Offensive security for AI
Pentesting for AI systems, LLMs, and agents.
We assess how your users, models, data, and tools interact to uncover abuse paths a conventional review may not cover.
From prompt to real impact.
An AI security assessment must analyze the whole system, not only the model's responses. Gekko connects each observed behavior to its exploitation conditions, business impact, and mitigation measures.
What we can analyze
- Direct and indirect prompt injection and its paths into the system.
- Sensitive data leakage in responses, context, or memory.
- Access controls, isolation between users, and permission boundaries.
- RAG, knowledge sources, documents, and context retrieval.
- Agents, tools, plugins, and actions with external effects.
- Resource abuse, automation, and usage controls.
Frequently asked questions
Do you only assess the model?
No. The model is one component within an application. The scope can include the interface, APIs, prompts, data, tools, identities, and the actions the system can execute.
What information do we need to get started?
A description of the system, its users, integrations, environments, and goals. From that conversation we define access, boundaries, and test scenarios.
Does the result include recommendations?
Yes. Each finding is documented with evidence, impact, and technical and control recommendations to support remediation and retesting.