Assessment
AI Prompt Injection Defense
Adds input and output defences against prompt injection in your AI apps.
Assessment
AI Security Audit
A written, point-in-time review of your AI systems' security posture, with findings ranked by severity and ready to act on.
Putting an AI application or agent into production without a security check means trusting that prompts, data access and stored keys are all handled safely. AI Security Audit reviews the systems you name against a written checklist and gives you a report with findings ranked by severity. Your team decides what to fix, and in what order.
- Findings ranked by severity, with clear remediation steps
- A written report you can share with customers or reviewers
- A recorded walkthrough of every finding with your team
$6,900
20–30 working days
Optional maintenance $345/mo
What it is
AI Security Audit is a one-time assessment of the AI applications, agents and tools you name. Tests are mapped to the OWASP Top 10 for LLM Applications (2025), covering prompt handling, data access, credential storage and logging. It is a point-in-time review, not ongoing monitoring. You receive a severity-ranked report with clear remediation steps.
Why businesses buy it
AI systems open new routes for things to go wrong: prompts that leak data, agents with more access than they need, keys stored where they should not be. Finding these after an incident costs far more than finding them before launch. This audit gives you an independent, written view of where your AI systems stand and what to fix first. The Scope Card names the systems, checks and report format before you order, and the review never implies certification or a guarantee.
Problems this solves
AI tools went live without anyone checking their security
The audit reviews the AI applications, agents and integrations you name against a security checklist. It covers prompt handling, data access, credential storage and logging for each one.
Nobody knows where the API keys for your AI tools are stored
Credential storage is one of the checklist areas. Findings show where keys and secrets sit today and what to change, ranked by severity so the riskiest come first.
Customers or auditors ask how your AI tools are secured
You receive a written report with findings ranked by severity and clear remediation steps. It gives you a documented starting point when someone asks about AI security.
Your team doesn't know which AI risks to fix first
Severity ranking turns a long list into a clear order of work. Your team can tackle the most serious issues first, using the remediation steps provided.
A good fit if
You are about to put an AI application or agent into production and want an independent check before launch.
You need a written report to show a customer, investor or compliance reviewer that your AI systems were assessed.
You have not had your AI systems reviewed before, or it has been more than six months since the last one.
You want a ranked list of findings and remediation guidance rather than ongoing day-to-day monitoring.
Not the right fit if
You want scanning built into your development pipeline that runs on every build, not a single report; see AI Application Security Agent.
You want each pull request or configuration change reviewed as it happens, rather than a periodic snapshot; see AI Security Review Assistant.
You want ongoing alerting after the report is delivered, not just the one-time findings; see AI Security Monitoring.
Your main concern is prompt injection specifically, rather than a broad review; see AI Prompt Injection Defense, which is narrower and always on.
How it works
- Scope and authorization are agreed in writing first. We confirm exactly which AI applications, agents and connected systems are in scope, and you provide written authorization before any testing begins.
- Each system is checked against a security checklist. We look at how prompts and inputs are handled, how credentials and API keys are stored, what data the system can read or write, and what gets logged.
- Documented test scenarios probe the boundaries. Within the agreed scope, we run controlled checks such as attempted access outside intended limits or known weak configuration patterns, and record exactly what happened.
- Findings are ranked by severity. Each issue found is written up with what it is, what could happen if left unaddressed, and the remediation steps we recommend, ordered from most to least urgent.
- The report is walked through with your team. A recorded 60-minute session covers every finding, answers questions, and confirms who owns each remediation item.
- You receive the written report and control test log to keep. Nothing is fixed automatically; the audit tells you what to change and in what order, and you or your team implement it.
What you provide within 72 hours
Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.
- Written authorization confirming which systems we are allowed to test.
- The list of AI applications and connected systems you want included in scope.
- Any existing security policies you already have, even in draft form.
- Read access to relevant cloud or application logs, where testing needs it.
- A named IT or security contact who can answer questions during the review.
- Admin access and API keys for every connected system, shared by adding our team as a user or creating a key you control, never by email.
- One decision-maker who can approve the final scope and sign off the report.
The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.
Timeline
Start
Scope confirmed and written authorization received.
Weeks 1–2
Systems reviewed against the security checklist.
Week 3
Documented test scenarios run within the agreed scope.
Weeks 3–4
Findings drafted and ranked by severity.
Week 4
Your review and two rounds of changes to the report.
Go-live
Report delivered, recorded handoff session, support begins.
| Option | Delivery time | Price |
|---|---|---|
| Standard | 20–30 working days | $6,900 |
| Express | 15–25 working days | $7,950 |
| Rush | 10–20 working days | $8,950 |
What you receive at handover
- A written findings report on up to three AI applications, agents, tools or RAG sources
- Findings ranked by severity and mapped to the OWASP Top 10 for LLM Applications (2025)
- Remediation steps for each finding (recommendations; making the fixes is not included)
- A control test log for the agreed test scenarios, checked against up to 20 of your policy documents
- A recorded 60-minute debrief to walk through the findings, plus 30 days of support for follow-up questions
Expected benefits and how to measure them
- You can see your AI security position at a fixed point in time.
- Fixes can be planned in order of risk.
- Questions from customers or auditors can be answered with a written record.
- Open findings by severity
- Log the report's findings in your issue tracker and count how many remain open each month.
- Time to close serious findings
- Record the date each high-severity finding is fixed against the report date.
- Repeat findings
- Compare any future review against this report to see which issues came back.
Before you start: List the AI applications in scope and any security checks done on them so far. Note any known incidents or customer questions.
These are things to track, not promised results. Outcomes depend on your data, your team and your market.
Running costs
The audit price is one-time and covers the review itself. Ongoing costs after delivery are roughly $20 to $300 a month in your own accounts, for hosting, logging and monitoring tools you may adopt to act on the findings, not for the audit itself.
Any AI model usage during the review is billed directly to your accounts, so nothing runs through a system we control.
Ask about running costsCustom requirements
If you need something outside the Scope Card, such as more than three systems in scope, add a note at checkout. You get a written Change Quote, and that work only starts once you accept it. Larger or bespoke projects go through the Custom AI request form instead.
Request a custom versionKeep it running
Once the report is delivered, monthly maintenance covers monitoring and change hours for follow-up work such as re-checking a fixed finding. It starts after the 30 days of included support and can be cancelled any month.
$345/mo (5% of the build price a month, includes 3 change hours)
Optional. Starts after the post-launch support period. Cancel any month.
How maintenance worksHow this compares
| Do it yourself with a SaaS tool | Hire a custom agency | Upmark Labs | |
|---|---|---|---|
| Price | A scanning tool charges a recurring subscription regardless of findings | A security firm quotes after a scoping call | Ours is one fixed price, shown on this page before you buy |
| Scope | A scanning tool covers whatever its rule set knows | An agency agrees scope during the engagement | Ours is written on the Scope Card, up to 3 systems |
| Delivery | A scanning tool still needs configuration before results mean anything | A security firm engagement often takes weeks to schedule | Ours has a fixed delivery time shown before you buy, with faster options |
| Output | A scanning tool produces a dashboard you interpret yourself | An agency report format depends on what was agreed | Ours is a written, severity-ranked findings report plus a walkthrough |
| Certification | A scanning tool does not certify anything on its own | An agency may offer certification as a separate service | Ours is a review only; no certification is implied |
Questions about this product
Is AI Security Audit a one-time report or an ongoing service?
It is a one-time, point-in-time review. You get a written report with findings ranked by severity, a control test log and a recorded walkthrough, and then the engagement ends. If you want ongoing checks afterwards, AI Security Monitoring or monthly maintenance covers that. The delivery time for each speed is shown in the panel on this page.
What does the AI Security Audit actually test?
Within the systems you authorize, we run tests mapped to the OWASP Top 10 for LLM Applications (2025). They check how prompts and inputs are handled and how credentials and API keys are stored. They also check what data the application can read or write, and what gets logged. Findings come with severity and remediation guidance, not raw scan output.
Do you fix the issues the audit finds?
No, the audit identifies and ranks issues; implementing fixes is your team's work or a separate engagement. We do include two rounds of changes to the report itself if something needs clarifying, and the 60-minute handoff session walks through what each finding means in practice and roughly how urgent it is.
How much access do you need for the audit?
We need written authorization for testing plus read access to the systems and logs in scope, shared by adding our team as a user or creating a key you control rather than shared by email. We only test what you have explicitly authorized, and nothing outside that agreed list is touched during the review or afterward.
How is this different from AI Application Security Agent?
AI Security Audit is a single point-in-time report; AI Application Security Agent is an ongoing agent that scans your code and dependencies continuously as you build. Many teams start with the audit for a baseline understanding, then add the Application Security Agent for continuous coverage as development keeps moving afterward.
What happens if the audit finds something serious?
Serious findings are flagged at the top of the report with clear severity ranking, and we walk through them first in the handoff session. We do not take any automatic action on your systems; a human on your team always decides what gets fixed, in what order, and when.
How much does it cost to run after the audit is delivered?
The audit itself has no ongoing cost once the report is delivered. If you adopt logging or monitoring tools to track the issues we found, expect roughly $20 to $300 a month in your own accounts, depending on what tools you choose to put in place. We are happy to recommend a starting point if you are unsure what to put in place.
Know where your AI systems actually stand.
Order AI Security Audit and receive a written, severity-ranked findings report on a fixed delivery date, scoped to the systems you name.
Works well with
Assessment
AI Security Review Assistant
Reviews designs, architecture changes and new integrations for security risk, using a threat model.
Assessment
AI Application Security Agent
Scans application code and dependencies for security issues.