AI security assessment services in India
We record what each AI system you run can reach, which published risks apply, and where testing should start.
Scope comes first
We record which ones it rules out, before anyone tests.
NIST's AI Risk Management Framework touches security in one subcategory, MEASURE 2.7: "AI system security and resilience – as identified in the MAP function – are evaluated and documented." Categorisation comes first: MAP 2, "Categorization of the AI system is performed"; MAP 2.1 asks for its tasks and methods to be defined.
What we record
An AIBOM (AI bill of materials) lists what a model is built from, not whether it can move money. We add that.
Every tool it can call, its schema, and the identity each call runs as. LLM08:2026 Hidden Context Exposure counts tool schemas as hidden context (unseen by users); LLM03:2026 Excessive Agency traces to excessive functionality, permissions and autonomy.
Every retrieval corpus, and who can add a document to it. That decides whether indirect prompt injection (orders hidden in a fetched document) is in scope.
Which screen renders the answer, which query it can land in, and which system acts on it before a person reads it.
Yes or no on fine-tuning, and on self-hosted weights. Together they decide whether LLM05:2026 Data and Model Poisoning is in scope.
An AI security configuration review of guardrails, logging and retention, from your side of the console: what is filtered, recorded, and kept for how long.
Your console export of projects, key labels, purposes and cost centres. It shows how many model consumers exist.
The applicability list
Entries from the OWASP Top 10 for LLM Applications, 2026 edition; tests from the OWASP AI Testing Guide v1 (AITG).
| System as deployed | In scope | Ruled out, and why |
|---|---|---|
| Hosted model on a vendor API. No retrieval, no tools, never fine-tuned. | LLM01:2026 Prompt Injection, LLM02:2026 Sensitive Information Disclosure, LLM06:2026 Unbounded Consumption, LLM08:2026 Hidden Context Exposure. AITG-APP tests. | LLM05:2026 Data and Model Poisoning: no Model or Training Data Control. AML.T0053 AI Agent Tool Invocation: ATLAS tags it Agentic AI only, and this system has no tools. AITG-MOD-01 to 07: you don't hold the model. |
| The same model with a retrieval index over internal documents. | Adds LLM09:2026 Vector and Embedding Weaknesses and the disclosure half of LLM02:2026. AITG-DAT and AITG-INF tests. | Indirect prompt injection through retrieval, if nobody outside your team can add a document. |
| A model with callable tools, acting between sessions. | LLM03:2026 Excessive Agency and ATLAS's Agentic AI techniques, including AML.T0053. Tool identity and scope are tested first. | Nothing, but OWASP's Agentic list applies as well. |
| Self-hosted open-weights model, fine-tuned in-house. | LLM04:2026 Supply Chain, LLM05:2026 Data and Model Poisoning, AITG-MOD-01 to 07. Model Control and Training Data Control exist. | Approaches that assume a vendor API and query access only, including any provider testing route. |
| Predictive model: a classifier, scorer or recommender with no language interface. | NIST's six capabilities (2.1.3) and ATLAS's Predictive AI techniques. | The whole OWASP LLM list: it describes a generative system this is not. |
Your report's last column names the next engagement: an LLM security test, an agent tool-permission review, a generative AI security test, guardrail design and verification, or none.
How we work
With a governance register, we reuse its system IDs.
We fill in each system's record from your exports.
Four axes per system, then the applicability list.
Per system, with the access to arrange first.
What this is not
The AI governance register says who approved a system and what it may decide alone. Our record says what a stranger can make it do, and how far the damage travels.
We add security columns on the register's IDs, making an AI system security inventory. We use MEASURE 2.7 and MAP 2 of the NIST AI RMF only to set the order (categorise, then evaluate).
Not an audit, and not continuous. SecWiz is not a CERT-In empanelled auditing organization; where a regulator requires one, that audit is not this work. Monitoring set-up, incident response and ongoing retainers are separate engagements (see managed security services), as is any ongoing re-testing a published framework recommends.
Technical detail
ATLAS content version 2026.08 had 16 tactics and 197 techniques when this was written. Each technique has a maturity label (Feasible, Demonstrated or Realized) and overlapping platform tags: Agentic AI 129, Generative AI 99, Enterprise 80 and Predictive AI 78, or 386 tags in all.
Published 26 November 2025: AITG-APP-01 to 14, AITG-MOD-01 to 07, AITG-INF-01 to 06 and AITG-DAT-01 to 05, 32 tests in all. AITG-APP-02 cites LLM01:2025, and AITG-APP-07 cites LLM07:2025 System Prompt Leakage, a name the 2026 edition retired. We map those forward by hand, and the report says where.
Section 2.2 of the AIBOM guidelines applies them "especially in" Government, Public Sector, Essential Services Organizations and the software export and services industry, so the list is indicative; 9.4.1.1 reaches organizations involved in AI-driven development and services. 9.4.1.3 states that "Government, public sector, and essential services organizations must ensure that an AIBOM is maintained for all AI systems being used, procured, and developed".
9.4.1.5 points to formats "such as Software Package Data eXchange (SPDX) or CycloneDX", so a vendor's AIBOM is a starting point; our gap list marks each element present, absent or vendor-supplied (see also AI vendor risk).
CERT-In's Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure, Version 1.0, 25.05.2026, has a row "Inventory and Visibility of AI Systems" with the objective "Maintain visibility into AI systems, integrations, APIs, and third-party AI dependencies", and a measure, "Define operational boundaries and permissions". It sets no minimum elements.
Circular SEBI/HO/MIRSD/DOS2/CIR/P/2019/10 of 4 January 2019 required a return per system that asked about capabilities: order initiation, routing and execution; disseminating investment or trading advice or strategies; and use in cyber security to detect attacks. We start from your latest Annexure A submissions.
FAQ
No. We reuse your register's system IDs and add the security columns it lacks: tools, the identity each tool call authenticates as, retrieval corpora and who can write into them, and where output goes. Without one, we go through repositories, model registries and provider bills, and the report says on page one that this is not the governance register.
A security record per system; a classification on four published axes; an applicability list of the OWASP 2026 entries and AI Testing Guide families in scope, and those ruled out with the reason; and each system's next engagement. Buyers inside CERT-In's stated AIBOM scope also get a gap list against the nineteen minimum elements in Table 10. We sign the classification and the list; your named system owner signs what each system is and may reach. Any finding is re-checked once fixed.
No. We send no payloads (test inputs) and attempt no extraction; drawing hidden context out through the chat is an LLM security test. We read it as the application assembles it: OWASP's LLM08:2026 Hidden Context Exposure says to assume hidden context is discoverable, so nothing in it should be treated as secret; we report what should not be in there. A finding gets a CVSS v4.0 score and reproduction detail. If none, the report says so.
No. CERT-In's Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM (Version 2.0 Dated 09.07.2025) set out nineteen minimum AIBOM elements in Table 10 at section 9.3: what a model is built from, trained on and for. As whole words, the file has no "RAG", "LLM" or "system prompt". Its one security element, "Security Requirements", is defined as "Encryption methods and access control mechanisms used to protect model data and user information." Nothing records whether the system can send an email or issue a refund. Keep the AIBOM for supply chain and procurement; add reach alongside.
It decides which attacks are possible. NIST AI 100-2 E2025 names four attacker capabilities for generative systems at 3.1.3: Training Data Control, Query Access, Resource Control and Model Control. A hosted model on a vendor API, never fine-tuned, has Query Access, plus Resource Control only if an outsider can get a document into what it reads. Without Model Control or Training Data Control, LLM05:2026 Data and Model Poisoning is ruled out in writing, with the reason.
The 2026 edition, with the year on every identifier, because OWASP's own landing page still serves the 2025 list. Seven of ten entries were renumbered and one renamed: Excessive Agency moved from LLM06:2025 to LLM03:2026, Improper Output Handling from LLM05:2025 to LLM10:2026, and System Prompt Leakage became LLM08:2026 Hidden Context Exposure, with a wider scope. OWASP weights its ranking: community vote three-quarters, incident data one quarter, so the order says nothing about danger in your deployment.
No, and it is not an audit. CERT-In's July 2025 audit policy states that "limited lists such as OWASP Top 10, SANS Top 25 and similar, should not be considered as standards or references for audits". Whether "and similar" covers the OWASP LLM list is not stated, so the report records it as unresolved. SEBI's Annexure A asked whether the AI or ML system is included in the system audit, if applicable. Where a regulator requires a CERT-In empanelled auditing organization, SecWiz is not one and this work is no substitute.
The last column of the applicability list names each system's next engagement, or none, and the access to arrange first: tool schemas and the identity each tool runs as, a route into the retrieval index, a non-production instance, or a written answer on fine-tuning.
Let's talk
Say whether each system retrieves documents, calls a tool or was fine-tuned, and whether a governance register exists. Add any regulator clause or form. We work remotely from India during business hours. We reply within one working day.