ClientRain · Kai Digital
AI security audit for your app or agent
Understand what your AI system can access, what it can do and where its configuration may create risk. Start with a focused review of one AI app or agent and one defined workflow.
From USD 490 · one AI app or agent · one defined workflow
Google Meet · English, Spanish and German · Based in Chile, working worldwide.
What is your AI actually allowed to do?
Can it read a document, change a customer record, or send a message? Each permission should have a reason that makes sense for the task. We look at how those permissions connect to the information moving through the agreed workflow.
For example, an assistant might encounter misleading instructions inside an uploaded document. Reviewing that situation means considering which material it should trust and what actions it can take afterward. The scoped audit documents findings and recommended next steps; active testing and remediation require their own agreement.
What this AI vulnerability review covers
An AI assistant can connect information, tools and actions in ways that deserve a closer look. The starting audit reviews the agreed configuration, permissions and data flow, with attention to:
- Data exposure: what information enters the system and where outputs, logs or connected services may send it.
- Access and permissions: which accounts and tools the AI can use and whether those permissions exceed the workflow’s needs.
- Untrusted input: where documents, messages or web content could influence instructions or downstream actions.
- Human approval: whether consequential actions require review and whether failures can be noticed.
Potential prompt-injection exposure and excessive tool access are reviewed within the agreed scope. This entry review does not include active attack simulations or exploit validation.
What you receive
- An inventory of the system and workflow reviewed.
- Findings supported by observations within the agreed scope.
- Priorities and practical recommendations.
- A report that states the review method, evidence and limitations.
- A walkthrough so you can discuss next steps.
The review uses the OWASP Top 10 for LLM Applications as a reference where relevant. This does not imply OWASP certification or a complete assessment of every listed risk.
Scope and authorization come first
Before access is shared, we agree which system you own or are authorized to have reviewed, what information is needed and what work is permitted. Do not send passwords, API keys or confidential customer data through the initial inquiry form.
Active penetration testing, source-code review, multiple systems, remediation and retesting require a separate written scope and quote. Testing requires written authorization. Third-party systems are excluded unless the required permission is in place.
This is a scoped assessment. It is not a security certification, compliance attestation or guarantee that all vulnerabilities have been found.
Applicable taxes and third-party costs are disclosed before purchase. Review the service terms.
Frequently asked questions
Is this a full penetration test?
No. The USD 490 starting scope is a configuration, permissions and data-flow review. Active security testing needs separate scoping, authorization and pricing.
Does the audit include fixing issues?
The report includes recommendations. Implementation of fixes and retesting are separate unless expressly included in your quote.
Can you review an AI agent connected to business tools?
Yes, subject to an initial scope review. We identify the connected tools, granted permissions and actions in the workflow before agreeing the engagement.
What should I prepare for the first conversation?
A plain-language description of the app, the workflow, the tools it connects to and your main concern. Start with non-sensitive examples; access arrangements come later.
Let’s see if I can help you.
Tell me what your business does, what you want to improve and which tools you use. The free introductory consultation lasts 15 minutes, within the 10-spot launch round. Spots and meeting times are confirmed by email.
Request a free consultation