Define the LLM application boundary

List the user-facing features, models, retrieval sources, memory stores, integrations, and tools in the proposed scope. Record which components you control and which belong to a provider. Include the model and application configuration versions that should appear in the report.

Write down what each role should be allowed to read or do. For a multi-tenant product, describe isolation and legitimate sharing between workspaces. This turns a general concern about AI into a reviewable set of security expectations.

Use OWASP LLM risks to organize coverage

The OWASP GenAI LLM Top 10 2026 provides a shared vocabulary for issues such as prompt injection, information disclosure, and excessive agency. The OWASP Agentic Applications Top 10 adds context for systems with tools, memory, and delegated work.

Use these references to discuss coverage, not as a promise of complete security. A report should identify the features examined and the limits of the work. The relevant question is what a failure would mean for your users, data, and approved actions.

Prepare controlled accounts, data, and actions

  • Provide representative accounts for each agreed role and tenant.
  • Use synthetic or suitably de-identified test data and approved retrieval sources.
  • Document the permitted tool actions and which actions require human approval.
  • Agree an environment, rate and cost limits, stop conditions, and escalation contacts.
  • Confirm provider terms, logging, evidence handling, and retention before testing.

Keep assessment activity within those agreed conditions. Do not send production credentials or customer data through a general enquiry form.

Ask for findings your engineers can act on

A useful finding explains the affected feature, prerequisites, observed impact, evidence, and the control that needs to change. It distinguishes a confirmed security consequence from an unexpected but harmless model response. Record configuration and version context so a later re-test can compare like with like.

Recommendations may concern application authorization, data filtering, tool permissions, approval design, or output handling. Our AI and LLM penetration testing service connects these findings to an agreed remediation and re-test plan.

Plan for changes after the assessment

A new tool, retrieval source, model, or permission can change the assumptions behind an earlier result. Keep the report with the version history and review significant changes. Decide which fixes need re-testing and which new features need a separate assessment.

Read how human validation fits AI-assisted testing and how to scope the surrounding web application and API before finalizing the brief.

All penetration testing guides | See a sample report | Discuss your scope