AI Security Testing

AI security testing is a specialist assessment of the applications you have built on artificial intelligence, including chatbots, copilots, AI agents and retrieval-augmented generation (RAG) systems, along with the large language models behind them.

Conventional penetration testing looks for flaws in code and configuration. AI testing looks for flaws in behaviour: prompt injection, data leakage, excessive agency and unsafe handling of model output.

CyberLab is among the first organisations worldwide recognised under CREST’s Security Testing of AI scheme. Our testing is aligned to the OWASP Top 10 for LLM Applications, ETSI EN 304 223 and the UK Government’s AI Cyber Security Code of Practice.

Speak with an ExpertGet Free HackRisk Report

What Is AI Security Testing?

AI security testing is the process of finding the weaknesses that a large language model introduces into an application, and that conventional penetration testing was never designed to catch. It applies wherever an LLM or other machine learning component shapes what an application does: a customer-facing chatbot, a copilot embedded in your own software, an agent that can take actions for a user, or a RAG pipeline answering questions from your internal knowledge base.

The risks work differently. An attacker does not need to breach your network to cause harm, because they can manipulate the model directly. A carefully worded prompt can override the instructions you gave the system, draw out data it should never reveal, or turn a helpful agent into one that takes actions nobody authorised. Content pulled in from a document, a web page or an email can carry hidden instructions the model then follows. Because these systems increasingly hold credentials and call real tools, the consequences reach well past the chat window.

These are not theoretical risks. In February 2024, the British Columbia Civil Resolution Tribunal decided Moffatt v Air Canada, holding the airline liable for inaccurate advice its website chatbot gave a customer. Air Canada argued the chatbot was a separate entity responsible for its own actions. The tribunal called that submission remarkable and rejected it. The damages were minor, at around CAD 812. The principle is what matters: an organisation owns what its AI tells its customers. The NCSC makes a related point in its guidance on secure AI system development, warning that prompt injection and data poisoning are novel vulnerability classes that sit alongside conventional threats rather than replacing them.

We assess the whole system: the model, the application wrapped around it, the data it can retrieve and the tools it can reach. You get an evidence-based picture of your exposure and a remediation roadmap you can act on.

Why Is Testing AI Different From Standard Penetration Testing?

Testing an AI application is a different discipline from testing a conventional web app or API. It needs a consultant who understands how these systems behave, not a standard methodology pointed at an unfamiliar target.

The differences are substantial. AI systems are non-deterministic, so the same input can produce different outputs on different runs. Security lives in the model's behaviour rather than in a fixed line of code, and it cannot be reduced to a pass or fail checklist. The attack surface is much larger than the model: it takes in the system prompt, the connected tools and plugins, the vector store behind a RAG pipeline, and every downstream system the output flows into. Prompt injection has no clean fix in the way a parameterised query stops SQL injection, so it has to be probed, understood and defended in layers. Where a third-party hosted model is in scope, testing is governed by that provider's acceptable use policy and terms of service, which we review and agree with you before any work starts.

Our AI engagements therefore pair recognised methodology with adversarial testing by hand, run under controls that make them safe to conduct against systems you depend on.

CREST Security Testing of AI logo

Recognised Under CREST's Security Testing of AI Scheme

CREST launched its Security Testing of AI scheme in August 2026. It sets independently assessable requirements covering practitioner competence, testing methodology, governance and quality control, and the technical approach used to identify AI-specific risk. CyberLab is recognised under it, in the first cohort of organisations worldwide to achieve it. For you, that means the capability of the team assessing your AI has been checked by someone other than us.

Read Announcement
CyberLab logo

Approved for Anthropic's Cyber Verification Program

Anthropic ships its generally available Claude models with cyber safeguards that block most security work. Its Cyber Verification Program allows organisations doing genuine defensive work to be independently verified and have those safeguards tuned to the work they actually do. CyberLab holds Defense Access, covering incident response, malware analysis and vulnerability validation. It shortens investigation time. A qualified consultant still reviews every finding before it reaches you.

Read Announcement
AI applications are being deployed faster than they are being tested, and they carry a class of risk that conventional security testing was never built to find. Organisations building on large language models face growing pressure to evidence AI security, from customer due diligence through to ETSI EN 304 223 and the UK Government's AI Cyber Security Code of Practice. A CyberLab AI security test gives you a clear, evidence-based understanding of your exposure, and a practical remediation roadmap to address it.

Uncover AI-Specific Risk

Find the vulnerabilities standard penetration testing does not look for, from prompt injection to data leakage and model manipulation, before an attacker does.

Real-World Threat Simulation

See how your AI holds up against the techniques a real attacker would use. A practical measure of readiness rather than a theoretical one.

Safe to Test on Live Systems

Testing runs under strict rate and cost controls, so it can be carried out on live systems with users present and no disruption to your service.

Evidence for Boards and Buyers

Give your board, your customers and your auditors independent evidence that your AI has been tested by an accredited team, so AI adoption does not stall in due diligence.

Thousands of organisations across the UK trust us, here’s why…

CREST & CHECK Accredited

We are certified for both CREST and CHECK Green Light testing - an achievement not all testing companies can claim.

Clear and Concise Reports

We provide easy-to-understand reports with detailed findings and actionable recommendations.

CREST Infrastructure & App Testing

We are certified in both CREST Infrastructure and Application testing to the highest standards.

Specialised Testing Teams

Developer-trained testers deliver comprehensive app, API, and cloud testing for deeper, more effective results.

Experienced & Senior Consultants

Our team consists of highly experienced, senior consultants and penetration testers with over 15 years of expertise.

We Save You Time and Money

Clients consistently tell us that we deliver higher-quality testing in less time.

Outstanding Communication

We establish dedicated Teams or Slack channels to ensure seamless two-way communication between all.

Forward-Thinking Security

Our team goes beyond identifying vulnerabilities, offering proactive solutions to mitigate future risks.

Trustpilot

What AI Systems Do We Test?

Our AI security testing covers the full range of AI applications and model deployments, including:

Chatbots & Conversational Interfaces

Customer-facing and internal chat assistants, tested for manipulation, data leakage and unsafe output handling.

Copilots & AI-Assisted Features

LLM features embedded inside your own products, assessed in the context of the application and the users around them.

AI Agents & Agentic Systems

Agents that call tools and functions and act on a user's behalf, tested for excessive agency, unauthorised actions and the security of their tool integrations, including Model Context Protocol (MCP) servers.

RAG Pipelines & Vector Stores

Retrieval-augmented systems, assessed for data isolation, retrieval poisoning and embedding weaknesses.

Custom & Fine-Tuned Models

Models trained or fine-tuned on your own data, tested for memorisation, extraction and poisoning risks.

Third-Party Hosted Models

Applications built on hosted models such as OpenAI, Anthropic or Azure OpenAI Service, tested within the provider's terms of service, agreed in advance.

What Do We Test For?

Our methodology is aligned to the OWASP Top 10 for LLM Applications, maintained by the OWASP GenAI Security Project and the recognised reference point for AI application security. We assess each of the areas below, combining automated technique with extensive manual testing.
01

Prompt Injection

Direct and indirect injection, including instructions hidden in third-party content, multi-turn and obfuscated payloads, jailbreaks and guardrail bypass.

02

Sensitive Information Disclosure

Extraction of personal data, credentials or proprietary information, training data memorisation, and leakage of other users' conversations.

03

Supply Chain

Risks in third-party models, datasets, plugins and packages, including unsafe model file formats and the provenance of models pulled from public hubs.

04

Data & Model Poisoning

Controls around training, fine-tuning and RAG ingestion, and whether malicious content can reach what the model learns from.

05

Improper Output Handling

Model output passed to downstream systems without validation, which opens routes to XSS, SQL injection, SSRF, command injection and unsafe rendering.

06

Excessive Agency

The scope of the tools an agent can use, whether it can be manipulated into unauthorised actions, and the controls around high-impact ones.

07

System Prompt Leakage

Disclosure of the system prompt, hidden instructions or configuration, and the impact of whatever is exposed.

08

Vector & Embedding Weaknesses

Access control and multi-tenant isolation on the vector database, and poisoning of embeddings retrieved during legitimate use.

09

Misinformation

The model's propensity to hallucinate, the integrity of its citations, and how well guardrails signal confidence to the user.

10

Unbounded Consumption

Denial of wallet and resource exhaustion, the strength of rate, quota and cost controls, and the risk of model extraction.

Three further stages frame every engagement:
  • Application & Architecture Mapping: A proxy-based reconnaissance stage that maps the AI components in scope, the data flows between them, the authentication boundaries and the tools the model can call.
  • Manual Review: Governance and configuration checks against security benchmarks, covering guardrails, logging, human oversight, incident response, data retention, model versioning and key management.
  • Exploitation: Permissioned, controlled exploitation of confirmed issues to demonstrate real impact. Never anything that risks system stability or produces genuinely harmful content, and only ever with your agreement.

Speak with an Expert

AI Security Testing vs Standard Application Testing

CyberLab AI Security Testing Recognised under CREST's Security Testing of AI scheme Standard Application Testing Conventional penetration testing
Target LLM and ML applications, AI agents, RAG pipelines and model integrations Web apps, APIs, cloud infrastructure and endpoints
Attack Surface Model behaviour, system prompts, connected tools, embeddings and downstream output handling Application code, configuration and known vulnerability classes
Determinism Non-deterministic. Behaviour-led testing with repeated and varied adversarial probing Deterministic. Reproducible, repeatable pass or fail results
Approach Adversarial prompting and manual analysis, mapped to the OWASP Top 10 for LLM Applications Automated scanning combined with manual exploitation
Key Risks Prompt injection, sensitive data leakage, excessive agency and denial of wallet Injection flaws, authentication weaknesses and misconfiguration
Standards OWASP Top 10 for LLM Applications, ETSI EN 304 223, NCSC secure AI development guidelines OWASP Top 10, CREST, CHECK, PCI DSS, ISO 27001
Consultants Recognised under CREST's Security Testing of AI scheme, with CREST and CHECK accredited testers holding AI and application security experience CREST or CHECK accredited penetration tester

CyberLab is accredited to the CREST Security Testing of AI standard, and holds CREST and CHECK accreditation for security testing.

How Does CyberLab's AI Security Testing Work?

1

Scoping & Primary Security Concerns

Every engagement starts with a detailed scoping conversation. We work with your team to understand the AI systems in scope, the model types and user roles involved, and the specific questions you need answered. Where a third-party hosted model is involved, we review and agree its acceptable use policy and terms of service with you before testing starts.

2

Application & Architecture Mapping

Using a proxy that records every request and response, our consultants map the AI components in scope, the data flows between the application, the model and its tools, the authentication and authorisation boundaries, and the functions the model can call.

3

Adversarial & Technical Testing

We work systematically through the OWASP Top 10 for LLM Applications, combining automated technique with extensive manual adversarial testing, all under strict rate and cost controls.

4

Manual Review & Exploitation

We assess the AI-specific configuration and governance controls against industry benchmarks and, with your permission, carry out controlled exploitation of confirmed issues to demonstrate their real-world impact.

5

Reporting & Remediation Guidance

You receive a clear, jargon-free report covering every finding, its potential impact, a severity rating and specific remediation guidance. Our consultants walk your team through the report and support your remediation planning.

Get Started

What Powers Our Testing

CyberLab is approved for Anthropic’s Cyber Verification Program, which gives independently verified security organisations access to Claude models for defensive work that the publicly available versions block by default.

Our consultants use that access for malware analysis, validating whether a vulnerability is genuinely exploitable, and speeding up incident response. Approval followed Anthropic’s review of our identity, our security controls and our intended use, and we remain subject to the programme’s ongoing controls.

The tools do not change our methods, our judgement or our accountability. AI shortens the investigation. A qualified consultant checks every finding before it reaches you.

Speak with an Expert

Which Standards and Regulations Does AI Security Testing Support?

1

OWASP Top 10 for LLM Applications

Maintained by the OWASP GenAI Security Project and the shared vocabulary for AI application security. Our testing methodology maps to it directly, so findings arrive in language your developers already use.

2

ETSI EN 304 223

The first European Standard dedicated to AI cyber security. It grew out of the UK Government's AI Cyber Security Code of Practice, published by DSIT with the NCSC in January 2025, which set out thirteen principles across the AI lifecycle. Testing evidences the provisions covering secure design, deployment and maintenance.

3

NCSC Guidelines for Secure AI System Development

The NCSC identifies prompt injection and data poisoning as vulnerability classes specific to AI systems. Our testing looks for both.

4

ISO/IEC 42001

The management system standard for AI. Independent security testing supports the risk assessment and operational control requirements.

5

EU AI Act

For organisations placing AI systems on the EU market, testing evidence supports the accuracy, robustness and cyber security obligations.

Get Started

Is It Safe to Test AI on Live Systems?

Yes. AI testing should never cost you your service or your data, and we build that into every engagement:

  • All testing runs under rate-limited, cost-controlled requests, so it is safe to conduct on live systems with users present, with no expected impact on your service.
  • Wherever possible we test against a non-production or staging instance, to avoid contaminating your production conversation history, RAG knowledge bases or fine-tuning datasets.
  • Adversarial techniques can occasionally elicit harmful or objectionable output. Any such output is treated as sensitive evidence, redacted in reporting wherever possible, and destroyed on completion of the engagement in line with your agreement.
Speak with an Expert

Meet The Security Testing Team

TALES FROM THE CYBERLAB

Episode 14 | Life as an Ethical Hacker Explained

with Tom Unsworth, Security Consultant at CyberLab

What does life as an ethical hacker really look like in 2026? In this episode of Tales from the CyberLab, Adam Myers and Tom Unsworth break down modern penetration testing, from uncovering hidden vulnerabilities to managing third party risk, real world attack techniques, and how strong teamwork delivers meaningful security outcomes.

Watch Now

TALES FROM THE CYBERLAB

Episode 21 | Hacking Critical Infrastructure Explained

with Steve Clarke, Head of Penetration Testing at CyberLab

What happens when cyber attacks hit the systems that keep society running? In this episode of Tales from the CyberLab, Adam Myers and Steve Clarke explore hacking Critical National Infrastructure, from OT realities to real world pen testing lessons, legacy risks and why resilience matters when downtime is not an option.

Watch Now

AI Security Testing: FAQ's

What is AI security testing?

AI security testing is a specialist assessment of applications built on artificial intelligence, including chatbots, copilots, AI agents and RAG applications, and the large language models behind them. It finds risks conventional penetration testing does not look for, such as prompt injection, data leakage and model manipulation. CyberLab's testing is aligned to the OWASP Top 10 for LLM Applications and delivered by a team recognised under CREST's Security Testing of AI scheme.

How is AI security testing different from standard penetration testing?

AI systems are non-deterministic, so security lives in how the model behaves rather than in a fixed piece of code, and it cannot be reduced to a checklist. The attack surface extends past the model to its system prompt, connected tools, vector stores and every system its output reaches. Testing it properly takes specialist expertise, recognised methodology and adversarial testing by hand.

Which AI systems can you test?

We test chatbots and conversational interfaces, copilots and AI-assisted features, AI agents and agentic systems, RAG pipelines and vector stores, and custom or fine-tuned models. That covers applications built on third-party hosted models, self-hosted or open-weight models, and models fine-tuned on your own data.

Do we need AI security testing if we only use Microsoft Copilot or ChatGPT?

If you use these tools as they come, your risk sits mainly in configuration and data access, which our Microsoft 365 Security Assessment covers. AI security testing becomes relevant once you build something: a custom copilot, an agent with access to your systems, a chatbot on your website, or anything connected to your own data. If your AI can be reached by a user and can act or answer on your behalf, it needs testing.

Do you test third-party hosted models like OpenAI or Anthropic?

Yes. Testing an application built on a hosted model is governed by that provider's acceptable use policy and terms of service, which we review and agree with you before testing begins, so the engagement is both effective and compliant.

Is it safe to run AI security testing on live systems?

Yes. All testing runs under rate-limited, cost-controlled requests, so it can be carried out on live systems with users present and no expected disruption. Wherever possible we test against a non-production or staging instance to avoid contaminating your production conversation history, knowledge bases or training data.

Is CyberLab accredited to test AI systems?

Yes. CyberLab is recognised under CREST's Security Testing of AI scheme, launched in August 2026 as the independent benchmark for providers testing generative AI and LLM-enabled systems, and is among the first cohort of organisations worldwide to achieve it. It assesses practitioner competence, methodology, governance and technical approach, and sits alongside our existing CREST and CHECK accreditations.

Does CyberLab use AI to deliver its testing?

Yes, for specific tasks. We are approved for Anthropic's Cyber Verification Program, which lets verified security organisations use Claude models for defensive work. Our consultants use it for malware analysis, vulnerability validation and incident response, where it shortens investigation time. It does not replace the tester. Every finding is reviewed by a qualified consultant before it reaches you.

What standards does your AI testing align to?

Our methodology is aligned to the OWASP Top 10 for LLM Applications and delivered by a team recognised under CREST's Security Testing of AI scheme. Testing also supports the provisions in ETSI EN 304 223 and the UK Government's AI Cyber Security Code of Practice, and the vulnerability classes identified in the NCSC's guidelines for secure AI system development.

How long does an AI security test take?

Timescales depend on the number of AI systems in scope, the model types involved and how many tools or data sources the model can reach. A single well-scoped chatbot is a short engagement. An agentic system with multiple tool integrations and a RAG pipeline takes longer. We always scope first so you have an accurate timeline before work begins.

How much does AI security testing cost?

Cost depends on scope: the number of AI systems, the user roles to be tested and the complexity of the tools and data behind the model. We quote after a scoping conversation rather than from a price list, so the figure reflects the work needed rather than an average. Get in touch and we will scope it with you.

What is the difference between AI security testing and AI red teaming?

AI security testing works systematically through a recognised methodology to find and evidence vulnerabilities across the whole AI system. AI red teaming is objective-led, taking a specific goal such as extracting a particular dataset and pursuing it however it can be reached. Most organisations should start with testing, then red team once the obvious issues are closed.

What do we receive at the end?

You receive a report covering every finding, its potential impact, a severity rating and specific remediation guidance, written to be read by both your developers and your board. Our consultants are available to walk your team through the findings and support remediation planning.

CREST, CHECK & Cyber Scheme Certified

CREST (the Council of Registered Ethical Security Testers) is an international accreditation with a strict Codes of Conduct and Ethics. CHECK is the Government-backed accreditation from the National Cyber Security Centre (NCSC) which certifies that a company can conduct authorised penetration tests of public sector systems and networks.

All our penetration testers are certified by CREST, with senior consultants certified by CREST to the highest CCT Level. Our testers are also either CHECK Team Leaders (CTL’s) or Team Members (CTM’s).

Security testers that pass the Cyber Scheme exams demonstrate ‘competence and skill at the highest levels’ as defined by the National Technical Authority for Cyber Security (NCSC).

Our team have decades of combined experience and take pride in operating at the highest level of the industry – conducting a broad range of government and commercial tests – and always aim to go the extra mile.

CyberLab-Certifications-Square







    By submitting this form you agree for your information to be processed in accordance with the CyberLab Privacy Notice.

    Speak With an Expert

    Enter your details and one of our experts will be in touch.

    Whether you’re looking to implement basic cyber security best practice, improve your existing defences, or introduce a new system or solution, our team of expert consultants, engineers, and ethical hackers are here to help.

    Our team specialise in creating bespoke security solutions and testing packages to improve and maintain your security posture.

    We are 100% vendor agnostic and will only ever recommend the best products and solutions for your requirements.

    This page was reviewed by Steve Clarke, Head of Penetration Testing at CyberLab, on 11.05.26.