An AI security company and a penetration testing company in one: AI red teaming for chatbots, RAG and agents, human-led pentests for web, API and cloud. With written permission.
Slenkwater Verzekeringen, customer care knowledge base
Claims handling policy, v3.2. Applies to: support assistant, all channels. Owner: Customer Care. Reviewed 2026-09-02.
1. Scope. This policy tells our support assistant how to answer questions about open claims. It does not cover new claims or complaints.
2. Identity. Before sharing claim details, the assistant confirms the customer's policy number and date of birth. It never reads them back in full.
3. Refunds. Refunds above EUR 250 need a human agent's approval. The assistant may explain the status of a refund but cannot start one.
4. Escalation. If a customer is upset, offer a call back within one working day and log the request in the CRM with the claim number.
5. Language. Answer in the language the customer writes in. If unsure, use Dutch.
6. Records. Do not store chat transcripts outside the claims system. Transcripts are deleted after 90 days.
MODEL LAYER
STACK LAYER
Not visible to a reviewer / read by the model
OWASP LLM01 / prompt injection, indirect
Lesson: retrieved text is data, not instructions
Every system has a version of itself that only attackers see. We find it first, in the code and in the conversation, and turn it into a list your engineers can close.
What it says, shares and does when a stranger is typing.
Mapped to the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications and MITRE ATLAS. Every finding carries a reproduction rate.
What one user can do to another, and how far one weak spot reaches.
Mapped to the OWASP WSTG and the OWASP API Security Top 10 (2023), rated in CVSS v4.0.
30-minute scoping call.
A questionnaire, a SOC 2 window or an ISO 27001 audit is waiting on it. We scope in one call and write the report their security team expects.
A chatbot, RAG search or agent with real tools is about to go live on your SaaS. We test the feature and everything it can reach, before strangers do.
Your clients want independent evidence for the agent and the app around it. We test before handover, report to you first, and never pitch your client.
Running security? Skip the doors and read the method.
Plate 01 / Fig. 1
In the prompt
Direct and indirect prompt injection, jailbreaks and system prompt leakage.
Mapped to
In the context
RAG poisoning, cross-tenant retrieval, sensitive data in embeddings and memory.
Mapped to
In the tools
Tool and function-call misuse, excessive agency, MCP server review, unsafe output handling and runaway spend.
Mapped to
In the app
Business logic, authorization, session handling and the multi-step abuse that scanners do not model.
Mapped to
In the API
Object and function level authorization, property-level access, rate limits and the endpoints nobody documented.
Mapped to
In the cloud
Identity and access, exposed storage, secrets in build pipelines, and the path from one service to the rest of the account.
Mapped to
MODEL LAYER
STACK LAYER
You did not see it go. Neither will your logs.
Somewhere along the way the dot disappeared, and the grid closed over the hole. Your brain filled the gap with what it expected to see. Every eye has a spot like this. Every system does too. That is the part we test.
Every system has one. We find yours first.
You can’t call our past clients yet. So we made everything else checkable: the method we test by, the rules we follow, a sample of the report you’d get, and this site itself.
The only blind spot in our report is the one you scope out.
v1.0 · 2026-10 · first public version
Read the methodThe full rules also cover test windows, how testing stops, how critical findings reach you and what happens to your data.
Rules of engagementMapped to the standards your auditors already use.
Advisories 0
When we publish one, it lands here with the vendor’s acknowledgment.
A security firm’s site should pass its own test.
Check it yourself
Scope builder
How we think about what we test, written up with the framework ids attached.
An AI pentest is an authorized security test of a chatbot, RAG application or AI agent. We check whether it can be talked or tricked into leaking data, ignoring its instructions or misusing its tools, and we map every finding to the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications and MITRE ATLAS.
A regular pentest examines code, configuration and infrastructure. An AI pentest also examines what the system does with what it reads: prompts, retrieved documents, tool results and memory. The worst issues cross into the stack, so we test both layers and report the paths between them.
It helps and it shortens the test. Grey box access (system prompt, tool definitions, test accounts) gives the most coverage per day. We can also test black box, the way an outside attacker would, and report what we could infer on our own.
The report states scope, method, dates, tester qualifications, severity in CVSS v4.0 and retest status, which is what enterprise security teams and SOC 2 or ISO 27001 auditors look for. A one-page attestation letter lets you share the result without sharing the findings.
Our ranges, excluding VAT: AI chatbot or RAG EUR 4,000 to 10,000; AI agent and MCP EUR 6,000 to 15,000; web application and API EUR 5,000 to 15,000; a SaaS platform with its AI feature (Launch Clearance) EUR 10,000 to 20,000. A quote follows a 30-minute scoping call.
Yes, with the vendor’s written permission for anything they host. We provide the authorization letter template and handle the paperwork with you.
SOC 2 does not strictly require one, but a point of focus under CC4.1 lists penetration testing among evaluation methods, and auditors and customers expect it. ISO 27001:2022 controls A.8.8 (technical vulnerabilities) and A.8.29 (security testing) are commonly evidenced with a pentest report.
If your organisation is a medium-sized or larger entity in one of its 18 sectors (some types regardless of size), it has applied since 15 August 2026. If your customers are, its supply chain duty means their security questionnaires now reach you, and a recent pentest report is the most direct answer.
Yes. DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 and replaces NIS2 for financial entities on ICT risk and testing. Article 25 testing, the chatbot and AI layer included, is what we do. Threat-led testing under Article 26 is not ours yet: Article 27 sets tester requirements a firm as young as ours cannot meet.
For high-risk AI systems, Article 15 requires accuracy, robustness and cybersecurity, from 2 December 2027 for Annex III systems under the AI Omnibus, Regulation (EU) 2026/1744. Most customer-service chatbots are not high-risk, but Article 50 transparency has applied since 2 August 2026. We produce test evidence; classification is for your counsel.
Mostly not. The CRA covers products with digital elements, such as installed software, apps and devices; SaaS is in scope only as the remote data processing of such a product. Whether NIS2 (the Cbw in the Netherlands) applies to you depends on your sector and size. The CRA's reporting duties started on 11 September 2026.
Yes. We sell no guardrail, firewall or platform, and no vendor owns us. Since 2025 platform vendors have bought several independent AI security firms, so their tests now come with a product to buy. Ours come with a list of fixes.
The founder leads every engagement and does the hands-on testing. Their credentials go on this site as soon as you can verify each one yourself, and not before.