Securing the Algorithms That Drive Business Decisions

AI and machine-learning systems support use cases including LLM chatbots, fraud detection, clinical workflows and automated decision-making. These systems introduce attack paths across models, prompts, training data, APIs, tools and third-party components.

NSI Global tests AI and ML systems for direct and indirect prompt injection, sensitive-information disclosure, excessive agency, insecure output handling, model extraction, inference attacks, data poisoning and supply-chain compromise. Findings document the affected component, reproduction evidence, likely impact and prioritised remediation.

Where applicable, testing is mapped to the OWASP GenAI LLM Top 10 2026 and MITRE ATLAS, with governance findings referenced to the NIST AI Risk Management Framework and its Generative AI Profile.

What We Assess

Model Exploitability

Test whether adversarial inputs can bypass controls, alter intended behaviour, expose protected information or trigger unauthorised actions.

LLM Security & Prompt Injection Testing

Test direct and indirect prompt injection, jailbreaks, retrieval-augmented generation inputs, system-prompt exposure and tool or plugin misuse.

Model Extraction & Inference Risks

Assess whether interfaces disclose model behaviour, membership, training data or proprietary outputs to a degree that could support reconstruction or imitation.

Testing for Data Poisoning & Supply Chain Threats

Review datasets, preprocessing and training pipelines, model repositories, libraries and third-party integrations for poisoning, tampering, provenance and dependency risks.

Risks Covered

Disclosure of sensitive prompts, data or system instructions
Manipulation of model behaviour or decision outputs
Unauthorised actions through connected tools or agents
Poisoning or tampering affecting training and inference
Weaknesses in model, dataset and dependency provenance

Where AI Risk Actually Sits

In most environments the model is not the weak point. The exposure is in what surrounds it: the prompts that reach it, the documents it retrieves, the tools it can call, the permissions those tools carry, and the third-party components in the pipeline. A model that can read a mailbox and send an email is an identity with privileges, and it should be assessed as one.

We test the integration as well as the model — what it can be made to do, what it can reach, and what it discloses when pushed.

Frequently Asked Questions

Can you test a model we did not build?

Yes. Most engagements involve third-party or hosted models reached through an API, where the risk sits in how the model is integrated — prompts, retrieval, tools and permissions — rather than in the model weights. We test the system around the model as well as the model itself.

What is prompt injection and why does it matter?

Prompt injection is when instructions reach a model through content it processes — a document, a web page, an email — and the model acts on them. It matters because a model with tool access can then take actions on an attacker's behalf. It is the first entry in the OWASP GenAI LLM Top 10 for that reason.

Do you need access to our training data?

Not usually. Most testing is black-box or grey-box against the deployed system. Where data poisoning or supply chain risk is in scope, we review provenance and pipeline controls rather than the data itself.

Will testing affect the model in production?

Testing runs against an environment you nominate, which is usually staging. Where production testing is necessary we agree rate limits, logging and stop conditions first, so the exercise neither degrades service nor pollutes your telemetry.

Secure Your AI

Contact NSI Global to define the models, applications, APIs, datasets and third-party components within scope. Confidential consultations are available at NSI Global’s radio-shielded Parramatta office.

What this engagement does not cover.

Testing is bounded by the scope agreed in writing. We do not test systems outside that scope, and no assessment establishes that an environment is free of vulnerabilities — only that the agreed scope was examined using the agreed techniques within the agreed window. Every report states what was tested, what was not, and what the evidence does and does not support.

1300 000 NSI (674)

AI Penetration Testing & ML Security