The model layer
LLM Security Audit
Can your model be made to do something it should not? Audit the prompt, output and data-handling layer.
An LLM security audit examines what a language model system can be made to do by text it did not expect, and what happens when it is. This one asks up to 21 questions across nine control domains, drops the ones your deployment shape has no surface for, and returns a score out of 100 with one of three verdicts.
It is a self-assessment. Nothing here connects to a model, sends it anything or tests it, so the result describes the deployment you described and not the deployment.
Two things can hold that verdict down whatever the score. If every link of the chain from untrusted content to an effect reads 1 or below, the answers describe a complete path and the verdict goes to HIGH EXPOSURE regardless of the number. And a top verdict cannot sit on a control that reads zero, because a weighted average would otherwise fill the hole in for you. Neither gate can ever improve a verdict. The whole method is published, weights and bands included, so you can recompute the number by hand.
Nothing is fetched from your systems and nothing you type is stored by us: your answers ride inside your own result link. Opening or sharing that link sends the address, and so the answers, to our host the way any URL does, where it appears in ordinary server logs. Nothing in it names you or your company. It is a self-assessment of design and evidence, not a penetration test, not an audit of a running system, and not a certification.
What can your system actually reach?
The questions depend on the shape of the deployment, not on what it is called. A model with no tools has no tool permissions to scope, so those questions are dropped rather than scored against you. Pick the narrowest one that is still true.
Results are subject to the Terms, which cover how a result may be described to somebody else. Nothing you answer is stored or sent to us.
Common questions
- Which profile should I pick?
- Pick by what the system can reach rather than by what it is called. If it only ever produces text from the conversation, pick assistant. If it pulls in documents, tickets, pages or records at run time, pick retrieval. If it can call a tool or take an action, pick agent, which keeps everything in the other two and adds the questions about blast radius.
- Is this a penetration test?
- No. Nothing here touches your system. It is a structured self-assessment of design and evidence, scored from answers you supply and that we cannot verify. A penetration test attacks a running system and reports what it achieved, which is a different question and a useful one.
- Why does a good score still come back as HIGH EXPOSURE sometimes?
- Because a gate fired. If every link of the chain from untrusted content to an effect reads 1 or below, the answers describe a complete path and the score is not the point: a weighted average can be pulled up by nine strong controls while the one thing standing between a hostile document and an action is missing. A gate can only ever make a verdict worse.
- Why are some questions missing for my profile?
- Because your deployment shape does not have that surface, so the question is dropped rather than scored. A model with no tools has no tool permissions to scope, and grading it on them would invent a finding. The weight is removed from the denominator instead of counting as a failure.
- What happens to my answers?
- Nothing you type is stored by us and no answer goes into a database. The answers ride inside the result link itself rather than in a record we keep, which is why the page works for someone you send it to and why there is nothing here tying a verdict to a person. It does mean that opening or sharing a result sends that address to our host the way any URL does, where it appears in ordinary server logs. Nothing in it names you, your company or your systems.
The three profiles, briefly
Assistant. A model answering from its own weights plus whatever is in the conversation. No documents pulled in at run time, no tools it can call, no actions it can take.
Retrieval. A model that pulls in documents, tickets, pages or records at run time and answers from them. Content it never saw in training reaches it every time somebody asks a question.
Agent. A model with tools it can call, systems it can reach and effects it can cause. It may also retrieve documents and keep memory between sessions.