Capability: AI Security Assessment
Lead: Joey Victorino — personally led
Basis: Written scope · before launch, before a deal, or after an incident · the production system, not the demo
Contact: joey@victori.no

An AI security assessment of the system you shipped, not the one in the deck.

An LLM application, agent, or retrieval pipeline is in production or about to be, and nobody independent has tested what it does when the input is hostile. I test it, read the architecture behind it, and write down what held and what did not.

What I do

Prompt injection & the OWASP LLM Top 10Direct and indirect prompt injection through user input, retrieved documents, tool results, email, and web content, plus the rest of the OWASP Top 10 for LLM Applications: insecure output handling, sensitive information disclosure, excessive agency, supply chain, and denial of service. Every finding is reproduced against the running system, not described from the design.

Agentic & MCP exposureWhat the agent can reach, and what an attacker can make it do. Tool inventories, MCP server trust and authentication, permission scoping, confused-deputy paths, and whether a poisoned input can turn a read into a write, or a write into an exfiltration.

Retrieval, data & model provenanceWhether retrieval enforces the permissions of the person asking or those of the service account that indexed the corpus. Where the training and fine-tuning data came from, where the weights came from and how they are verified, and what the system is permitted to send out, to whom, and whether anyone would know.

Guardrail & monitor efficacyTesting the controls the vendor says are there. Input and output filters, classifiers, rate limits, logging, and alerting, judged by whether they caught the attacks I ran and whether the record of them would have been noticed.

Who it is for

CISOs, general counsel, and product owners accountable for an LLM system that touches customer data, internal documents, or tools with side effects, who need an answer before launch, before a customer security review, or before a regulator asks. Investors and acquirers who need the AI product tested before it is priced, as an extension of technical due diligence. Boards and counsel preparing for the EU AI Act, where the obligations for high-risk and general-purpose systems turn on documented risk management, data governance, logging, and human oversight, and where an independent assessment is the evidence that those exist rather than a policy that says they should.

The scope is the system as deployed: prompt injection in every delivery path, the OWASP LLM Top 10, agentic and MCP exposure, model and data provenance, retrieval permission enforcement, guardrail and monitoring efficacy, and egress. It is distinct from building a private AI environment, which is a separate service, and from red teaming the surrounding infrastructure, which I will scope separately if the assessment shows it is needed. I build and secure this class of system in my own operating work, so the findings are tested against how these systems behave in production.

When not to hire me

Do not hire me for a checkbox. If what you need is a vendor questionnaire completed or a certificate to attach to a sales deck, there are cheaper ways to get one and the result will not change what the system does. I do not sell or resell AI security products, so I will not recommend one as the fix. I am not the right choice for benchmark evaluation of model quality, or for a system I am not permitted to attack in a representative environment, because an assessment conducted against a sanitized copy tells you about the copy. If the system is a prototype nobody has decided to ship, wait, and assess the thing you will be accountable for.

What you get

A list of what I was able to make the system do that it should not have done, with reproduction steps, the architectural reason it worked, and a ranking by what it would cost you if someone else found it. Alongside it, a statement of the controls that held under test, so you know what you can rely on and what you cannot. The findings are written for the executive who signs off and the engineer who has to fix them, in one document, with the fix that works in production rather than a policy recommendation. One named person ran the tests, read the architecture, and signs the conclusion.

It arrives as a written conclusion in the format of the sample memorandum: the question, the evidence reviewed, the assumptions it rests on, the findings, the unknowns, and what to do next.

Questions people ask

What is an AI security assessment?

An independent test of an AI or LLM system against the ways it can be misused: prompt injection, data leakage, excessive agency through tools and agents, retrieval that ignores document permissions, and guardrails that do not hold. It reads the architecture and attacks the running system, then reports what worked, what held, and what to change.

How much does an AI security assessment cost?

Engagements are scoped and priced in writing after a short scoping call. The scope depends on the number of models, tools, and data sources involved and on whether the system is agentic. Contact me with an outline of the system and the date you need the answer by, and I will reply with a written scope.

Is this the same as LLM red teaming or a penetration test?

It overlaps with both and is neither. A penetration test targets infrastructure. LLM red teaming often stops at the model. This assessment tests the whole system as deployed: the model, the prompts, the retrieval layer, the tools and MCP servers the agent can call, the guardrails, and the egress paths, against the OWASP LLM Top 10 and beyond it.