AI INTEGRITY
SOLUTIONS LLCSECURITY ASSESSMENT
SOLUTIONS LLCSECURITY ASSESSMENT
Final technical result · tested scope
Application Security Penetration Test
Technical report and finding details
Application security penetration testing
We attack your systems the way real adversaries would, then prove what we found.
Certified testers work through your web apps, APIs, cloud and AI features by hand. Every finding lands in your dashboard as it is confirmed, with steps to reproduce and a fix. When you are done, you get a technical report and a signed letter of attestation.
tester@ais:~$ nmap -sV -p- --min-rate 2000 staging.example.com PORT STATE SERVICE VERSION 443/tcp open https nginx 1.24.0 8443/tcp open https Node.js Express tester@ais:~$ ffuf -u https://staging.example.com/api/FUZZ -w api-routes.txt -mc 200,401,403 v1/users [Status: 401] v1/export [Status: 200] v1/admin/audit [Status: 403] tester@ais:~$ curl -s -H "Authorization: Bearer $LOW_PRIV" /api/v1/users/1042/invoices {"invoices":[{"id":88121,"owner":1042,"total":"4,210.00"}]} ▲ HIGH IDOR on /api/v1/users/:id/invoices — cross-tenant read confirmed tester@ais:~$
Reports map findings to the frameworks your auditors ask about
- SOC 2
- ISO/IEC 27001
- PCI DSS 4.0
- HIPAA
- NIST SP 800-115
- OWASP ASVS
- OWASP LLM Top 10
One place to follow the test, fix what we find, and ask for a retest
No waiting weeks for a PDF. Findings appear the moment a tester confirms them, so your engineers can start fixing while the test is still running.
Customer portal — web & API
Oct 14 – Oct 25 · 2 testers assigned · Credentialed, grey-box
| ID | Finding | Severity | CVSS | Status |
|---|---|---|---|---|
| F-01 | Cross-tenant invoice read through user ID in URL (IDOR) | High | 8.1 | Fix in progress |
| F-02 | Password reset token valid after use | Medium | 6.5 | Ready for retest |
| F-03 | Support chatbot reveals system prompt via prompt injection | Medium | 5.9 | Open |
| F-04 | Missing rate limit on login allows credential stuffing | Medium | 5.3 | Fixed & verified |
| F-05 | Verbose stack traces returned on malformed JSON | Low | 3.7 | Fixed & verified |
| F-06 | Session cookie missing SameSite attribute | Low | 3.1 | Open |
Live findings
Each finding includes impact, proof of exploitation, and steps to reproduce.
Talk to your testers
Comment on a finding and get an answer from the person who found it.
Retests included
Mark a fix as ready and we verify it, then update the report.
Push to your tracker
Send findings to Jira, GitHub Issues or Linear with one click.
What we test
Every engagement is manual, led by an experienced tester, and backed by automated coverage. Pick a target to see what is in scope.
Web application pentest
Authenticated and unauthenticated testing of your app's business logic, access control and data handling, following the OWASP Web Security Testing Guide.
See the full scope, standards and checklist- Broken access control and IDOR
- Authentication and session flaws
- Injection: SQL, NoSQL, command, template
- Business-logic abuse
- File upload and SSRF
API pentest
REST, GraphQL and gRPC endpoints tested against the OWASP API Security Top 10, using your specs and real tokens for each role.
See the full scope, standards and checklist- Object- and function-level authorization
- Mass assignment
- Rate limiting and resource exhaustion
- GraphQL introspection and batching abuse
- JWT and OAuth misconfiguration
AI & LLM application pentest
Adversarial testing of chatbots, copilots and agents built on large language models, mapped to the OWASP Top 10 for LLM Applications and NIST AI RMF.
See the full scope, standards and checklist- Direct and indirect prompt injection
- System prompt and training-data leakage
- Excessive agency in tools and plugins
- Insecure output handling
- Jailbreaks and guardrail bypass
Cloud security assessment
Configuration review and attack-path testing across AWS, Azure and Google Cloud, from a leaked key or a compromised workload to your crown jewels.
See the full scope, standards and checklist- IAM privilege escalation paths
- Public storage and snapshots
- Kubernetes and container escape
- Secrets in code and pipelines
- Logging and detection gaps
Internal & external network pentest
Find what is exposed on the internet and how far an attacker gets once inside, including Active Directory attack paths.
See the full scope, standards and checklist- Exposed services and vulnerable versions
- Active Directory privilege escalation
- Credential reuse and weak passwords
- Network segmentation testing
- Lateral movement
Mobile application pentest
iOS and Android apps and their back-end APIs, following the OWASP Mobile Application Security Testing Guide.
See the full scope, standards and checklist- Insecure local data storage
- Certificate pinning bypass
- Hard-coded secrets
- Deep link and intent abuse
- Back-end API authorization
Why a scanner is not a pentest
Automated scanners are useful, and we run them too. But the issues that lead to breaches are usually logic flaws that only a person finds.
| Capability | Automated scanner | AI Integrity pentest |
|---|---|---|
| Finds known vulnerable versions and misconfigurations | Yes | Yes |
| Finds broken access control and business-logic flaws | No | Yes |
| Chains small issues into a real attack path | No | Yes |
| Proves impact with evidence and steps to reproduce | No | Yes |
| False positives removed before you see the report | Partly | Yes |
| Counts as a penetration test for PCI DSS 11.4 | No | Yes |
| Retest of your fixes and a signed letter of attestation | No | Yes |
How an engagement runs
Most tests go from kickoff to signed attestation in three to four weeks.
Scope
We agree on targets, test accounts, rules of engagement and testing windows. You get a fixed quote.
Recon
We map your attack surface: hosts, routes, roles, third-party services and data flows.
Exploit
Testers chain weaknesses the way a real attacker would and confirm impact without harming production.
Report
Findings are rated with CVSS 3.1, with proof, business impact and a clear fix for each one.
Retest
Once you have fixed an issue, we verify it and update its status in the report.
Attest
We issue a signed letter of attestation you can share with customers and auditors.
What you receive at the end
Two documents, written for two audiences.
- Technical report
- For your engineers. Scope, methodology, every finding with evidence and remediation, and retest results.
- Letter of attestation
- For your customers and auditors. Confirms the test was performed, what was in scope, and that high-risk findings were resolved.
Letter of attestation
Example Corp
completed an application security penetration test performed by AI Integrity Solutions LLC between October 14 and October 25, 2026. All high-severity findings were remediated and verified by retest.
J. DoeLead tester
AIS-2026-114Reference
Sample document
What your auditor will ask for, and what we hand over
Each report states the scope, dates, methodology and retest results that auditors look for. Your auditor decides what evidence is enough, so share this table with them early.
| Framework | What it asks for | What we provide |
|---|---|---|
| SOC 2Trust Services Criteria CC4.1 and CC7.1 | Evidence that you evaluate your controls and identify vulnerabilities. | Technical report and letter of attestation |
| ISO/IEC 27001:2022Annex A 8.8 and 8.29 | Management of technical vulnerabilities and security testing before release. | Technical report with remediation and retest results |
| PCI DSS 4.0Requirement 11.4 | Internal and external penetration tests at least every 12 months and after significant changes, with retests. | Report covering methodology, findings and retests; segmentation testing on request |
| HIPAA45 CFR 164.308(a)(8) | Periodic technical evaluation of the safeguards that protect health data. | Technical report and letter of attestation |
What a finding looks like
Written so the developer who picks it up can reproduce it in minutes.
F-01 · Cross-tenant invoice read through user ID in URL
CVSS 3.1 · 8.1 · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NImpact
Any signed-in user can read invoices belonging to other customers by changing the numeric ID in the request. In testing, we read invoices from three tenants using a free trial account.
Fix
Check that the invoice owner matches the tenant on the session before returning data, and use non-sequential identifiers. Add an authorization test for this route.
OWASP API1:2023 · CWE-639 · ASVS V4.2.1
Steps to reproduce
# 1. Sign in as a trial user (tenant 2201)
curl -s -X POST https://staging.example.com/api/v1/login \
-d '{"email":"[email protected]","password":"•••"}'
# 2. Request another tenant's user ID
curl -s https://staging.example.com/api/v1/users/1042/invoices \
-H "Authorization: Bearer $TRIAL_TOKEN"
# 3. Response contains tenant 1042's data
{"invoices":[{"id":88121,"owner":1042,...}]}Fixed prices, agreed before testing starts
You know the full cost before kickoff. Retests and the letter of attestation are always included, never billed as extras.
Essential pentest
For one web application or API getting ready for a customer security review or a first audit.
$3,500 per engagement
- One web application or API in scope
- Up to 5 days of manual testing by a certified tester
- Findings in the platform as they are confirmed
- Technical report with CVSS scores and fixes
- One retest within 90 days
- Signed letter of attestation
Custom engagement
For several applications, cloud, network or AI systems, or a recurring testing program.
Quoted after a scoping call
- Any mix of web, API, AI & LLM, cloud, network and mobile
- Testing days sized to your scope
- Quarterly or annual testing schedules
- Unlimited retests during the engagement
- Reports mapped to SOC 2, ISO 27001, PCI DSS or HIPAA
- A named lead tester for every engagement
Prices in US dollars. Your scope is confirmed in a written quote before any testing begins.
Questions we hear before every engagement
Something else on your mind? Ask us directly.
Will testing break production?
We agree on testing windows and rules of engagement before we start. Tests that could take systems down or delete data are excluded unless you ask for them in writing. When staging matches production, we test there.
How long does a pentest take?
Testing itself takes 3 to 10 days depending on scope. From kickoff to signed letter of attestation, most engagements take three to four weeks, including time for your team to fix and for us to retest.
What does the $3,500 Essential pentest include?
One web application or API, up to 5 days of manual testing, live findings in the platform, the technical report, one retest within 90 days and a signed letter of attestation. Larger scopes get a fixed quote.
What is the difference between a vulnerability scan and a pentest?
A scanner checks for known issues automatically. A pentest is a person working through your application like an attacker, finding logic and access-control flaws that tools miss and proving their impact. Auditors and frameworks such as PCI DSS ask for the second.
Can we share the results with our customers?
Yes. Share the letter of attestation: it confirms the scope, dates and that high-severity findings were fixed, without exposing technical details. Keep the full technical report internal.
Is the retest really included?
Yes. The Essential pentest includes one retest within 90 days, and custom engagements include unlimited retests while the engagement is open. The report is updated with the results.
Do you test AI features such as chatbots and agents?
Yes. We test applications built on large language models for prompt injection, data leakage, unsafe tool use and guardrail bypass, following the OWASP Top 10 for LLM Applications.
Tell us what you need tested
We reply within one business day with questions about scope and a proposed timeline.
AI Integrity Solutions LLC324 Blackwell St, Suite 900
Durham, NC 27701, United States