified evidence and a prioritised fix plan.
View scope, deliverables and requirements
What is included
- One AI application in one agreed test environment, up to three user roles and two connected tools or data sources.
- Up to 40 agreed test cases and 500 model requests covering prompt injection, sensitive-data exposure, retrieval permissions, unsafe output handling and excessive agent permissions.
- Review one code repository or dependency inventory and the application’s supplied cloud configuration for exposed secrets, vulnerable dependencies, authentication and usage controls.
- Manual validation of findings, a report walkthrough and one focused retest of the original findings within 30 days (up to four hours).
What you receive
- Executive risk summary and an inventory of the assessed AI components.
- Evidence-backed findings with severity, affected component, reproduction steps, business impact and recommended fixes.
- Coverage matrix marking passed, failed, blocked and untested checks; prioritised remediation backlog and retest results.
Delivery
Typically 5–7 business days after scope, access and the test window are agreed. Includes up to 24 specialist hours, including the retest.
Before we start
An authorised technical contact, written permission to test the named assets, test accounts and synthetic data. We agree request limits, model usage costs and stop conditions before testing.
Scope boundaries
Whole-network penetration testing, denial-of-service, social engineering, model training, unrestricted production testing and remediation implementation are excluded. Findings describe the tested version and scope; this is not a security certification or a guarantee that every vulnerability will be found.
Security hardening
From US$4,490 per engagement
Turn assessment findings into practical fixes for data access, agent permissions, guardrails and secure application behaviour.
View scope, deliverables and requirements
What is included
- One previously assessed AI application; up to five agreed findings and 32 specialist hours, whichever limit is reached first.
- Implement agreed fixes such as server-side access checks, least-privilege tool permissions, secret handling, approval gates, output validation and usage limits.
- Test changes in staging, perform one approved deployment and provide a rollback plan.
- Retest the selected findings and check agreed legitimate user journeys for regressions.
What you receive
- Reviewed code or configuration changes with a change log.
- Before-and-after test evidence and a record of fixed, partially fixed and outstanding findings.
- Deployment and rollback instructions plus a technical handover.
Delivery
Typically 5–10 business days after findings, access and changes are agreed. Larger changes receive a separate estimate before work begins.
Before we start
A recent AI Security Scan or an equivalent report we can validate, source/configuration access, a staging environment and an owner who can approve deployment.
Scope boundaries
A fresh full assessment, architecture replacement, new features, retraining and third-party vendor fixes are excluded. Prompt filters alone cannot eliminate prompt injection; authorisation must be enforced outside the model.
Monthly monitoring
From US$1,290 per month
Recheck your assessed AI system each month and catch security regressions when models, prompts, tools or dependencies change.
View scope, deliverables and requirements
What is included
- One previously assessed AI application in one environment, with up to three roles and two connected tools or data sources.
- One scheduled monthly run of up to 40 agreed regression tests and 500 model requests, plus a dependency and configuration change review.
- Up to eight specialist hours per month for test execution, findings triage and a review meeting.
- Notify the nominated contact of a confirmed critical finding within one business day of validation. Service hours: Monday–Friday, 09:00–17:00 SAST, excluding South African public holidays.
What you receive
- Monthly coverage and findings report, with changes against the agreed baseline.
- Updated risk register and prioritised recommendations for the system owner.
- A record of tests blocked by access or system changes and a proposed next action.
Delivery
Monthly service after an initial assessment and baseline handover. Renewals are invoiced separately; no automatic card charges or unused-hour rollover.
Before we start
An agreed test baseline, current access, a named technical contact and advance notice of releases. Material architecture or integration changes require a new scope.
Scope boundaries
Continuous monitoring, a 24/7 security operations centre, incident response, emergency remediation and unlimited release checks are excluded. Remediation and additional runs are quoted separately.
Monthly monitoring means scheduled regression checks, not continuous surveillance or a 24/7 response service. Hardening and monitoring can use a previous assessment we validate. Selecting them without scanning does not include a new full assessment.
Renewals are invoiced separately, with no automatic card charges or unused-hour rollover. We confirm the final scope and price before work begins.
