AI Security
Prompt injection, jailbreaks, model abuse, APIs, authentication, authorisation, and secrets
AAM-003
AI Red
Team
Can your AI withstand realistic attacks?
AI systems create new possibilities – and new attack surfaces. Prompt injection, manipulated data sources, insecure agents, or abused tools can bypass safeguards and deliberately influence system behaviour.
The AI Red Team simulates realistic attacks against models, agents, data, interfaces, and infrastructure. Not to compile a list of theoretical risks, but to show what is actually possible under realistic conditions.
Discuss the AI Red Team →01
Why
Traditional penetration testing remains important. AI systems, however, add new layers to the attack surface: models can be manipulated, prompts abused, RAG content influenced, and agents induced to use tools or permissions in ways that were never intended.
These attacks do not target infrastructure or software alone. They can alter information, expose sensitive data, influence decisions, or cause an AI system to be used for unintended purposes. Assumptions about safeguards therefore need to be tested under realistic conditions.
Trust must withstand attack.
02
What
Five attack surfaces. One realistic picture.
Agents & Tools
Agent behaviour, tool security, MCP, permissions, agent chains, and privilege escalation
Data & Knowledge
RAG manipulation, data poisoning, data integrity, knowledge sources, and embeddings
Infrastructure
Cloud, network segmentation, containers, identity & access management, and supply chain
Resilience
Detection, logging, monitoring, incident response, and recoverability
03
How
Together, we define the scope and rules of engagement, analyse the architecture and threat model, and derive realistic attack paths. Our specialists then challenge AI components and their environment to determine how they withstand real attacks.
Scope
Define objectives, boundaries, test environment, and attack scenarios
Model
Understand the architecture and develop realistic attack paths
Attack
Attack models, agents, data sources, APIs, and infrastructure
Validate
Assess impact, safeguards, and actual exploitability
Improve
Prioritise findings and derive concrete improvements
04
Knowledge
After the AI Red Team, you have a much clearer understanding of how resilient your AI actually is:
Which realistic attack scenarios against your AI actually work
Which attack paths connect models, agents, data, APIs, or infrastructure
Which weaknesses have the greatest impact on security and trustworthiness
Which existing protection, detection, and response measures are effective – and which are not
Which technical improvements should be implemented first
Typical deliverablesAI Red Team ReportAttack ScenariosAttack PathsTechnical FindingsPrioritised ImprovementsExecutive Summary
05
scip AG
AI Red Teaming requires an attacker mindset – and an understanding of AI.
For more than twenty years, scip has developed and conducted demanding Red Team exercises for organisations with high security requirements. We combine this offensive experience with our own research into Trustworthy AI and modern attack techniques targeting foundation models, agents, and AI ecosystems.
Our goal is not to produce as many findings as possible. We want to show which assumptions hold under realistic attack conditions, where safeguards fail, and what actually matters for the resilience of your AI.
20+
Realistic
AI + Security
06
Perspective
AAM is not a linear process. Depending on the context, other questions may become relevant and different capabilities can be applied where they add value.
07
Insights
Our AI Red Team work combines long-standing offensive security experience with ongoing research into AI Security, Trust, and emerging attack techniques.
C2 Architecture – Pull the Strings, Run the Show →NIST AI RMF — Generative AI Profile →Decision Security – From Secure Information to Trustworthy Decisions →ISO/IEC 27001:2022 — Information Security Management Systems →AI Assurance & Trustworthy AI →08
Assumptions are easy.
Evidence is harder.
You do not need to assume that your safeguards work. Let us find out what happens when someone tries to bypass them.
Discuss with scip →