AI Agent and LLM Security Assessment

Overview

When a custom application puts a large language model or an AI agent to work, the security questions change. What can the model read? What can the agent do on its own? What happens when someone asks it to do something it shouldn’t? This assessment answers those questions with a code-level review of how your application wires AI into its systems.

What This Assessment Covers

This assessment covers custom applications that use large language models or AI agents. Its focus is what the model or agent can reach and do: the data it can access, the permissions it runs with, the tools it can call, and how the application connects it to the rest of your systems.

Need something adjacent?

• For the rest of the application, beyond its AI features, see our application vulnerability assessment.
• To fix what we find, see our vulnerability management and remediation solutions.

How We Review It

We follow the model’s access through the code: which database accounts and API credentials it uses, what those accounts are allowed to do, what reaches the model from untrusted input, what the application does with the model’s output, and which actions an agent can take without a person approving them. Giving an AI agent read access to a production database is a good example of the kind of decision we review. See our article on protecting production SQL databases from AI agent query risks.

Standards

We map findings to the standard your organization follows, such as the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, the NIST AI Risk Management Framework, or ISO/IEC 42001. We agree on which during the scoping call.

Fixing What We Find

Findings are only useful if they get fixed. The controls that usually follow an assessment like this, such as limiting what data the model can reach, sandboxing the tools an agent can call, and requiring a person to approve high-impact actions, are remediation work. We can scope that work with you after the assessment, through our application maintenance and remediation program.

Languages and Frameworks

We review backend and frontend application code in whatever your application is built on. Authentication, authorization, input handling, and data access follow the same principles in every language, and the standards we assess against are language-neutral, so we bring the same rigor to a stack we haven't reviewed before. Our first Django audit and our first audit of a Java application on Tomcat were both in stacks that were new to us.

Applications we review include:

• Backend: Ruby on Rails, Python (Django, Flask, FastAPI), Java (Spring, and applications on Apache Tomcat, including legacy code), and JavaScript or TypeScript on Node.js
• Frontend: React, Angular, Vue, and other JavaScript or TypeScript applications
• APIs: REST and GraphQL
• Mobile: iOS and Android apps, assessed against OWASP MASVS

If your application is built on something else, ask us. We review that too.

AI-Assisted Review

With your authorization, we use AI assistance to conduct in-depth code reviews, which saves time and money. You decide where your code is processed: with our contracted U.S.-based AI providers, on offline models, or exclusively within your organization's own AI infrastructure. We can also review without AI assistance, which may increase the timeline and cost of the engagement.

We use AI assistance to audit code, not data. Before any AI is used, we analyze your repositories for secrets and other sensitive data, in the latest code and throughout the commit history, since a credential deleted from the code can still sit in an earlier commit. TruffleHog is one tool we use for this, and we use a variety of other tooling as each engagement requires.

We work within the frameworks this page describes, and when the code is available, we write unit tests that demonstrate each suspected shortcoming or exploit. At no time do we take the output of an AI model and present it as a finding. Our team reviews every finding thoroughly before it reaches your report.

What You Receive

• A findings report, with each finding tied to the risk or control it falls under in the agreed standard, its severity, and recommendations.
• An optional signed attestation or bridge letter from Frank Rietta, scoped to exactly what was assessed.

Not Authorized by OWASP

Please note that OWASP does not accredit or authorize specific companies to conduct assessments against the OWASP Top 10 for LLM Applications or the OWASP Top 10 for Agentic Applications. Our use of their mark on this page is for fair use only to clearly identify the standards that we follow. You are free to read and follow these standards on your own or use any consultant or contractor of your choice.

Frank Rietta is a life member of OWASP, believes strongly in their mission, and supports the local club organization.