A full audit of a multi-tenant voice and chat AI platform
Security and compliance auditA production platform where businesses run AI phone and chat agents for their own customers, with telephony, payments and thirteen CRM integrations.
Read moreAI agent security test - Your agent can call tools. We find out who else can make it.
Hands-on testing of LLM features, RAG, agents and MCP tools. We follow injected instructions all the way to a tool call and check what leaks between your customers.
- From $6,500
- 5 to 7 tester days
- Retest and attestation letter
- Fixes as pull requests
What we test
- Prompt injection chains that end in a tool or agent action
- Data leaking between customers through RAG, vector stores or agent memory
- Tool and MCP permissions enforced on the backend, not in the prompt
- System prompt and secret disclosure
- Unsafe handling of model output (XSS, SSRF, SQL built from output)
- Cost and abuse limits on model usage
Scope and price - What one test covers
One AI feature or agent with up to five tools, one tenant model and one channel (chat, API or email).
What raises the price
- More agents, tools or MCP servers
- Retrieval over customer documents (RAG) or long term agent memory
- More than one channel, for example chat and email
- Complex roles and tenant hierarchies
Typical engagement
- Starting price
- From $6,500
- Testing time
- 5 to 7 tester days
- Start
- Usually within two weeks of the signed scope
- Report
- Within three business days of the last testing day
A good fit
- Seed to Series B products with LLM features used by business customers
- A customer or auditor asked how your AI features are tested
- Agents that can call tools, send messages or change data
Not a fit
- Early prototypes without real customer data
- Frontier model red teaming
- Work that requires US-person testers (FedRAMP, CJIS, ITAR)
Example finding - What a finding looks like
Illustrative example in the format of our reports. Real findings are shared only with the system owner.
HIGHWK-007OWASP LLM01 Prompt injection
An instruction hidden in a shared document makes the agent email the full customer list
- Reproduced
- 7 of 20 attempts
- Root cause
- The email tool accepted any recipient and the agent read untrusted document text as instructions.
- Fix
- Recipients restricted on the server to the requesting user. Document text passed as data, not instructions. Pull request with regression test.
- Retest
- 0 of 20 attempts. Closed.
Mapped to the standards your buyers check
| Area | Standards |
|---|---|
| Prompt injection to tool action | OWASP LLM01, OWASP Agentic Top 10, MITRE ATLAS AML.T0051 |
| Cross-tenant retrieval and memory | OWASP LLM02, SOC 2 CC6.1, ISO 27001 A.8.3 |
| Tool and MCP permissions | OWASP LLM06, OWASP Agentic Top 10, SOC 2 CC6.3 |
| System prompt and secrets | OWASP LLM07, ISO 27001 A.8.24 |
| Output handling | OWASP LLM05, ASVS V5 |
| Cost and abuse limits | OWASP LLM10, SOC 2 A1.1 |
What scanners miss - The risk sits in chains, not single requests
Automated tools are strong on the standard web list. They are weakest where an AI product is most exposed: several steps that only fail together.
- Injected text to tool call. An instruction hidden in an email, document or web page that ends in an agent action.
- Cross-tenant retrieval. Another customer's document returned through RAG, a vector store or agent memory.
- Permissions in the prompt. Tools that trust the model to decide who may do what, instead of the backend.
- MCP servers. OAuth scopes, inherited permissions and tool descriptions that change what an agent will do.
- Output used as code. Model output rendered as HTML, used in a URL fetch or built into a query.
- Cost abuse. Unbounded loops and prompts that turn your model bill into someone else's tool.
What you get - Evidence, fixes and a letter you can send.
- A report your auditor can sample. Scope, method, dates, every finding with severity, proof and the exact fix. Written so an auditor can trace a finding from discovery to closure.
- Fix pull requests. Confirmed findings ship with a pull request and a regression test. We open them from a fork or a branch you protect, your engineers review and merge, and we never hold merge or deploy rights.
- Free retest within 90 days. A tester who did not write the fix confirms it holds, and the report is updated with before and after evidence.
- Signed attestation letter. A one page letter for your customers and investors, signed by the lead tester, with an ID your customer can check with us.
- Questionnaire answers. We answer the pentest and AI lines of the questionnaire your customer sent, each one pointing to the part of the report that proves it.
Related evidence
Our team's previous work. Client names stay private, the numbers come from the engagement record.
Two critical cross-customer bugs in a B2B SaaS
Grey-box penetration testA B2B platform used by 340 business customers, tested with partial access (grey box).
Read moreCombine - Often bought together
FAQ - Questions buyers ask
Do we need this if we use OpenAI or Anthropic?
Yes. The model provider secures the model. Your prompts, tools, retrieval and permissions are yours, and that is where these findings live.
Do you need access to our code?
It helps but is not required. Read access lets us confirm root causes faster and write fix pull requests.
Will my SOC 2 auditor accept your report?
Auditors look for scope tied to your systems, a named method, dated testing, findings with severity and evidence that fixes were retested. Our reports are written to that list.
Who writes the fixes, and how do you stay independent?
We open pull requests from a fork or a protected branch, your engineers review and merge them, and a tester who did not write the fix retests. The attestation letter says who wrote each fix.
Do you test production?
We start with staging or dedicated test tenants. Production is tested only with your written risk acceptance.
Where are you based?
Wardkey is a brand of Meridal Group LLC, a United States company. Testing is performed from the EU. We do not take work that requires US-person testers, such as FedRAMP, CJIS or ITAR scope.
How long does it take?
Most tests start within two weeks of the signed scope and take four to eight tester days. The report follows within three business days.
What if you find nothing?
Then the report says exactly what was tested and how, which is what your customer's reviewer needs to see.
Send us the questionnaire your customer sent.
We will tell you which lines a test answers, in writing, within one business day.
Who we are
- CompanyMeridal Group LLCWyoming, United States
- TestingPerformed from the EUFor clients in the US and Europe