Prompt injection testing
Adversarial testing of direct and indirect injection paths, including documents and web content, tool abuse and data leakage, with a retest after remediation.
Test an AI application- Standards
- ISO/IEC 42001 · NIST AI RMF
- Testing
- Adversarial, tool-aware
Why this matters now
AI is already in use inside most organisations, usually before governance catches up. Prompt injection testing gives you control without blocking work that is genuinely useful.
What the engagement covers
Each area below is a defined part of the engagement, with an owner, an output and a date.
Scope
A defensible boundary statement agreed before any control work begins.
Attack paths
Direct and indirect injection routes, including documents and web content.
Tool abuse
Attempts to make the system act beyond its intended authority.
Data leakage
Testing for exposure of system prompts, secrets and other users' data.
Mitigations
Specific, implementable fixes ranked by risk reduction.
Retest
Verification after remediation, with a comparison against the first run.
How the work runs
The same sequence on every engagement, so you know what happens next.
Inventory
Establish what AI is actually in use, including tools adopted without approval.
Assess
Evaluate each use case for security, privacy, legal and model risk.
Control
Apply proportionate controls: policy, access, logging, approval points and monitoring.
Test
Adversarial testing against the deployed system, including indirect injection paths.
Govern
Reporting, review and change control so governance keeps up with adoption.
What you get out of it
Adoption without blind spots
Useful AI work continues; the uncontrolled parts get controlled.
Standards alignment
Mapped to ISO/IEC 42001 and ISO/IEC 27001 so one programme serves both.
Tested, not assumed
Controls verified by adversarial testing against the live system.
Before you enquire
How quickly can this start?
Who actually does the work?
How is this priced?
Where to go next
Test an AI application
One scoping call with the consultant who would run the work. No obligation, no charge.