The Risk
You've deployed AI tools like Microsoft Copilot or ChatGPT Enterprise to improve efficiency. But have you verified they cannot leak confidential information between clients or projects?
Many organisations assume their AI tools are secure without actually testing them. Our security audit uses adversarial techniques to find vulnerabilities before they become breaches.
What We Test
Client Data Separation
Can Agent-ClientA access ClientB information? We attempt cross-client queries to verify boundaries hold.
Permission Enforcement
Do file and folder permissions actually prevent unauthorized access? We test if AI tools respect your access controls.
Adversarial Prompts
Can clever prompting bypass security? We use advanced techniques to attempt privilege escalation and data extraction.
Context Switching
Does switching between clients maintain isolation? We test if data from one context leaks into another.
Anonymization Validation
If using anonymized data, can client details still be extracted? We check for inadvertent identifier leakage.
Compliance Verification
Does your setup meet industry-specific requirements? We assess against relevant regulations and standards.
Our Testing Methodology
1. Discovery & Mapping
- Understand your current AI tool setup
- Map data access patterns and permissions
- Identify critical confidentiality boundaries
- Define test scenarios specific to your risk profile
2. Automated Testing
- Run comprehensive automated test suite
- Attempt cross-client data access (15-20 scenarios)
- Test permission boundary enforcement
- Verify context isolation
- Check for data leakage vectors
3. Manual Red-Team Testing
- Advanced adversarial prompting techniques
- Creative attempts to bypass security
- Social engineering scenarios
- Edge case exploitation
4. Analysis & Reporting
- Detailed vulnerability analysis
- Risk assessment and severity ratings
- Remediation recommendations
- Compliance gap analysis
What You'll Receive
Comprehensive Security Report
A detailed document including:
- Executive Summary - High-level findings and risk assessment
- Vulnerability Catalog - Every security issue found, with severity ratings
- Test Results - Detailed outcomes from all test scenarios
- Risk Matrix - Likelihood and impact analysis for each vulnerability
- Remediation Roadmap - Prioritised recommendations with implementation guidance
- Compliance Assessment - How your setup aligns with industry requirements
- Best Practices Guide - Recommendations for ongoing security
Live Review Session
Dedicated session to walk through findings, answer questions, and discuss remediation strategies.
Who Needs This
Firms Using Microsoft Copilot
Copilot has broad access to your Microsoft 365 data. Have you verified it respects client separation?
Companies with ChatGPT Enterprise
Custom GPTs and integrations may have unintended data access. We'll verify your configuration.
Organisations with Custom AI
Built your own AI tools? We'll test if they properly enforce your security requirements.
Firms Preparing for Audits
Need to demonstrate AI security for compliance or client requirements? Our report provides evidence.
Engagement Options
Standard Audit
- Single AI tool (e.g., Microsoft Copilot)
- Standard test suite (15-20 scenarios)
- Comprehensive report
- Live review session
Comprehensive Audit
- Multiple AI tools or complex integrations
- Extended test suite (30+ scenarios)
- Custom test development for your specific risks
- Detailed remediation implementation guidance
- Follow-up review after remediation
What Happens After the Audit?
Depending on what we find, you have several options:
If Minor Issues Found
We provide guidance for your team to fix internally and can offer implementation support where needed.
If Major Issues Found
We can implement a secure architecture (see our Secure AI Implementation service) or provide consulting to remediate specific vulnerabilities.
Ongoing Monitoring
Optional quarterly re-audits ensure security is maintained as your AI usage evolves; we'll scope a retainer aligned to your environment.
Why Trust Us?
- Implementation Experience - We've built secure AI systems, so we know where vulnerabilities hide
- Adversarial Expertise - We think like attackers to find weaknesses before they're exploited
- Professional Services Focus - We understand the specific confidentiality requirements of your industry
- Practical Recommendations - We provide actionable guidance, not just theoretical risks
Common Findings
In our audits, we frequently discover:
- AI tools with overly broad access permissions
- Inadequate client-matter separation in file structures
- Missing safeguards against adversarial prompting
- Unclear data retention and deletion policies for AI interactions
- Insufficient audit logging of AI access
- Gaps in user training on secure AI usage
Most organisations are surprised by at least one finding. Better to discover vulnerabilities through an audit than through a data breach.