Skip to main content
PPenTesting.org

What to send a firm for an AI penetration test quote

A firm needs to know what the system can read, what it can do and who can use it before it can quote. Send the same description to every firm and the quotes can be compared line by line.

The system and how people reach it

  • What it does and who uses it: one or two sentences, and whether users are the public, customers or staff.
  • The model: the provider and model, or whether you fine-tuned or host your own, and how your application calls it.
  • Entry points: chat window, API, file upload, email, a browser or agent that visits pages, voice.
  • Roles: the kinds of account (anonymous, customer, staff, admin) and whether customers share data.
Describing the system and its entry pointsFour things to name: what it does; the model; entry points; user roles.The systemYour requestWhat it doesAnd who uses itThe modelProvider, fine-tuned or hostedEntry pointsChat, API, upload, email, agentRolesAnd whether customers sharedata

Instructions, data and tools

This is the part that is new compared with a normal test. The tester needs to know what the model is told, what it can read and what it can do.

  • Instructions: whether there is a system prompt, and whether the tester gets it.
  • Data it retrieves: each document store, search index or database, who can add to it, and whether it holds personal or confidential data.
  • Content from outside: web pages, emails or files from people you do not control that the system reads.
  • Tools and connections: every tool, plug-in, API or MCP server the model can call; for each, whether it only reads or can also send or change things, and whose permissions it uses.
  • Memory: whether it remembers anything between sessions or users.

The NCSC says “design protections need to focus more on deterministic (non-LLM) safeguards that constrain the actions of the system” (NCSC blog). A list of tools and permissions is what lets a firm test those safeguards.

What to say about instructions, data and toolsFive things to name: instructions; retrieved data; outside content; tools and connections; memory.What the model reads and doesYour requestInstructionsSystem prompt, shared or notRetrieved dataStores, editors, sensitivityOutside contentWeb, email, filesToolsRead or change, whosepermissionsMemoryBetween sessions or users

Limits, environment and the rules of the test

  • Environment: live, or a test copy, and how close the copy is to live in tools, permissions and data.
  • Things the system must not do during testing: send real email, move money, change production records, message real customers.
  • Cost and capacity: a spending or request limit, and any rate limits that could block the tester. Each request can cost money.
  • Test accounts: which roles the tester needs. Send logins only after you pick a firm.
  • Window and contact: dates, blackout periods, and who to call if something breaks.

The report you need, and the firm

  • Who will read it and why: a customer questionnaire, an insurer, your board or an audit. Ask for a short version you can share.
  • Findings tied to the OWASP Top 10 for LLM Applications 2025, if your reader uses it, with steps to repeat each one and the impact reached.
  • Whether a retest of fixed findings is included.
  • The firm’s evidence of AI testing work. CREST has two AI accreditations; here is the difference. A firm’s own list of services is not an accreditation.
From scope to quotesFour steps: write the scope once; send it to two or three firms; compare the answers; send test accounts only to the firm you choose.1WriteThe scopeonce2SendThe same to2-3 firms3CompareMethod, report,who tests4Then shareAccounts, afteryou choose
Keep passwords and test accounts out of the first email.

Next steps

Sources

Frequently asked

Should I send the system prompt with the request?

Say whether the tester will get it. Giving it lets the tester work from what the system is told; withholding it tests what an outsider could learn. Either is a valid choice, but the firm should know which you want before it quotes. Share the text itself only once you have chosen a firm.

Can I test the live system?

You can, but say so. Live testing needs care over what the system can do, such as sending email or changing records, and over cost per request. A test copy with the same tools, permissions and data shape is often safer; tell the firm how close it is to the live setup.

What if I use a model from a provider and do not run it myself?

List the provider and the model, and say how you call it. Read the provider’s terms on security testing before you start, and tell the firm what you find. The test still covers everything you build around the model.

Find firms that fit your test

Answer a few questions about what needs testing and why, and see matched firms with a link to each one’s contact page.

Match with firms