--- title: "AI Security: red team, containment, and evidence" description: "Adversarial testing, agent containment, and the evidence an enterprise security review asks an AI vendor for." source: "https://www.kensink.com/ai-security/" canonical: "https://www.kensink.com/ai-security/" --- ★ AI Security · Est. 2026 Lab open · 2 slots OWASP LLM + ASI mapped Full source at handoff AI SECURITY · 12 OFFERS · 4 STAGES # We break the agent before someone else does. Adversarial testing, containment engineering, and the evidence your customer’s security team is asking for. Every finding ships with its fix. Every fix becomes a test that runs forever. You keep the source. [Find your stage →](https://www.kensink.com/ai-security/lifecycle) [Read the red team spec ↗](https://www.kensink.com/engagements/ai-red-team) KL · AI SECURITY PRACTICE FIXED SCOPE · 1 TO 6 WEEKS FULL SOURCE HANDOFF _Fig. 01 · Policy gate · live Allowed Blocked_ The third call is an instruction the user never wrote, injected through a page the agent read. It fails at the gate, not in your customer’s inbox. 01 · THE STATE OF IT ## The numbers your board has not seen yet. Published 2026 research, not our opinion. Every figure describes a system somebody shipped last quarter. 62% of AI-built applications ship with a critical vulnerability OX Security #3 Excessive agency's new rank in the OWASP LLM Top 10, up from sixth OWASP GenAI 2026 2× the human rate at which AI-assisted commits leak secrets GitGuardian 2026 30–80 AI-specific questions now sitting in an enterprise questionnaire Aetos **The one that changes the sale.** SOC 2 alone now fails the AI section of an enterprise vendor review. 87% of buyers check your posture before they ever speak to procurement, increasingly with an agent that reads your site. 02 · START HERE · 4 MOMENTS ## Which one have you said out loud this month? Security for an AI company is not one purchase. It is four moments, each with a different buyer, trigger, and return. Find yours and start there. [STAGE 01 “We’re shipping fast.” Build · alongside Nobody is asking you security questions yet, which is exactly why this is the cheapest stage to be in. 62% of AI-built apps ship a critical flaw A third the cost of the same work retrofitted Prevention runs at a fiftieth of recovery Built-in Security](https://www.kensink.com/engagements/built-in-security) [STAGE 02 “A deal is stuck.” Prove · once · 2 wks A questionnaire landed three weeks before the rep promised close, and it has an AI section nobody can answer. A trust page, machine-readable The 30 to 80 AI answers, with evidence AI-BOM, DPA, incident plan AI Trust Pack](https://www.kensink.com/engagements/ai-trust-pack) [STAGE 03 “More of them.” Scale · once · 3 wks Three deals in flight. And the agent just gained a tool that can spend money or write to production. Prompt injection, direct and indirect Tool misuse and excessive agency The eval suite, wired into your CI AI Red Team](https://www.kensink.com/engagements/ai-red-team) [STAGE 04 “They’re auditing us.” Certify · once · 6 wks SOC 2 Type 2 in flight, ISO 42001 on an RFP, an EU customer, a board that now asks quarterly. Controls implemented, evidence automated Readiness, not audit. A CPA signs it Costs less if you already did stage 3 Audit Readiness](https://www.kensink.com/ai-security/lifecycle) Relative commitment, not a price. Every engagement is fixed scope with the spec and the figure published on its own page. 03 · WHAT ACCUMULATES ## Four artifacts, not four invoices. Every engagement creates or extends one of these. Step through the stages and watch what you own. AI-BOM Every model, service, SDK, vector store, MCP server and agent you run — Evidence Pack Trust page, answer bank, data-flow map, DPA, incident plan — Eval Suite Adversarial regression tests, in CI, with a ship gate started Policy Layer Per-agent identity, scoped credentials, policy-as-code, audit log, kill switch started **Read stage one closely.** Built-in Security is the only thing that puts an artifact in your hands before anyone asks you for it, which is why it is both the cheapest entry and the one that changes the most downstream. 04 · THE LINE · 12 OFFERS ## Three ways to buy, and they are different products. Once, alongside, or ongoing. The delivery mode is a real difference in what you get, not a billing detail. ONCE ### We deliver and leave Fixed scope. You get the artifact, full source and a runbook. Same ownership terms as every other engagement on the site. - [AI Trust Pack](https://www.kensink.com/engagements/ai-trust-pack) · once · 2 wks - [AI Red Team](https://www.kensink.com/engagements/ai-red-team) · once · 3 wks - Agent Containment · once · 6 wks - AI Security Assessment · once · 3 wks - Shadow AI Sweep · once · 1 wk 7 offers · 1 to 6 weeks · figures on each spec page ALONGSIDE ### Built in as we build Wired into the product while it is still being written, or one of our engineers inside your team on your sprint cadence. - [Built-in Security](https://www.kensink.com/engagements/built-in-security) · add-on · 0 extra weeks - Embedded Security · your sprint cadence Containment during a build is a design decision. Afterwards it is surgery. ONGOING ### It keeps running An AI system changes weekly, so a point-in-time test is stale within a month. We say that at the sale, not after it. - Deal Desk · monthly - [Security Care](https://www.kensink.com/engagements/security-care) · monthly - Fractional Security Lead · monthly 12-month terms · Priority SLA \[05 · HOW WE WORK\] ## Four rules, on every engagement. The difference between this and a consultancy’s PDF. They come out of the K-Framework’s Judgment pillar, which already says red-team in CI. 01 ### Every finding ships with its fix A finding without a fix is homework. We close it in the same engagement, or we say plainly why we did not and who should. 02 ### Every fix becomes a test Findings turn into cases in an eval suite wired into CI with a ship gate. The same failure cannot come back next sprint. 03 ### Evidence a customer can read Not just a report for the CTO. The deliverable has to survive being forwarded to a procurement team you will never meet. 04 ### You own everything Full source, the suite, the policies, the runbook. No platform to keep renting, no seat we can revoke. 06 · SECURITY WITH AI ## Agents do the sweep. People make the calls. “AI-powered security” is the most oversold phrase in this category, so here is the specific version, including the three lines we will not cross. | Stage of work | What the agents do | What a person does | | --- | --- | --- | | Discovery | Sweep the repo, cloud config, package manifests, MCP configs and SaaS logs to build the AI-BOM | Decide what is in scope and what the business can live with | | Assessment | Run thousands of adversarial prompts, map results to OWASP LLM and ASI categories | Judge exploitability, rank by reachability, throw out the noise | | Red team | Run and mutate the attack library continuously | Design the novel attack the library lacks, confirm every finding by hand | | Questionnaires | Retrieval over your own evidence drafts each answer with its source | Approve every answer before it is sent | | Care | Re-run on every model change, triage, watch for drift | Decide what is worth waking someone up for | RULE 01 **No finding is reported without human confirmation.** A false positive in your board pack is worse than a missed one. RULE 02 **No questionnaire answer is sent without your approval.** Those answers are contractual representations, not drafts. RULE 03 **We name which parts were agent-run.** You are buying from an AI lab. Being specific is a trust asset. 07 · SCOPE AND QUESTIONS ## What we do not sell, said on the page. Each of these is a firm we will hand you to. A lab that says no and gives you a name gets the next call. Do you run a SOC or do 24/7 monitoring? No. No staffed monitoring, no MDR, no on-call rota. We build the detection and the automated response, hand it over, and your team or your MSSP runs it. If you need a staffed SOC we will introduce you to one. Can you issue our SOC 2 or ISO 42001? No, and nobody who builds your controls should. We do readiness: controls implemented, evidence automated, policies written, gap register closed. A CPA firm issues the SOC 2. A certification body issues the ISO 42001. That distinction goes in the proposal, not the small print. Is this a penetration test? Not a general one. We test AI systems and the code around them: prompt boundaries, tool permissions, agent identity, memory, MCP servers, and the supply chain. Network, infrastructure, physical and social engineering are somebody else's discipline and we will say so rather than stretch. We already pay for Vanta. Does this replace it? No. Compliance software collects evidence and it is cheap. It does not implement a control, wire a policy gate, or answer the AI section of a questionnaire from first principles. We work alongside it and we will use the tooling you already have. How fast can you start? Trust Pack and Shadow AI Sweep usually inside two weeks of signature. Red Team and Containment depend on the slot; we run a small number of engagements at once by design, which is also why the delivery lead is a named person rather than a pool. What do we actually walk away with? Full source for anything we build, the eval suite and its ship gate, the policy set, the runbook, and the evidence pack in a form you can forward to a customer. There is no platform to keep renting and no seat we can revoke. NEXT STEP ## Send us the questionnaire that is blocking the deal. Fifteen minutes. We will tell you which of the four moments you are in, what it costs to get past it, and whether you need us at all. [Book a 15-min intro →](https://www.kensink.com/contact) [See the full lifecycle ↗](https://www.kensink.com/ai-security/lifecycle)