TENTAMENten-TAH-men
AI Red-Team Assessment
Tentamen is Latin for an attempt or a test. We attempt what an attacker would against your AI system, under written authorization, and report exactly what worked.
Your AI system tested the way an attacker would, then retested after you fix it.
From $7,500, set by the system’s size and the depth agreed at scoping. One retest of fixed findings is included.
Testing happens only under a signed authorization and rules of engagement. The report covers what was tested; it cannot show a system has no weaknesses.
Is this for you?
- Companies shipping a chatbot, AI agent, or AI feature to customers
- Teams whose AI system can read sensitive data or take actions in other systems
- Product and security leads who need evidence of testing before launch or for a customer review
The problem
AI systems fail in ways ordinary testing misses.
A chatbot or AI agent follows instructions in the text it reads. A customer message, an uploaded document, or a web page can carry instructions that steer it to reveal data, ignore its rules, or take an action it should not.
Functional QA checks that the system does what it should. It rarely checks what the system can be talked into doing.
How we work
Attempt what an attacker would, within signed rules.
We start with scoping and a rules-of-engagement document you sign: the system, the environment, the techniques, the limits, and the contacts. Testing is time-boxed and usually runs in staging.
We test for prompt injection, direct and indirect; leakage of data and system instructions; jailbreaks of safety rules; unsafe tool use and actions; and abuse of cost and rate limits. Every finding is checked by a second engineer, and fixed findings are retested.
What we test
Typical AI systems in scope.
Common systems, whichever model provider they use.
- Support
Customer-facing chatbots
Leakage, jailbreaks, and off-policy answers to customers.
- Internal
Assistants over company data
Access beyond what the user should see.
- Agents
AI agents with tools
Unsafe actions triggered by injected instructions.
- Documents
Document and email processing
Instructions hidden in files the system reads.
- Products
AI features in products
Abuse paths through the feature into your platform.
- Cost
Usage and cost abuse
Ways to run up model costs or exhaust limits.
What you receive
Scoping and rules of engagement
What is in scope, which environment, which techniques, and who to call, signed before testing starts.
Adversarial testing
Prompt injection, direct and through documents or web content; data leakage; jailbreaks; unsafe tool use and actions; and abuse of cost or rate limits.
A findings report
Each finding with severity, reproduction steps, evidence, and a specific fix, plus an executive summary.
A retest
After you fix the findings, we retest them and issue an updated report.
How it works
Scope
A scoping call and a written rules-of-engagement document, signed by you.
Test
A time-boxed test in the agreed environment, with daily contact during testing.
Report
The findings report and a readout with your engineers.
Retest
One retest of fixed findings, and an updated report.
Test areas
What an assessment covers.
| Area | The question it answers |
|---|---|
| Prompt injection | Can text the system reads override its instructions? |
| Data leakage | Can it be made to reveal data or its own system instructions? |
| Jailbreaks | Can its safety and policy rules be bypassed? |
| Unsafe actions | Can it be steered to take actions it should not? |
| Access boundaries | Can one user reach another user’s data through it? |
| Cost and abuse | Can it be used to run up costs or degrade service? |
The areas tested are set in the rules of engagement for each system.
The report
Findings your engineers can reproduce.
Every finding is checked by a second engineer before it reaches you.
- Severity
- Each finding rated by likelihood and impact.
- Reproduction
- Steps and evidence your engineers can repeat.
- Fix
- A specific, proportionate fix for each finding.
- Retest result
- The status of each finding after your fixes.
Common concerns
What leaders ask before they sign.
- Authorization
- Nothing is tested before you sign the rules of engagement.
- Production
- Staging by default; production only with written approval and limits.
- Third parties
- Testing stays within your systems; model providers’ own platforms are out of scope.
- Limits
- The report covers what was tested. It cannot show a system has no weaknesses.
Who does what
Who authorizes, who tests, and who fixes.
Your team
- Sign the authorization
- Provide the test environment
- Fix findings
- Decide on remaining risk
Custos
- Scope and write the rules
- Run the test
- Review and report findings
- Retest fixes
Afterward
Where clients go next.
Most take one of these routes. You choose, and nothing starts without your approval.
Keep retesting
Monitoring adds quarterly retests as prompts and models change.
Review staff AI use
The shadow AI review covers the other track.
Before you start
What to have ready.
- What the system does and who uses it
- The data it can read and the actions it can take
- A staging environment and test accounts
- Your launch or review date
Related services
Who does what
You authorize the test. We run it within the rules.
Every finding is checked by a second engineer before it reaches you.
- Your system ownerAuthorizes testing, approves the scope, and decides what to fix and when.
- Your engineersProvide the test environment and fix findings. They join the readout.
- Custos testerA Sophrono engineer who builds AI systems, running the adversarial test within the agreed rules.
- Custos reviewerA second engineer who checks every finding before the report goes out.
What the rules of engagement set out
Scope, methods, and contacts, signed first.
- Testing starts only after you sign the authorization and rules of engagement.
- The report lists every technique attempted, every finding, and its evidence.
- Each finding has a severity rating and a specific fix.
- One retest of fixed findings is included, with an updated report.
Scope a red-team assessment
Tell us about the AI system.
We reply with scoping questions and a draft rules-of-engagement document. Nothing is tested until you sign it.
- An engineer reads every request
- A reply by email within two business days of receipt
- No obligation until scope and price are agreed
Not ready to scope this? Ask a security engineer first: a free 20-minute call on where your AI risk is.
Where this fits
- Ask Ask a security engineer
- Test AI Red-Team Assessment
- Monitor AI Security Monitoring
Not ready yet? Ask a security engineer. After this: AI Security Monitoring.
Questions
Do you test production systems?
We prefer a staging environment that mirrors production. Production testing is possible only with explicit written approval and agreed limits.
Which AI systems can you test?
Chatbots, retrieval-based assistants, AI agents that use tools, and AI features inside products, whichever model provider they use.
Is this a penetration test of our whole application?
No. It focuses on the AI components and how they connect to data and actions. A full application penetration test is a separate engagement.
Do you test whether the AI does its job well?
No. The assessment covers security: what an attacker could make the system do. Sophrono’s Agent Assurance (sophrono.com) checks that an agent does its job and stays within its approvals.