Last updated
What is AI security and assurance?
AI security and assurance is the practice of finding and fixing the ways AI systems can be attacked, abused or fail, and being able to demonstrate that to the people who ask. It spans offensive testing (LLM penetration testing, AI red teaming, agent security testing), architecture and threat modelling before you build, and governance work that maps what you've built to the standards buyers and regulators now expect: ISO/IEC 42001, the NIST AI RMF, and in Australia the Government's AI Technical Standard and AI Impact Assessment regime.
Ironbark Cyber approaches all of it from the attacker's side first. Assurance paperwork that isn't grounded in real adversarial testing is a comfortable fiction. We do the testing first, so the assurance reflects what's actually true.
Who is this for?
Teams for whom an AI failure is a board-level problem, not an inconvenience.
- Product and engineering teams shipping AI features (LLM applications, copilots, agents, RAG over sensitive data) who need them tested before customers or attackers get there.
- Security leaders buying or approving AI who need evidence-based answers for vendor reviews, risk committees and customer questionnaires.
- Australian government agencies and their suppliers aligning with the AI Technical Standard, completing AI Impact Assessments, or preparing for the mandatory standards flagged for 2027.
- Regulated and export-exposed organisations working toward ISO/IEC 42001 or navigating the EU AI Act.
Who it's not for: if you want a certificate without testing, a rubber stamp on a model card, or a tool subscription that promises "AI security" from a dashboard, we're the wrong firm, and we'll tell you that on the scoping call rather than after the invoice.
What services does Ironbark Cyber offer?
- LLM application penetration testing. Hands-on attack of your LLM-backed application: prompt injection, data exfiltration, guardrail bypass, excessive agency and everything the OWASP LLM Top 10 doesn't have a name for yet.
- AI red teaming. Objective-driven adversarial campaigns against your AI systems as deployed, including guardrails, monitoring and human oversight.
- AI agent security testing. Security testing for agentic systems: tool abuse, privilege escalation through agent chains, memory poisoning and confused-deputy attacks.
- Secure AI architecture review. Threat modelling and design review of your AI stack before (or after) you build it.
- ISO/IEC 42001 readiness. Gap assessment and remediation roadmap for the AI management system standard your enterprise customers are starting to ask about.
- AI governance & assurance. Alignment with the Australian Government AI Technical Standard, AI Impact Assessments, the NSW AI Assessment Framework and Queensland's FAIRA.
How does an engagement work?
The same way every Ironbark Cyber engagement works. A free 30-minute scoping call with the senior consultant who will do the work; a fixed quote within one business day; an agreed scope and rules of engagement; testing with an open channel to your team and live escalation of critical findings; then a report and debrief. Fixed issues get a free retest within 90 days.
What do we receive at the end?
- An executive summary written for boards and risk committees, in plain language.
- A technical report with evidence, reproduction steps and remediation guidance for every finding, ranked by real-world impact.
- Framework mapping to the standards you care about (OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, the AU AI Technical Standard).
- A debrief call with your engineering team, and an attestation letter you can share with customers.
- A free retest of fixed issues within 90 days.
What does AI security testing cost?
Every engagement is fixed-price, quoted within one business day of scoping. As a guide, focused assessments start from AU$20,000 and multi-phase assurance programmes are scoped to AU$100,000+. You'll know the exact number before you commit to anything.
Which frameworks do you map to?
Ironbark Cyber maps findings and recommendations to the frameworks your stakeholders actually cite: the OWASP Top 10 for LLM Applications, MITRE ATLAS, the NIST AI Risk Management Framework, ISO/IEC 42001, the Australian Government AI Technical Standard, the DTA Policy for responsible use of AI in government (v2.0, including AI Impact Assessments), the National AI Centre's Guidance for AI Adoption, and the EU AI Act for organisations exporting into Europe.
FAQ
Frequently asked questions
How much does AI security testing cost in Australia?
Ironbark Cyber quotes fixed fees after a free 30-minute scoping call, with the quote delivered within one business day. Focused assessments such as an LLM application pentest are fixed-fee; multi-phase AI assurance programmes are scoped and phased to your risk profile. Indicative ranges are published on this page, and the price never changes mid-engagement.
What is AI security testing?
AI security testing is authorised, adversarial testing of systems that use machine learning models: LLM applications, agents, RAG pipelines and the infrastructure around them. It covers attacks that traditional penetration testing does not, such as prompt injection, jailbreaking, data extraction from models and context, tool and agent abuse, and failures of the guardrails between the model and your data.
We only call a model API. Do we still need testing?
Yes. Most real-world AI vulnerabilities live in the application around the model, not in the model itself: what data reaches the context window, what tools the model can invoke, how outputs are trusted downstream, and how tenants are separated. Those are your responsibility regardless of whose model you use, and they are exactly what Ironbark Cyber tests.
What is the difference between AI red teaming and an LLM penetration test?
An LLM penetration test is scoped to a specific application and hunts for exploitable vulnerabilities in it. AI red teaming is broader and objective-driven: we emulate a motivated adversary against your AI system as deployed, including its guardrails, monitoring and the humans in the loop, to test whether realistic attack objectives can be achieved. See our comparison of AI red teaming vs penetration testing for a full breakdown.
Which frameworks and standards do you map findings to?
Depending on the engagement: the OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, the Australian Government AI Technical Standard, the DTA Policy for responsible use of AI in government (including AI Impact Assessments), the National AI Centre Guidance for AI Adoption, and the EU AI Act for exporters. You tell us what your auditors and customers ask for; we speak the language.
How long does an AI security engagement take?
Focused assessments typically run one to three weeks of testing, with the report delivered within a week of testing finishing. Broader red team or assurance programmes are phased over one to three months. Critical findings are escalated live during testing, so remediation never waits for the report.
Can you test production AI systems safely?
Yes. We agree rules of engagement up front, including rate limits, data handling and kill-switch contacts, and test carefully. Where a staging environment mirrors production we will usually prefer it, but many AI-specific risks only manifest against production data flows, and we are experienced at testing them without disruption.
Who actually does the testing?
Senior offensive security consultants, led by Ironbark Cyber founder Luke Stephens (hakluke), a widely known security researcher featured by HackerOne on AI red teaming. The consultant who scopes your work is the one who does it, with no junior bench and no rebadged scanner output.
Contact
Talk to us
Tell us what you're trying to protect, secure or build. We'll come back with a plan.