Rockfort Red · live
Walk into every security review with the answers already prepared.
The security review stopped being a formality. It is a filter, and it is where deals stall.
A report formatted for procurement, in 48 hours. Setup in under an hour.
How it works
From one endpoint to a finished report in 48 hours
- Hour 0
Connect one endpoint
No code changes and no infrastructure work. Setup takes under an hour.
- Hours 1 to 47
We attack it
Thousands of automated scenarios against the live system, mapped to OWASP LLM Top 10 and MITRE ATLAS.
- Hour 48
You get the report
Severity-rated findings and a summary written for procurement. A re-test once you have fixed things.
System prompt revealed through a language switch
- Severity
- High
- Maps to
- OWASP LLM07 · System prompt leakage
- What happened
- Asked to reply in another language, the assistant repeated its full system prompt, including the names of two internal tools.
- Fix
- Move tool names and access rules out of the prompt. Add an output check for prompt text.
- Re-test
- Fixed, and confirmed on re-test.
A finding, the way your buyer will read it
What we test
- Prompt injection, direct and hidden in documents and tools
- Jailbreak chains and nested roleplay
- System prompt leaks
- Data exfiltration, mapped to MITRE ATLAS
What you get back
- Findings mapped to the OWASP LLM Top 10
- Severity ratings your engineers can act on
- A summary written for your buyer's procurement team
- Prioritised fixes, then a re-test
A recruitment technology company was stuck in an enterprise customer's security review
We red teamed their AI product. They cleared the review, and the deal moved.
"Rockfort helped us identify vulnerabilities before a Fortune 500 customer review."
Questions we get
How is this different from a penetration test?
Pen tests were built for networks and web apps. They do not cover prompt manipulation, jailbreaks, or injection hidden in documents and tools. Red is built for AI systems, and the report maps to what procurement teams ask for.
How quickly do we get results?
Setup takes under an hour. The report arrives within 48 hours. Once you fix what we find, we re-test within the same week.
Does it work with our LLM stack?
OpenAI, Anthropic, Gemini, Azure OpenAI, open-source, fine-tuned or self-hosted. Red connects at the API layer, with no changes to your application.
Do you need our code or data?
No. We test your endpoint through its interface, the way an external attacker would. No source code, no training data, no internal systems.
What does the first assessment cost?
Nothing. Your first managed red team assessment is free, report included. Paid plans add recurring testing.
Hand over the report before they ask for it.
Your first managed red team assessment is free. Book a 20-minute call, or run the free Red Check yourself first.