LLM Testing
Security testing for LLM-powered applications, AI agents, and copilot integrations, mapped to the OWASP LLM Top 10.
AI is no longer experimental, it is shipping in production at scale across customer support, internal copilots, agentic workflows, code generation, and decision-support tools. Every one of those deployments now sits in the attack surface. LLM-powered applications carry entirely new categories of risk that mainstream application security testing has never had to address: prompt injection, agent abuse, retrieval-augmented attack paths, data exfiltration through model output, and supply-chain compromise via untrusted model weights or training data.
The risk is structural, not incidental. An LLM accepts instructions from anyone whose text reaches the prompt, including attacker-controlled emails, documents, web pages, and tool outputs. Indirect prompt injection turns any of those inputs into a potential command channel. Where the LLM is wired into agents or tool-calling APIs, a successful injection is no longer just a data leak, it becomes operational compromise: sending email as the user, querying internal systems, modifying records, executing code.
Vantage Point's LLM Testing service covers the model itself, the surrounding application, the retrieval pipeline (RAG), and any agent or tool-calling layer. Coverage maps to the OWASP LLM Top 10, plus our own evolving test cases developed through internal R&D and CTF practice against AI systems.
AI changes what an attacker can do, not just how.
Prompt injection is now production-real
Indirect prompt injection via retrieved documents, emails, web pages, or pasted snippets is the default attack vector against LLM applications. Treating it as theoretical is no longer defensible.
Agents turn injection into impact
A chatbot that gets jailbroken leaks data. An agent that gets injected sends email, queries databases, deletes records, or executes code on the user's behalf. The same flaw class produces dramatically different outcomes.
AI inherits the data it was built on
Training data poisoning, leaked secrets baked into prompts, fine-tuning sets containing PII, and model weights pulled from untrusted registries all create persistent risk that traditional application testing never looked for.
Hallucination is a security control failure
When an LLM confidently produces wrong output that drives business decisions, executes tool calls, or generates code that ships to production, the gap between "AI demo" and "AI system" becomes a security problem.
The supply chain just got longer
Foundation models, plugins, vector stores, embedding services, third-party agents, each is a new dependency with its own update channel, its own trust boundary, and its own potential for compromise.
Regulators are catching up, fast
MAS Singapore AI risk guidance, CSA Singapore expectations, the EU AI Act, and emerging NIST AI guidance all set out testing and evidence requirements. Evidence-led security testing today gets ahead of where regulation is clearly moving.
What we test.
Coverage maps to the full OWASP LLM Top 10 (2025). Test scope is tailored to whether the system is a chatbot, a RAG-powered assistant, an agent with tool access, a code assistant, or a multi-agent workflow.
OWASP LLM Top 10 coverage
The complete OWASP Top 10 for LLM Applications, the published baseline for LLM application security testing.
- LLM01, Prompt Injection (direct and indirect)
- LLM02, Sensitive Information Disclosure
- LLM03, Supply Chain (models, plugins, datasets)
- LLM04, Data and Model Poisoning
- LLM05, Improper Output Handling
- LLM06, Excessive Agency
- LLM07, System Prompt Leakage
- LLM08, Vector and Embedding Weaknesses
- LLM09, Misinformation and Hallucination
- LLM10, Unbounded Consumption
Application & agent layer
How the model is wrapped, called, and given access to the rest of the system. Almost always where the highest-impact findings live.
- Application-layer wrappers and middleware
- Tool / function-calling abuse
- Agent autonomy and least-privilege boundaries
- Plugin and connector security
- Multi-agent / agent-to-agent attacks
- Output handling and downstream injection
RAG, data & supply chain
The data the model reads, the embeddings it searches, and the dependencies it ships with.
- Retrieval-augmented generation (RAG) attack paths
- Indirect prompt injection via retrieved content
- Embedding store poisoning
- Training / fine-tuning data exposure
- Foundation-model supply chain
- Plugin and tool registry trust
What LLM engagements consistently surface.
Drawn from common categories our consultants surface across engagements of this type. Severity and prevalence vary by environment and maturity.
Indirect prompt injection
Hidden instructions in retrieved documents, support tickets, emails, or web pages causing the LLM to ignore its system prompt, exfiltrate data, or call tools the user never requested.
Agent tool abuse
Agents with broader tool access than required, granting "send email" or "query database" to flows that should only read, allowing an injection to take destructive actions.
System prompt and secret leakage
System prompts containing API keys, internal URLs, or business logic recoverable through targeted queries or output-format manipulation.
Output handling failures
LLM output rendered as HTML without sanitisation enabling XSS; output passed to eval/exec; SQL generated from natural language without parameterisation.
Excessive data exposure
Vector stores returning chunks across tenant boundaries; document retrievers exposing internal PII because chunking ignored access control.
Unbounded consumption
No rate limit on expensive completions; no token budget per session; cost-amplification via crafted prompts that produce runaway agent loops.
A structured, intelligence-led path through every engagement.
Every engagement follows the same disciplined path through the Velocity platform, so quality, traceability, and reporting are consistent across teams.
Scoping
Define assets, environments, Rules of Engagement, and acceptance criteria with the technical and security stakeholders.
Execution
Manual and tool-assisted testing by CREST-accredited consultants, with evidence captured at each step.
Validation
Every finding is reproduced, risk-rated under CVSS, and confirmed by a second consultant before reporting.
Reporting
Cryptographically signed reports with test-case traceability, severity ratings, reproduction steps, and remediation guidance.
Debrief & Retest
Stakeholder walk-through of findings, prioritisation support, and a retest cycle on remediated issues.
Mapped to recognised baselines.
LLM Testing engagements map to the recognised AI security frameworks plus the underlying application security baselines that still apply when an AI system ships in production.
Reports built for audit, engineering, and executive review.
Every engagement produces verifiable, traceable, regulator-ready artefacts, generated by Velocity and signed cryptographically.
PDF · JSON · XML · CSV · Multi-Language Reporting Supported · CVSS 3.0 / 3.1 / 4.0
- Executive summary
- Technical findings report with OWASP LLM Top 10 mapping
- Reproducible prompts, payloads, and responses
- Agent action traces where in scope
- CVSS scoring and impact analysis
- Prioritised remediation recommendations
- Retesting on remediated findings
- Optional JSON / XML / CSV export for downstream tooling
Common buyer questions.
Do you only test the model, or the whole application? +
The whole application. Testing the model in isolation misses where most production risk actually lives, the application wrapper, retrieval pipeline, tool-calling layer, and downstream consumers of model output. Where you only need a focused model-only assessment we can scope that, but most engagements cover the full stack.
Can you test agentic systems and multi-agent workflows? +
Yes. Agent testing is a core part of the service, covering tool-calling abuse, autonomy-boundary violations, multi-agent coercion, and chained-injection scenarios where the model takes action on behalf of an attacker-controlled input.
What about RAG and vector store security? +
RAG-specific testing is included where applicable: indirect prompt injection via retrieved content, cross-tenant chunk leakage, embedding poisoning, and chunking strategies that bypass access controls.
Do you test code assistants and copilots? +
Yes. Code assistants raise specific risks, generated code containing CVEs, prompt injection via untrusted code or comments, secret leakage from training data, supply-chain exposure through suggested dependencies.
How do you test models we don't control (e.g. OpenAI, Anthropic, Google)? +
The model provider is in scope as a dependency, not a target. We assess how your application uses that provider, prompt construction, output handling, tool integration, data flow, rather than attempting to test the foundation model itself, which would breach provider terms of service.
Test your AI the way attackers will.
Whether you are launching a customer-facing LLM, an internal copilot, or a multi-agent workflow, Vantage Point can identify the OWASP LLM Top 10 categories that actually apply to your system and provide consultant-validated, audit-ready evidence.