01.1
AI Threat Modeling
AI Threat & Exposure Assessment
Know what your AI can reach, and what to test first
Unmapped AI is unmanaged risk. We chart the identities, data, tools, permissions, and vendor boundaries around your AI systems, then isolate the attack paths that matter. You leave with a ranked assurance plan and a clear view of what to test first.
The Problem
Unmapped Reach, Unknown Risk
Most AI risk begins with one unanswered question: what can this system actually touch? Until you know, you can’t tell whether the next step is pentesting, red teaming, model validation, or a vendor review.
This assessment answers it. We trace how your AI links to users, data, tools, permissions, and downstream systems, find where trust boundaries fail, and settle what should be tested, and in what order.
You’re in the right place if you’re saying:
- AI is going into a sensitive workflow, and we can’t describe its real attack surface.
- Our board, insurer, customers, or regulator wants assurance that we understand the risk.
- We run a vendor’s AI product and have no control over the model underneath it.
- Pentest, red team, model validation, vendor review: we honestly don’t know which one we need.
What We Map
The Layers Behind Your Exposure
Coverage spans every AI system and workflow you declare, pilots and production agents alike, plus the dependencies that decide how far a failure spreads.
Systems and Workflows
Each AI system you declare, and the business process it powers.
Data Flows and Retrieval
Sources, retrieval paths, storage, logs, and retention, traced to show where sensitive data travels.
Identity and Privilege
Identities, roles, secrets, and tool access, examined for excessive privilege and weak trust boundaries.
Model and Provider Boundaries
What you own, what your provider owns, and the handoff points between them.
Integrations
APIs, plugins, any MCP servers, and whatever downstream systems your AI can call.
Logging and Monitoring
Whether your logs and alerts would show what your AI did, what it touched, and who asked, so misuse doesn’t go unseen.
Vendor Terms
Contract clauses and provider terms that shape what can be tested, and where.
Threat Scenarios
High-value misuse cases, ranked, plus the adversaries with the strongest motive to try them.
Control and Documentation Gaps
Where current controls and documentation fall short of your highest risks.
Shadow AI
Unsanctioned AI tools your staff use, found through your identity, endpoint, network, expense, or SaaS data and added to the inventory.
How We Assess
From Blind Spots to a Plan
Each phase sharpens your next decision: what to test, and in what order.
Frame
Pin down which AI systems, workflows, and stakeholders are in scope, which business consequences matter, and who sponsors the work.
Map
Draw the systems, data flows, and trust boundaries from interviews, documentation, and configuration review, and list the models, providers, tools, and MCP servers behind each one.
Threat Model
Identify likely adversaries and misuse scenarios using MITRE ATLAS and the OWASP Top 10 lists for LLM and agentic applications, then trace the attack paths with the greatest potential for material harm.
Qualify and Plan
Sort out what’s testable, match each risk to the right assurance activity, then walk your team through the ranked register and recommended scope in a stakeholder workshop.
Key Outcomes
Know Before You Test
Reveal Your True Reach
See how your AI, its data sources, and your business systems connect, including the paths nobody drew on the whiteboard.
Expose Excess Privilege
Learn how far every identity, agent, and tool can reach, and where that reach exceeds the job it was given.
Prioritize the Right Tests
Spend testing budget on the misuse cases with the largest business consequence, not the loudest headline.
Lock the Scope
Settle which components are testable and what’s off-limits before anyone attacks anything.
Deliverables
What You Walk Away With
System and Data-Flow Insight
A diagram linking your AI systems to the data sources and business systems they touch, because attack paths follow the data.
AI System Inventory
The models, providers, versions, data sources, tools, and MCP servers behind each system you declare, ready for insurers and auditors who ask for an AI bill of materials.
Trust-Boundary and Permission Map
The reach of every identity, agent, and tool, because permissions set the blast radius.
Threat Model and Misuse Scenarios
Misuse cases ranked by consequence, so attention goes where the damage would be largest.
Testability Matrix
What can be tested, what stays out, and why, so the next engagement starts with a clean scope.
Visibility Gaps
Where your logs and alerts would miss AI misuse, because you can’t respond to what you can’t see.
Ranked Risk and Remediation Register
A shared priority list for engineers and executives, because a backlog isn’t a strategy.
Recommended Scope and Framework Crosswalk
A recommended assessment scope, cross-referenced to MITRE ATLAS, OWASP, NIST, and the regulatory and contractual expectations that apply, so your next audit, security review, or procurement call starts prepared. It supports compliance but certifies nothing.
Stakeholder Workshop
A working session with your engineers, risk owners, and sponsor to walk through the results and settle what to test next.
Insurer-Ready Report (Add-On)
Cyber insurer asking about AI? We write the findings up as a report that answers your carrier’s AI questions, and add a review of your AI use policy and staff training. Coverage, terms, and premiums stay your insurer’s decisions.
Common Questions
AI Exposure Mapping Explained
What does a threat and exposure assessment involve?
It’s a structured look at how your AI links to identities, data, tools, and business processes. We identify material attack paths and establish what can be tested. You get a prioritized assurance plan; nothing is exploited.
Should I choose this or an AI penetration test?
Choose this when you need the map. An exposure assessment ranks risk without exploiting anything, while a penetration test, our AI Penetration Testing service, launches real attacks on one defined system to show what’s exploitable and what it would cost. The exposure assessment is built to scope that test.
Our AI is all vendor products. Does this still apply?
Yes. Much of the risk sits in your own setup: how the product is configured, what it’s connected to, and which permissions it holds. We separate your responsibilities from the vendor’s, without attacking the provider’s platform.
Will it uncover all the AI our employees use?
As far as your data shows, yes. Shadow AI discovery is included: we use your identity, endpoint, network, expense, or SaaS data to find unsanctioned AI tools and add them to the inventory. Tools that leave no trace in that data can still slip through.
What do you need from us?
Time with the owners of the in-scope AI systems and workflows, whatever architecture and vendor documentation exists, and a sponsor who can confirm business impact. More context means a sharper plan.
Our cyber insurer is asking about AI. Can this help?
Yes. More carriers now ask about AI use and controls at application and renewal. Add the insurer-ready report, and we map what we found to your carrier’s questions, along with your AI use policy and staff training. Coverage, terms, and premiums stay your insurer’s decisions.
How long does it take?
It depends on how many systems and workflows are in scope, what documentation exists, and how many stakeholders are involved. Your statement of work sets the timeline.
Your Move
Find Your Real Attack Surface
Name the AI systems heading into sensitive workflows. We’ll chart their reach and show you what to test first.