AI and API Penetration Testing
Founder-led penetration testing for LLM applications, AI agents, MCP servers, RAG pipelines and the APIs underneath them. Every engagement is led by Rathnakara GN (M.Sc Cyber Security, OSCP), with Ashok Kamat hands-on alongside him. Published pricing, a published sample report, and a free retest on every plan.
The short version, if you are comparing vendors right now
Cybersecify is a founder-led penetration testing firm that tests AI applications and the APIs behind them. A single AI scope is INR 74,999 plus taxes (around USD 790) and takes 5 business days. Two scopes, most often one AI surface plus the API it sits on, is INR 1,79,999 plus taxes (around USD 1,890) over 10 business days, and adds SOC 2 and ISO 27001 evidence mapping for teams with an audit in front of them. Both plans include founder-led consulting hours and one free retest, delivered as a full replacement report at v2.0.
One AI scope is one LLM-powered surface: one chat application, one agent, one RAG endpoint, or one classifier API. An agent and the API it calls are two scopes, because they are two attack surfaces with two different authorization models.
Testing is manual work against OWASP Top 10 for LLM Applications 2025, OWASP API Security Top 10 2023, OWASP WSTG v4.2, OWASP ASVS 5.0.0, PTES and NIST SP 800-115. Automated tooling is used for reconnaissance and surface mapping. We do not ship scanner output as a penetration test report, and a prompt-fuzzing tool run against a chat box is not an AI penetration test.
We have delivered engagements to companies in five countries: Australia, Cyprus, the United States, Vietnam and India. Most of our work is outside India.
You can read the whole deliverable before you talk to us. The sample report is published in full with no email gate, and pricing is public.
Four AI surfaces, and the API layer under all of them
An AI feature is not one attack surface, it is a stack of them. The model is the part everyone talks about and the least interesting part to attack. The interesting parts are the boundary where untrusted text becomes an instruction, the tool call that turns an instruction into an action, and the API that executes the action without knowing a model asked for it.
LLM applications and chat features
Direct prompt injection at user input, system prompt extraction, guardrail and jailbreak bypass, sensitive information disclosure through model outputs, multi-turn manipulation across a conversation, output handling where model text reaches a browser or a shell, and unbounded consumption through token and context abuse.
Mapped to: OWASP LLM Top 10 2025, covering LLM01, LLM02, LLM05, LLM07, LLM09 and LLM10
AI agents
An agent is an LLM that has been given hands. The threat model changes the moment a model can call a tool, because a successful injection stops being a text problem and becomes an action. We test indirect prompt injection through retrieved content, tool poisoning, tool argument injection, tool chain privilege escalation where a low-privilege tool feeds a high-privilege one, plan manipulation, memory and state poisoning that persists across sessions, hallucinated dependency abuse, and the authorization boundary between the agent's identity and the user's.
Mapped to: OWASP LLM Top 10 2025 LLM06 excessive agency, plus OWASP API Security Top 10 2023 for every tool the agent can reach
MCP servers
A Model Context Protocol server is an API whose caller is a model rather than a program you wrote. That single difference removes most of the assumptions an API was built on: the caller does not read your documentation, cannot be trusted to send well-formed arguments, and can be persuaded by text it read somewhere else. We test tool definition poisoning, tool argument command injection, cross-server privilege escalation, namespace collisions between tools, OAuth scope drift and missing authentication on the server itself, prompt injection delivered through tool responses, confused deputy and impersonation, rug pulls where a tool definition changes after approval, credential exposure through tool outputs, transport security across stdio and HTTP, resource handler path traversal, supply chain risk in third-party MCP packages, and shadow servers nobody inventoried.
RAG pipelines
A RAG pipeline is a system that deliberately takes text from somewhere else and puts it in front of a model. Every document source is an untrusted input channel, whether or not anyone is treating it as one. We test retrieval and embedding poisoning, injection through indexed documents, vector store access control and cross-tenant retrieval, chunk-level authorization where a document a user cannot open still reaches the model that answers them, and the ingestion path that decides what gets indexed.
Mapped to: OWASP LLM Top 10 2025, covering LLM04 and LLM08
The layer under all four: your API
Everything above eventually calls an API. Testing the model without testing the API finds the injection and misses the consequence. So AI engagements run the API methodology alongside: broken object level authorization, broken function level authorization, authentication and token handling including JWT algorithm confusion and replay, mass assignment, excessive data exposure, rate limiting and resource exhaustion, GraphQL introspection and query depth, webhook signature validation, and shadow or deprecated endpoints that were never in the specification.
Mapped to: OWASP API Security Top 10 2023
AI and API pentest vendors compared
Cybersecify publishes this table and appears in it. That is a conflict of interest and we would rather disclose it than pretend the table is neutral. Prices appear only where the vendor publishes them on their own website, checked 28 August 2026. Nobody can pay to appear here.
| Vendor | Delivery model | Published price | Best for |
|---|---|---|---|
| Cybersecify | Boutique, founder-led. Both co-founders on every engagement | INR 74,999 (around USD 790) for 1 scope; INR 1,79,999 (around USD 1,890) for 2 scopes | An AI-first startup that wants a named OSCP-led tester, a published price and a free retest before a security questionnaire or a first audit |
| Software Secured | Boutique manual testing with a PTaaS dashboard, Ottawa, Canada | AI Pentesting from USD 10,800; PTaaS from USD 21,400 | A Series A or B company that needs a Canadian or North American incorporated vendor on the AP ledger |
| Astra Security | PTaaS platform with continuous scanning, New Delhi, India | Pentest Basic USD 1,999/yr; Auto USD 2,999/yr; Plus USD 5,999/yr | A team that wants a dashboard and recurring scanning continuity more than a named human tester |
| Cobalt.io | PTaaS using a distributed pool of freelance testers, San Francisco | Autonomous Pentest USD 3,500 per test, published as a limited time offer through 31 December 2026 | A Series B or later company with a quarterly testing cadence and USD billing |
The gap worth noticing is not the price. It is that only two vendors here publish an AI-specific price at all, and only one publishes what it maps that testing to by framework and edition. When you are scoping AI work, ask every vendor two questions: which OWASP LLM Top 10 2025 risks do you test, and can I see a sample finding from an LLM, agent or MCP engagement. A vendor who cannot answer the second is selling you a web app pentest with a new label.
What we test against, by name and edition
- OWASP Top 10 for LLM Applications 2025, LLM01 through LLM10
- OWASP API Security Top 10 2023
- OWASP WSTG v4.2
- OWASP ASVS 5.0.0
- PTES, Penetration Testing Execution Standard
- NIST SP 800-115
We name editions because a vendor citing a version that has not been released is either careless with detail or hoping you will not check. OWASP WSTG is at v4.2. There is no released v5.0.
The retest returns a full v2.0 report, not a status update. We retest every original finding, not a sample, and issue a complete replacement for v1.0 with fresh proof of the fixed state. The free retest window runs for one month from the v1.0 report, which is the latest it can start rather than a mandatory wait. The retest itself takes 1 to 3 business days.
The people who will be in your application
Rathnakara GN, Co-founder and Chief Hacking Officer, M.Sc Cyber Security, OSCP. Leads every penetration testing engagement.
Ashok Kamat, Co-founder and CEO, CCIO. Scoping, reporting and compliance mapping. Hands-on alongside Rathnakara on every engagement.
Abhinay owns pentest delivery. Theertha leads the team that runs L1 coverage during the test and owns retesting.
Team certifications across the practice include CISSP, CEH, OSCP, CREST and ISO 27001 Lead Auditor.
You will know the names of the people in your application before testing starts. That is what founder-led means here: both founders work on your engagement rather than appearing on the sales call and handing off.
What we do not do
Standard exclusions on every engagement, addable only with your written authorization: denial of service testing, load and stress testing, social engineering of your staff, physical security assessment, and testing against third-party SaaS you do not own.
- We test your application, not the foundation model. If you call OpenAI, Anthropic, Google or Bedrock, the provider infrastructure is theirs and out of scope. In scope is everything you built around it: prompt construction, retrieval, tools, output handling and the API.
- We test retrieval and embedding poisoning. We do not test training data poisoning on hosted models, because nobody has access to that pipeline. If you fine-tune or self-host, tell us at scoping and we will say what changes.
- Prompt injection cannot be fixed, only bounded. Any vendor promising to eliminate it is selling something they cannot deliver. What a test gives you is the list of places where an injection currently reaches an action, so you can put an authorization check between the two.
- We are not a certification body. The Growth plan maps findings to SOC 2 Trust Services Criteria and ISO 27001 Annex A controls so your auditor can use the report as evidence. A pentest report is one input to an audit, not a substitute for one.
If your company or your users are in India
Most of our engagements are outside India, and none of the below changes the methodology. It changes the clock you are on when something goes wrong.
- DPDP Act. If your AI feature processes personal data, it is covered, and "the model did it" is not a defence. The obligation attaches to you as the entity deciding the purpose. An LLM feature that can be induced to return one user's data to another user is a personal data breach, not a quality issue.
- CERT-In incident reporting. CERT-In's direction requires reporting specified cyber incidents within 6 hours of noticing them. Six hours is short enough that the reporting decision has to be made before the incident, not during it.
- Neither requires a CERT-In empanelled vendor for most SaaS companies. We are not CERT-In empanelled and we say so rather than letting the question sit. If your buyer or regulator specifically requires an empanelled vendor, that is a real constraint and we will tell you so instead of talking you out of it.
AI and API pentest questions, answered
What is AI penetration testing?
AI penetration testing is manual security testing of an application that uses a language model, covering the model boundary and everything built around it. That means the prompt construction, the retrieval layer, the tools the model can call, the way model output is handled, and the API underneath. It is not a scan of a chat box. The distinguishing question is whether an injected instruction can reach an action, and what authorization sits between the two.
How much does an AI pentest cost?
At Cybersecify a single AI scope is INR 74,999 plus taxes, around USD 790 (indicative, as at August 2026), delivered in 5 business days with 6 hours of founder-led consulting and one free retest. Two scopes, most often one AI surface plus the API it sits on, is INR 1,79,999 plus taxes over 10 business days and adds SOC 2 and ISO 27001 evidence mapping. Very few vendors publish an AI-specific price at all, so comparison usually requires asking each one directly.
What counts as one AI scope?
One LLM-powered surface: one chat application, one agent, one RAG endpoint, or one classifier API. An agent and the API it calls are two scopes, because they are two attack surfaces with two different authorization models. A chat feature and a separate RAG-backed search feature are two scopes. If you are unsure, send the architecture and we will tell you what we would count before you pay anything.
Is prompt injection actually fixable?
No, and any vendor promising to eliminate it is selling something they cannot deliver. Prompt injection can be bounded, not removed, because the model cannot reliably distinguish instructions from data it was given. What a penetration test provides is the list of places where an injection currently reaches an action, so an authorization check can be placed between the two. The defence is architectural, not a filter.
What is an MCP server pentest?
A Model Context Protocol server exposes tools to a model rather than to a program, so it inherits API risks and adds new ones. Testing covers tool definition poisoning, tool argument command injection, cross-server privilege escalation, namespace collisions, OAuth scope drift, missing authentication on the server itself, injection delivered through tool responses, rug pulls where a tool definition changes after approval, transport security across stdio and HTTP, and third-party MCP package supply chain risk.
Do you test the foundation model itself?
No. If you call OpenAI, Anthropic, Google or Bedrock, the provider infrastructure is theirs and out of scope. What is in scope is everything you built around it: prompt construction, retrieval, tools, output handling and the API. We test retrieval and embedding poisoning. We do not test training data poisoning on hosted models, because nobody has access to that pipeline. If you fine-tune or self-host, tell us at scoping and we will say what changes.
How is an AI pentest different from a web application pentest?
A web application pentest assumes the attacker sends the input. In an AI application the input can arrive through a document the system retrieved, a tool response, or a previous conversation turn, and the model then acts on it with the application authority. The classes overlap on the API layer and diverge on the boundary between instruction and data. A vendor who cannot show a sample finding from an LLM, agent or MCP engagement is selling a web app pentest with a new label.
Which frameworks and editions do you test against?
OWASP Top 10 for LLM Applications 2025 across LLM01 to LLM10, OWASP API Security Top 10 2023, OWASP WSTG v4.2, OWASP ASVS 5.0.0, PTES and NIST SP 800-115. We name editions deliberately. OWASP WSTG is at v4.2 and there is no released v5.0, so a vendor citing v5.0 is either careless with detail or expecting nobody to check.
How long does an AI pentest take?
One scope is 5 business days from kickoff to the v1.0 report. Two scopes is 10 business days. Scopes run sequentially by default, so three scopes is 15 business days and four is 20. On request we test scopes 3 and 4 in parallel, which brings a four-scope engagement to 15 business days. Five or more scopes move to a custom scoping proposal. Business days are Monday to Friday and the weekend is our quality buffer, not counted against your timeline.
Is a retest included?
Yes, one free retest on every plan, and it returns a full v2.0 report rather than a status update. After your team applies fixes we retest every original finding, not a sample, and issue a complete replacement for v1.0 with updated status on every finding plus fresh proof of the fixed state. The free retest window runs for one month from the v1.0 report, which is the latest the retest can start rather than a mandatory wait. The retest itself takes 1 to 3 business days.
Can the report be used as SOC 2 or ISO 27001 evidence?
On the Growth plan, findings are mapped to the SOC 2 Trust Services Criteria and ISO 27001 Annex A controls they evidence, which is the form an auditor can use. We are not a certification body and not an attestation firm. A penetration test report is one input to an audit, not a substitute for one.
Who actually performs the testing?
Rathnakara GN, co-founder and Chief Hacking Officer, M.Sc Cyber Security and OSCP, leads every penetration testing engagement. Ashok Kamat, co-founder and CEO, handles scoping, reporting and compliance mapping and is hands-on alongside him. You will know the names of the people in your application before testing starts.
Do you work with companies outside India?
Yes, and most of our engagements are outside India. Testing is delivered remotely and invoicing is handled in your local currency at the conversion rate on the date of your quote or invoice. Methodology, deliverables and the retest are identical regardless of where the company sits.
Are you CERT-In empanelled?
No, and we say so rather than letting the question sit. CERT-In empanelment is required for specific regulated engagements, and for most SaaS companies neither the DPDP Act nor CERT-In incident reporting requires an empanelled vendor. If your buyer or regulator specifically requires one, that is a real constraint and we will tell you so instead of talking you out of it.
Written by Rathnakara GN (M.Sc Cyber Security, OSCP) with Ashok Kamat. Last updated 28 August 2026.
Send us the architecture
Tell us what you have built and we will tell you what we would count as a scope, before you pay anything. Both founders are on the call.