How is this different from a standard penetration test?

A conventional pentest treats the application as the system under test and the model as an opaque dependency. We treat the model, its context window, its tools, and its infrastructure as one system — because an attacker does. Findings that only appear when you chain a prompt-level trick to a cloud-level misconfiguration are the ones that get missed by teams that only own one half.

Do you need access to model weights?

No. Most engagements are black- or grey-box against a deployed endpoint, which is the attacker’s actual vantage point. Weight access, training data, or fine-tuning history helps for alignment evaluation and lets us reason about why a behaviour occurs rather than only that it does — but it is never a precondition.

Will testing damage production or pollute our data?

Scope, rate limits, and data handling are agreed in writing before anything runs, and we default to a staging environment mirroring production configuration. Where production is genuinely the only meaningful target, we agree explicit blast-radius limits and a rollback path first. Any data encountered is handled under the engagement’s NDA and destroyed on completion.

What do we actually receive?

A written report with reproducible proof-of-concept for every finding, severity rated against exploitability in your deployment rather than a generic scale, and remediation guidance specific to your stack. Plus the harness — the test cases become yours, so regression testing does not require hiring us again.

Do you publish what you find?

Never client work without written permission, and never with identifying detail. Novel techniques that are not client-specific may be written up generically for the research surface, always after remediation and always with the client’s sign-off on the wording.

Break it

AI Security

Adversarial testing for language models and the systems that let them act. We assess the whole deployment — the prompt, the index, the tools, and the cloud account underneath — because that is the surface an attacker actually gets.

Scope an engagement

Engagements from $14,000. Or start with the Exposure Review at $4,500.

Pricing status: confirmed. PinkCloud quotes from these figures.

Prices exclude any applicable tax.

What an engagement looks like

Scoped as fixed-window work with a written deliverable. No retainers you cannot exit, no findings held back for a follow-on sale.

LLM red team

2–4 weeks · adversarial

Structured adversarial testing against a deployed model or assistant. Prompt injection through every channel the system will accept text from — including the ones nobody counted as input, like filenames, retrieved documents, and tool output. Jailbreak chains, instruction hierarchy collapse, and refusal-boundary mapping under sustained pressure rather than single-shot probes.

Agentic system assessment

3–5 weeks · architecture + adversarial

For systems where the model can act: tool-use abuse, privilege inheritance through service accounts, confused-deputy paths between the agent and the APIs it fronts, and loop-level failures — retry amplification, poisoned memory, and cross-session state bleed. We read the IAM policy and the orchestration code, not just the transcripts.

RAG and retrieval review

2–3 weeks · targeted

Tenant isolation in embedding stores, indirect injection via ingested documents, extraction of source material through reconstruction attacks, and access-control drift between the source system and the index that mirrors it. The index usually inherits far weaker authorization than the database it was built from.

Alignment and safety evaluation

Scoped per model · evaluation

Independent evaluation of model behaviour against a stated policy: where refusals fail open, where they fail closed on legitimate use, and how both move under fine-tuning, system-prompt changes, or context pressure. Delivered as a reproducible harness you keep and re-run, not a one-off PDF.

Method

Single-shot probes prove very little.

Most published jailbreaks are one clever message. Real compromise is rarely one message — it is a position built over a conversation, or planted in a document the model will read next week, or assembled from three tool calls that are each individually permitted.

So testing is chained and stateful by default. We work the system the way someone with a motive and a fortnight would, and we report the path, not just the payload.

Map the input surface
Every channel that reaches the context window. Filenames, document bodies, tool responses, retrieved chunks, and user text — ranked by how little they are trusted today.
Establish baseline behaviour
What the system does when nothing is adversarial, so that deviation is measurable rather than anecdotal.
Chain and escalate
Compose findings. A weak injection plus an over-scoped tool plus a retry loop is a different severity than any of the three alone.
Hand over the harness
Test cases are delivered as runnable code against your endpoint, so the fix can be verified and the regression caught.

Order

AI Security Assessment

Two weeks of chained, stateful adversarial testing against a deployed model or assistant, delivered as a written report with a reproducible proof-of-concept for every finding and a harness you keep.

Two weeks at the published floor for the AI security practice. The floor covers up to 3 distinct systems, models or accounts; beyond that, each further block of up to 3 systems adds 10 percent, capped at 30 percent, and more than 12 systems needs a scoping call.

Two weeks buys the practice's shorter adversarial shapes, chosen at the scoping call: an LLM red team (the site scopes it at 2–4 weeks, adversarial) against a deployed model or assistant, or a RAG and retrieval review (2–3 weeks, targeted) against the retrieval path. We assess the deployment as one system — the prompt, the index, the tools and the cloud account underneath — because that is the surface an attacker actually gets.

Testing is chained and stateful rather than single-shot: prompt injection through every channel the system will accept text from, including filenames, retrieved documents and tool output; jailbreak chains, instruction-hierarchy collapse and refusal-boundary mapping under sustained pressure. In the retrieval shape that means tenant isolation in embedding stores, indirect injection via ingested documents, extraction of source material through reconstruction attacks, and access-control drift between the source system and the index that mirrors it. We report the path, not just the payload.

assessment

Two weeks of chained, stateful adversarial testing against a deployed model or assistant, delivered as a written report with a reproducible proof-of-concept for every finding and a harness you keep.

$14,000

2 weeks

140 hours at $100/hour

Pricing status: confirmed. PinkCloud quotes from these figures.

Prices exclude any applicable tax.

Deliverables

Input-surface map: every channel that reaches the context window, ranked by how little it is trusted today
A baseline of behaviour when nothing is adversarial, so deviation is measurable rather than anecdotal
A written report with a reproducible proof-of-concept for every finding
Severity rated against exploitability in your deployment rather than a generic scale
Remediation guidance specific to your stack
The harness: test cases delivered as runnable code against your endpoint, yours to keep and re-run
Scope, rate limits and data handling agreed in writing before anything runs

Exclusions

The practice's longer shapes: the Agentic system assessment (3–5 weeks) and the Alignment and safety evaluation (scoped per model), which are quoted as engagements at a weekly rate
A compliance certificate or an audit opinion: if nobody intends to act on the findings, a larger firm with an audit practice will serve you better and cost less
Compliance evidence deliverables: these add 10 percent to the floor
Testing a system that is not built yet: adversarial testing needs something to test, and at the whiteboard the useful conversation is an architecture review, which is AI Engineering
Staff augmentation: fixed-scope work with an end date, not two engineers embedded for six months
Incident response and on-call cover: we are not an incident-response retainer and we do not carry a pager; mid-incident you need an IR firm today and us afterwards
Implementing the remediation: the report carries remediation guidance, and building is the AI Engineering practice
On-site attendance: delivery is remote by default, and on-site work needs a scoping call
None of the above is a refusal: everything here has a route and a rate. Work outside this scope is quoted at our published hourly rate — as a change request during the engagement, or as a separate engagement afterwards — and is agreed in writing before it starts. The assessment itself is an agreed budget of 140 hours at that rate

Order

Questions we get asked

How is this different from a standard penetration test?: A conventional pentest treats the application as the system under test and the model as an opaque dependency. We treat the model, its context window, its tools, and its infrastructure as one system — because an attacker does. Findings that only appear when you chain a prompt-level trick to a cloud-level misconfiguration are the ones that get missed by teams that only own one half.
Do you need access to model weights?: No. Most engagements are black- or grey-box against a deployed endpoint, which is the attacker’s actual vantage point. Weight access, training data, or fine-tuning history helps for alignment evaluation and lets us reason about why a behaviour occurs rather than only that it does — but it is never a precondition.
Will testing damage production or pollute our data?: Scope, rate limits, and data handling are agreed in writing before anything runs, and we default to a staging environment mirroring production configuration. Where production is genuinely the only meaningful target, we agree explicit blast-radius limits and a rollback path first. Any data encountered is handled under the engagement’s NDA and destroyed on completion.
What do we actually receive?: A written report with reproducible proof-of-concept for every finding, severity rated against exploitability in your deployment rather than a generic scale, and remediation guidance specific to your stack. Plus the harness — the test cases become yours, so regression testing does not require hiring us again.
Do you publish what you find?: Never client work without written permission, and never with identifying detail. Novel techniques that are not client-specific may be written up generically for the research surface, always after remediation and always with the client’s sign-off on the wording.