Last updated
What is AI red teaming?
AI red teaming is an authorised adversarial campaign with objectives instead of a vulnerability checklist. Ironbark Cyber agrees a set of attacker goals with you, the ones that map to your real risk register, and then attempts to achieve them against your deployed AI systems, using the same persistence and creativity a real adversary would. The output is not a list of theoretical weaknesses; it's a demonstrated answer to "could this actually happen to us, and would we notice?"
What does a campaign cover?
- Objective-driven attacks against LLM applications, agents and AI-backed workflows: data extraction, unauthorised actions, fraud paths, persistent manipulation.
- Guardrail and safety-system evaluation. Filters, moderation layers, output classifiers and policy enforcement, bypassed the way attackers bypass them, iteratively and in combination.
- Detection and response. Did your monitoring see us? Did anyone act? A red team is as much a test of your telemetry as your controls.
- Supply chain and pipeline attacks where in scope: model registries, fine-tuning data, prompt and template stores, MLOps tooling.
- The human layer. Operators who approve agent actions, review flagged outputs or handle AI-generated content are part of the system, with your agreement, they're part of the scope.
How is the campaign run?
In phases: reconnaissance and threat modelling, attack development, execution, then reporting and replay. Campaigns are structured around MITRE ATLAS so every technique we use has a name your defenders can look up. Rules of engagement, boundaries and stop conditions are agreed before anything runs, and critical objective achievements are reported the day they happen.
What do we receive?
- A campaign narrative: what we tried, what worked, what your systems caught, told end-to-end so your team can replay it.
- Technical findings with evidence and remediation guidance, ranked by real-world impact.
- ATLAS technique mapping and control recommendations that map to NIST AI RMF and ISO/IEC 42001.
- An executive debrief for boards and risk committees, plus a free retest of fixed issues within 90 days.
How long does it take and what does it cost?
Campaigns typically run two to six weeks. Pricing is fixed-fee per phase: indicatively from AU$30,000, with multi-phase campaigns scoped to AU$100,000+, quoted exactly within one business day of a scoping call. Wondering whether you need a red team or a pentest first? Read our comparison, for most teams the honest answer is a pentest first.
FAQ
Frequently asked questions
How much does an AI red team engagement cost in Australia?
AI red teaming is scoped to objectives rather than assets, so pricing varies more than a pentest. Ironbark Cyber quotes fixed fees within one business day of a scoping call; indicative ranges are published on this page. Phased campaigns can be staged so you commit one phase at a time.
What is AI red teaming?
AI red teaming is an objective-driven adversarial campaign against your AI systems as deployed. Instead of enumerating vulnerabilities in one application, we pursue realistic attacker goals (extract the training data, hijack the agent, defraud the workflow, poison the pipeline) against the full stack: models, applications, guardrails, monitoring and the people operating them.
How is AI red teaming different from an LLM penetration test?
A pentest asks "what vulnerabilities exist in this application?" A red team asks "can a motivated adversary achieve this objective against our organisation?" Pentests are broad within a scope; red teams are deep along attack paths, and they test your detection and response as well as your prevention. Our comparison page covers when to choose which.
Do you follow a recognised methodology?
Campaigns are structured around MITRE ATLAS tactics and techniques, informed by the OWASP LLM Top 10, and reported so findings map cleanly to NIST AI RMF and ISO/IEC 42001 controls. The methodology is documented in the report so your auditors can follow the reasoning.
Will you disrupt production systems?
No. Rules of engagement are agreed up front, objectives, boundaries, data handling, escalation contacts and stop conditions. Destructive actions are simulated or performed against replicas. We have run adversarial campaigns against live systems for organisations of every size without operational impact.
How long does an AI red team take?
Typically two to six weeks depending on objectives, phased as reconnaissance, attack development and execution. You receive interim updates throughout, and if we achieve a critical objective early, you hear about it that day, not in the closing report.
Contact
Talk to us
Tell us what you're trying to protect, secure or build. We'll come back with a plan.