A security review of one AI agent system: what it can read, send, delete, and pay for, and how it could be made to.
For a business shipping an agent that touches customer data, money, or email, or that has to answer a customer's security questionnaire. A scoped review with findings ranked, evidence for each, and the fix, mapped to the OWASP Top 10 for Agentic Applications and the OWASP LLM Top 10.
from$4,000 USD
Typically $4,000 to $9,000, one agent system per review. What moves it: the number of tools, connectors, and environments the agent can reach.
What is reviewed
Six checks. Each one produces findings with evidence, or a written statement that it passed and why.
- SCOPES
Permissions and tool scopes
The agent gets the narrowest access that still does the job. Every token, role, and scope is listed.
- SECRETS
Keys and credentials
Where each key lives, who can read it, how it rotates. Nothing in prompts, logs, or repositories.
- ACTIONS
What it can send, delete, or pay for
Outbound and destructive actions are named, limited, and gated. The agent cannot do what the scope did not grant.
- INPUTS
Prompt-injection paths
Everything the agent reads, from emails and documents to web pages and tickets, is treated as untrusted and tested that way.
- CONNECTORS
Tool servers and integrations
MCP servers, webhooks, and third-party connectors are reviewed for what they expose and to whom.
- GATE
A person before production
Nothing deploys raw. A human approves what ships, and the record says who and when.
What each check means in practice
Permissions and tool scopes
Every token, role, API scope, and service account the agent holds, compared with what the job needs. Over-scoped access is the first thing checked and the cheapest to fix.
Secrets
Where keys live, who can read them, whether they appear in prompts, logs, repositories, or tool outputs, and how they rotate.
Actions it can take
The outbound and destructive actions the agent can perform (send, delete, pay, change) and whether each one is limited and gated by a person where it should be.
Prompt-injection paths
Everything the agent reads is a way in: emails, documents, web pages, tickets, tool results. Each input is tested for whether an instruction hidden in it can change what the agent does.
Connectors and tool servers
MCP servers, webhooks, plugins, and third-party connectors, reviewed for what they expose, to whom, and what happens if one is compromised.
Human gate and logging
Whether a person approves what matters before it happens, and whether the record afterwards shows what the agent did, with what, and why.
What you get
- A written report with every finding ranked by severity, the evidence, and the fix.
- A map of what the agent can reach, with what access, and through which path.
- Mapping to the OWASP lists (Agentic Top 10 and LLM Top 10), so the report answers a customer's security questionnaire in their own vocabulary.
- A fix pass, quoted separately as a build, or done under the retainer.
- A re-check of the fixed items, so the report can say they are closed.
- Scope
- One agent system per review: the agent, its tools, connectors, and the environments it runs in.
- Access needed
- Read-only access to the configuration and code, plus a sandbox copy where possible for the injection and action tests.
- Timeline
- Stated in the scope; a single-environment agent takes days, not weeks.
Who asks for this
A business that shipped an agent which reads customer email, writes to the CRM, moves money, or touches production, and wants to know what it can actually do before a customer or an attacker finds out.
A SaaS team whose customer has sent a security questionnaire that asks about the AI features, and needs answers that are true.
An agency running automations across many client accounts, where one over-scoped token would be every client's problem.
Anyone who had an agent built by someone else and was handed the keys without the map.
Questions about the review
Is this a penetration test?
No. It is a scoped review of one agent system against a written checklist, with hands-on testing of the injection and action paths. If you need a full penetration test of the application around it, the scope will say so and who to ask.
Do you need production access?
Read-only access to configuration and code, and a sandbox copy of the agent where possible. Tests that could send, delete, or pay are run against the sandbox, never against production, unless you ask for it in writing.
What frameworks is it mapped to?
The OWASP Top 10 for Agentic Applications and the OWASP Top 10 for LLM Applications. Findings are labelled with the matching item so the report can be handed to a customer's security team as is.
Does the build service include this?
Every VXSec build ships with the same six checks as a security pass. The standalone review is for agents VXSec did not build, or for a deeper look at one that acts on money, customer data, or email.
Send the problem in writing.
What you are running, what is wrong or what you want built, and links if you have them. A written scope and a fixed price come back within two business days.
Or email [email protected] directly.
- You send: the tools involved, what should happen, what happens instead.
- You get back: a scope in plain words, a fixed price, what is out, and how it will be verified.
- Then: a call if you want one, or straight to the spec.