AI System Security Audit: Secure AI audit
Secure AI audit is a 10-day review of one operational AI workflow: what data flows into the model and external services, who gains access to sources via AI, completeness of logs, and identification of data leakage and prompt injection risks. The deliverable is a risk register and a remediation roadmap.
AI Systems Security Audit
RESTART Group — AI system security audits for companies where AI assistants, RAG, or external AI services are already handling corporate data.
An audit is needed when a company already has an AI pilot, RAG, chatbot, or uses external AI services, but lacks confidence in data security and risk management. It falls under the direction AI safety: protection mechanisms for LLM and RAG, as well as typical threats, are also described there. The use of AI in information security operations—analyzing SOC and SGRC events—is a separate task: AI in information security.
Login Format
The audit addresses the question that arises after deployment: what exactly is happening with data and access within the operational AI system, and what risks has the company inadvertently accepted? We analyze the entire system—from data sources and access rights to logs, integrations, and external services—and conclude with a risk register and a remediation plan.
The audit does not rewrite the solution or replace development: it documents the current state and priorities. If an production environment needs to be designed afterward, that is separate work.
What's included
Data
What information is sent to the model and external services, where requests and responses are stored, how long they are retained, and who can access them.
access rights
Who administers the perimeter, what roles are assigned to users and service accounts, and to which sources do they receive rights through IAM.
Architecture
Model composition and RAG pipeline, integration with corporate systems, log completeness, environment separation, and operational procedures.
Risks
Personal data and trade secrets in queries, hallucinations in high-stakes scenarios, prompt-based instruction injection, vendor lock-in.
If the audit shows that the scenario can be put into commercial operation, the next step is design secure AI automation: architecture, roles, logs, human-in-the-loop and rules of operation of AI agents.
Volume limits
The package covers one agreed-upon environment. What exactly constitutes a environment is fixed prior to the contract.
- one AI application or one use case of an external AI service; one environment;
- up to two models or providers, three data sources, five integrations;
- up to five trust boundary intersection points—these are agreed-upon exchange channels (provider's external API, application's public API, corporate storage connection), not a requirement to verify every API operation;
- up to six role categories and eight interviews;
- Up to 20 documents with a total volume of up to 400 pages and up to ten approved exports of configurations and logs totaling up to 1 GB.
What is needed from the client
- environment diagram, component list and integrations;
- description of roles and data, query and response storage settings;
- available contractual terms of AI providers;
- read-only access or prepared data exports.
If an external service is used, we check the settings and information available to the customer—neither we nor you have access to the provider's internal infrastructure.
What is not included
- active penetration testing, load and destructive checks;
- Full source code audit, verification of model weights and training dataset;
- unlimited red teaming;
- configuration fixes;
- Certification and confirmation of full compliance with all legislative requirements.
Active testing and re-verification after fixes are separate items and are evaluated outside this package.
When the work is completed
- verified controls, evidence, risks, and audit limitations are specified for all elements of the agreed-upon perimeter;
- each risk has been assigned a priority, a recommended measure, and a responsible role;
- unverified questions are clearly highlighted in a separate list;
- The defense of the results has been conducted.
The absence of critical findings is not a guarantee of the absence of vulnerabilities: an audit reflects the perimeter's state at the time of assessment. The conclusion "not yet ready for production deployment" is just as valid a result as a list of fixes.
Output documents
| Artifact | Why is it needed? |
|---|---|
| Risk register | Identified risks with significance assessment and indication of their specific causes |
| Safety Checklist | Data, access, and log requirements enabling the environment to be re-verified independently and internally |
| Architecture analysis | Weak points of the current scheme: where data leaves the perimeter, where logs are missing, and where roles are blurred |
| Roadmap to Elimination | What to close before production operations, what can be postponed, with sequencing and responsible roles |
The package is supplemented with a perimeter passport that includes a methodology, a data architecture and flow diagram, a matrix of tested controls with evidence, and a re-verification checklist—using this, you or another contractor can re-test the scope after corrections have been made.
Package budget
Package budget: 700K – 1.4M RUB excluding VAT.
The exact fixed price is determined after the initial meeting and scope verification; included work, deliverables, and exclusions are confirmed prior to commencement; any scope expansion is possible only upon agreement.
Active testing (penetration testing of the AI/API perimeter) and retesting after remediation are assessed as separate items.
Team composition
- Information Security Architect — data processing mode, access controls, logs, regulatory requirements for your perimeter.
- AI Architect — models, RAG, prompts, integrations, and abuse scenarios involving them.
- Data Engineer — sources, composition of transmitted data, masking, and storage.
- Project Manager — interviews, gathering materials, coordinating conclusions, and delivering the result.
Pentest of AI/API environment
If the AI solution publishes an API, widget, callback point, proxy, or integration with external services, a pentest may be required after a Secure AI audit. It does not check the model as such, but web/API, authorization, access rights, file handling, prompt and API abuse scenarios, and secure loop boundaries.
Frequently asked questions
What does an AI security audit check?
Data: what goes into the model and external services, where requests and responses are stored. Access: user roles and service accounts, permissions to data sources via AI. Architecture: models, RAG, integrations, logs, environment segregation. Risks: personal data and trade secrets in queries, hallucinations, prompt injection, vendor lock-in.
How long does an AI security audit take and how much does it cost?
10 business days for one agreed scope. Package budget — 700K – 1.4M RUB excluding VAT; the exact fixed cost is determined after the kick-off meeting and scope verification.
Do you check for prompt injection and data leaks?
The audit assesses the risks of prompt injection and data leaks: where they may occur and what measures are needed. Active testing is not included in the package and is evaluated as a separate item.
Does AI penetration testing fall under an audit?
No. If an AI solution publishes an API, widget, proxy, or integration with external services, a pentest of the AI/API perimeter may be required after the audit: it checks web/API security, authentication, access controls, file handling, and prompt abuse scenarios.
Is this a model code audit?
No. The main focus is enterprise architecture, data, integrations, access and operation of AI.
Suitable for external AI services?
Yes, if you need to understand what data and processes fall into the external loop.
Can it be combined with a pilot?
Yes, secure audit can go before the pilot or in parallel with him.
External AI services and attack surface
If AI scripts use public APIs, web widgets, proxies, cloud storage, callback points, or external LLM services, they should be considered part of the external attack surface. As part of the Secure AI audit, RESTART checks not only data and roles, but also which technical points of the AI environment are visible to the outside and how they are controlled.
After the audit: verification of measures and acceptance
Secure AI audit reveals risks and gaps in the AI control loop—it's an architectural assessment, not a measurement. If you need to further test a specific security control (masking, logging, access controls, DLP, SIEM/SOAR, API protection, secure RAG), this is done in the InfoSec lab using a limited set of scenarios. However, if the system requires formal acceptance—with defined thresholds for load and response quality, along with protocols and sign-offs—this is performed on the dedicated test stand. Polygon.
How we fix the volume and deadline
The terms below are identical for all packages and are incorporated into the contract without changes.
- Perimeter — prior to the agreement. We hold an initial meeting of up to 60 minutes and agree on the perimeter passport: systems, processes, sources, participants, and outcomes.
- Countdown of the term. The timeline starts after the handover of the approved set of source materials, provision of access credentials, and confirmation of the interview schedule. Delays on the client's side will postpone the timeline by a corresponding amount of time.
- Data. We operate within a coordinated secure channel. Production data is not transmitted to external AI services without the customer's written permission.
- Result transmission. We provide materials in PDF and editable formats (DOCX, XLSX, PPTX, or agreed equivalents) and conduct one results defense session of up to 90 minutes.
- Acceptance. Five business days are allocated for reviewing the results. One consolidated round of clarifications within the agreed scope is included; however, correction of errors and non-compliances with the contract is not limited to this round.
- Volume change. New systems, sources, and tasks are included only upon agreed changes to scope and cost.
- Work format. The default format is remote, unless an in-person component is explicitly planned for the package.
The statuses and licenses on the basis of which the works are performed are collected on the page "Licenses and statuses".
Email us
Write to us at info@restart.re or click the button below. For the first letter, it is sufficient to briefly describe the outline, the role of the organization, current systems, limitations and the desired outcome.
Email usRequest format
We agree on the volume, timing and output artifact - and launch it in a short time.
