Questions, answered

Permission testing verifies that an AI system — a chatbot, copilot or autonomous agent — only performs actions and only exposes data that it is explicitly allowed to. Unlike classic penetration testing, which targets infrastructure, permission testing targets the model's behaviour: can it be talked, tricked or injected into overstepping its authority?

A pentest checks servers, networks and code. Permission testing checks decisions. Your infrastructure can be perfectly secure while your agent still refunds every customer who asks nicely in three languages. Both matter; they answer different questions.

Any system built on LLMs that can take actions or access data: customer-support bots, internal copilots, RAG pipelines, coding agents, and multi-agent workflows. We are model-agnostic — OpenAI, Anthropic, Google, open-weight or self-hosted.

No. All tests run against staging or sandboxed environments. Destructive actions (payments, deletions, messages) are always simulated — we prove they would have happened without letting them happen.

Execution traces (prompts, tool calls, responses) from the test environment, kept for 90 days on Team plans and per contract on Enterprise. We never store production user data. All data is hosted in the EU.

No source code, ever. We need API access to a test environment and, where relevant, a test account with standard user permissions — the same starting point an attacker would have.

Yes. Enterprise reports map findings to EU AI Act risk-management requirements and ISO/IEC 42001 controls, giving your compliance team auditable evidence that AI system behaviour is tested and monitored.

Findings ranked by exploitability and blast radius, each with the full execution trace that proves it, affected components, and concrete remediation steps. Reports are delivered as PDF plus a machine-readable JSON export for your ticketing system.

Yes — re-tests of remediated findings are included in every plan. On Team and Enterprise, regression testing runs automatically with each new release you ship.

The free audit is delivered within 48 hours of receiving access to your test environment. Full Team-plan onboarding — including CI/CD integration — typically takes under a week.

A test environment, a short description of what the AI system is allowed to do, and 30 minutes with someone who knows the system. We handle the rest.