Overview
Indian companies are shipping customer-service bots, lending assistants and internal copilots, often in several Indian languages at once. Guardrails tuned on English prompts can behave differently in Hindi, Gujarati or mixed-script input. We test how your AI feature handles hostile instructions, which personal data it can be talked into revealing and what its connected tools can be pushed to do. CERT-In's 2025 guidelines now list AI system audits as an audit type.
Large language models turn text into instructions, which erases the old boundary between data and code. A model cannot reliably tell your trusted prompt from a hostile one hidden in a document, a web page or a user message, so prompt injection is the central risk we test. We assess both direct injection, where a user manipulates the model, and indirect injection, where content the model retrieves carries an attacker's instructions into the conversation.
From there we follow the consequences through your architecture. Where a model draws on retrieval-augmented generation, we test whether it can be steered into surfacing documents or records the current user should never see. Where it can call tools, browse, run code or write to systems, we assess excessive agency: how much damage a manipulated model can do through the permissions you have granted it. We also check insecure output handling, where model responses flow unescaped into a browser, a shell or a downstream query.
Our work is strictly defensive. We identify weaknesses and show their impact with the minimum necessary evidence, clearly labelled as illustrative, and we never publish jailbreak recipes or attack payloads for reuse. Findings are mapped to the OWASP Top 10 for LLM Applications and translated into controls your team can apply: input and output boundaries, least-privilege tool design, retrieval scoping, and guardrails that fail safe.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Architecture reviewWe map prompts, data sources, tools and trust boundaries in your AI feature.
- Threat modellingWe identify where untrusted text can reach the model and what it can trigger.
- Manual testingTesters probe injection, leakage, agency and output handling against the live feature.
- Impact assessmentConfirmed weaknesses are shown with minimal, clearly labelled illustrative evidence.
- Report & debriefFindings map to the LLM Top 10 with defensive controls your team can apply.
What you receive
- Findings mapped to the OWASP Top 10 for LLM Applications
- Illustrative evidence of impact, no reusable payloads
- Assessment of tool and agent permission design
- Defensive control recommendations that fail safe
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP Top 10 for LLM Applications
- OWASP WSTG
- OWASP API Security Top 10
- NIST AI RMF
- MITRE ATLAS
- PTES
- CVSS v4.0
- DPDP Act 2023
- RBI IT Governance Direction 2023
Frequently asked questions
Can prompt injection ever be fully fixed?
Not by filtering alone. Because a model reads all text as potential instruction, the durable defence is architectural: limit what the model can do, scope what it can retrieve, and treat its output as untrusted. We test those boundaries and recommend controls that hold even when a prompt is manipulated.
Do you test models we did not build ourselves?
Yes. Most organisations use a hosted or open model and build features around it, so we focus on your application: the prompts, retrieval, tools and integrations you control. We assess how your design uses the model rather than the provider's internal training.
Is this testing safe to run against our AI feature?
Yes. The work is defensive and non-destructive. We agree boundaries first, avoid actions that would corrupt data or spam real users, and capture only the minimum evidence needed to prove a finding. We never release jailbreak techniques for reuse.
Do you quote in rupees, and is GST extra?
Yes to both. Proposals are fixed-price in INR, and 18% GST is added on the invoice. The figure covers testing, the report, a debrief call and a retest of the findings you fix.
Can this report go to our RBI or SEBI auditor?
Reports show scope, dates, method, CVSS-rated findings and closure status, which is what auditors normally look for. If a regulator or contract insists on a CERT-In empanelled auditor, note that we do not claim empanelment; raise it when we scope the work and you will get a clear yes or no on whether we can meet it.