I check the security of AI systems and infrastructure that are already running
The check covers AI agents, search over your own documents (RAG), MCP servers and infrastructure. I work from the OWASP LLM Top 10, a list of the main vulnerabilities in AI systems.
Prompt injection is when someone slips the model an outside instruction and it follows it. I also check for poisoned documents in knowledge-base search, tampered MCP tools and attacks that run up your model bill
I run 10+ AI systems of my own around the clock. I managed a $1.34M ad budget and saw advertising systems from the inside
The fine for a repeat personal data leak is 1–3% of revenue, and no less than 20M ₽. Limits on foreign software under critical information infrastructure (CII) rules apply to the owner of a significant object
Three options: from a quick diagnostic to ongoing support
The express diagnostic shows how serious the problems are. A full audit is for when the risks are high or you need to meet legal requirements. Ongoing support keeps your defenses in order as new kinds of attack appear.
The article on personal data and AI models explains what such a diagnostic looks for, which fines the law sets and how to check the essentials yourself in twenty minutes.
Express diagnostic
A quick first check: a shortened checklist, one attack shown live and a PDF with the five main risks. Afterwards you'll know whether you need a full audit.
- A 60-minute intro call: how the system is built, which language models and integrations it uses, where personal data is stored
- Six hours of checks against a shortened checklist
- I show one attack live: prompt injection, a DNS or SSL misconfiguration, or an exposed .env file with keys
- A 4–6 page report: the five main problems by urgency, their risk level, and the exact commands and code to fix them
- A 30-minute walkthrough of the results
Full security audit
A full attack simulation in four areas: AI and language models, infrastructure, personal data, business logic. A 30–50 page report, attacks shown live and 30 days of answers to your questions.
- A full attack cycle based on the OWASP LLM Top 10 (2025 edition)
- Four areas: AI and language models 40%, infrastructure 25%, personal data 20%, business logic 15%
- A 30–50 page final report with evidence, with each finding mapped to legal requirements
- I show the 1–2 most dangerous attacks on your system live
- A 90-minute walkthrough of the report, then 30 days of answers to questions about the fixes
The price ranges from 400,000 ₽ to 1.1M ₽, depending on the scope and the number of AI agents in the system
Ongoing support
New ways to attack AI systems keep appearing. With ongoing support, I keep your system's list of threats up to date and check the system against it again.
- Basic, 52,000 ₽: a monthly re-check, Telegram alerts about new vulnerabilities (CVE), 2 hours for your questions
- Basic also includes a quarterly report on how the risks are changing
- Extended, 130,000 ₽: I review new AI features before release, two a month
- Extended also includes one day a week working alongside your team
- Extended also includes briefings on new threats and a response to critical findings within 24 hours
19 checks in four areas
The checklist is built around risk. The AI checks are based on the OWASP LLM Top 10 (2025 edition). Infrastructure is the foundation: without it, the rest of the protection doesn't hold. 152-FZ applies to anyone who handles personal data, and 187-FZ to owners of CII objects. The industry checks come from what I've seen in ad accounts and online stores.
AI and language model security
OWASP LLM Top 10 (2025): 8 checks
Direct prompt injection
Talking the model into breaking its rules: role-play, pressure over several turns, commands hidden in base64, Unicode or ROT13
Indirect prompt injection through documents, files and webhooks
The attack arrives through data the model loads on its own.
Source: EchoLeak CVE-2025-32711, CVSS 9.3
System prompt leakage (LLM07:2025)
Getting the model to reveal its system prompt. Access keys and internal service addresses are sometimes written into it
Excessive agency (LLM06:2025)
An agent with write access to a system does things it shouldn't.
Source: CVE-2025-53773 GitHub Copilot RCE, CVSS 7.8
Unbounded consumption (LLM10:2025)
Without a spending cap, the model bill can reach $10k a month: an attacker simply keeps sending requests.
MCP server and tool poisoning
An attack through a third-party MCP server: commands for the model are hidden in a tool's description.
Source: CVE-2025-54136 · Claude Code CVE-2025-59536 · CVE-2026-21852 (Check Point Research)
Vector database weaknesses (LLM08:2025)
Embeddings are numeric fingerprints of text that AI uses to find similar documents. I check whether the original text can be rebuilt from the vectors, whether someone can tell that a document is in the database, and whether fake documents can be slipped into search
Sensitive information disclosure (LLM02:2025) and personal data in logs
I check whether personal data leaks through model answers, logging systems and error trackers. For this I set up a fictional client with realistic data
Infrastructure
6 checks of the perimeter and dependencies
DNS settings and email spoofing protection
SPF, DKIM, DMARC (often set to `p=none`, which lets anyone send fake invoices in your name), CAA, DNSSEC
SSL/TLS encryption settings
The target is an A+ grade in SSL Labs: HSTS preload, the right cipher suites, OCSP stapling
Web application firewall (WAF) and CDN
I try to get past the filter with a disguised request and to find the server's real address through DNS history, the SSL certificate and email headers
How secrets and keys are stored
`gitleaks` across the whole repository history, access keys in the page code, an exposed `.git/` folder, .env files in backups
Vulnerabilities in third-party libraries
I check npm, pip, go.mod and Cargo.lock against an up-to-date CVE database.
Source: Shai-Hulud npm malware · Sonatype 454k+ malicious packages 2026
Backups and recovery
On a test server, I check that data can actually be restored from a backup
Personal data and Russian legal requirements
152-FZ · 187-FZ on CII · removing personal data from requests
152-FZ compliance
I check whether Russian citizens' data is stored in Russia, who you pass it on to, and whether you are listed in Roskomnadzor's register of personal data operators. Fines under Article 13.11 of the Code of Administrative Offences: 3–15M ₽ for a leak, depending on the size of the database; 1–3M ₽ for failing to notify Roskomnadzor; 1–3% of revenue for a repeat leak, and no less than 20M ₽
Readiness for CII requirements
The restrictions apply only to the owner of a significant critical information infrastructure (CII) object. The legal basis is Presidential Decree No. 166 of 30.03.2022 and, since 1 September 2025, the duty to use software from the register of Russian programs on significant objects (Federal Law No. 58-FZ of 07.04.2025). If your object falls under these rules, using Cursor, Claude or OpenAI on it is a formal violation. Options to consider: GigaChat on your own hardware, or YandexGPT. Whether they suit your object is checked separately
Removing personal data from model requests
I set up a fictional client with realistic data and record every request that goes to OpenAI or Anthropic. Then I check whether the filters let through full names, INN (tax ID), phone numbers, email addresses or passport details
Business logic and industry checks
Sign-in and checks for your industry
Sign-in and sessions
Where session tokens are stored (httpOnly or localStorage) and how they are refreshed; access to other users' data by direct link (IDOR); webhook signatures; protection against replayed requests; race conditions in payments
Advertising and e-commerce specifics
Whether the pages served to visitors have been tampered with; how the tracker handles fraudulent traffic; whether pixels fire; signatures on CAPI data (the server-side channel that sends conversions to the ad platform); up-to-date IP blocklists; browser fingerprints leaking through third-party scripts
What a check usually turns up
Examples of findings, sorted by risk level from critical to minor.
- An OpenAI or Anthropic API key sits in the page code: it takes half a minute to extract, and a large bill can be run up on it overnight
- Indirect prompt injection lets an attacker pull data out, as in the EchoLeak case
- The model's system prompt contains access keys or internal service addresses
- Personal data goes to OpenAI without being anonymized, which can breach the personal data law
- MCP tool poisoning: hidden commands in a tool's description
- No limit on how often the model can be called: an attacker can run up the bill and bring the service down
- DMARC set to `p=none`: anyone can send fake invoices from the company's address
- A B or C grade in SSL Labs, no HSTS preload
- Restoring from a backup hasn't been tested for more than a year
- Library vulnerabilities left unpatched for more than 90 days, webhooks without a signature
- No CSP headers, an exposed `.git/config` file
- Error messages that reveal internal details
- X-Frame-Options not set, an overly open Referrer-Policy
The full audit report: 30–50 pages with evidence and an action plan
Both the CEO and the engineer who will fix the issues can follow the report. Every finding comes with evidence you can reproduce and the exact command or code for the fix.
Summary for management
For the CEO, CTO and board: what the risks are, what they mean for the business and what the fixes will cost
Methodology
OWASP LLM Top 10, 187-FZ, 152-FZ, CVE references: what was checked and why
List of findings
For each finding: its number, risk level, evidence (a screenshot or a command), what it leads to, how to fix it and how to check the fix
Action plan by urgency
What to fix in the first 48 hours, what in the first month and what within the quarter
Appendices
Full logs of the checks, mapping to requirements (152-FZ, OWASP, ISO 27001) and, on request, a video of the attacks
Four kinds of companies that need this
The full audit and ongoing support are designed for companies with revenue of 1M ₽ a month or more. If your revenue is lower, it makes more sense to start with the express diagnostic for 45,000 ₽. I don't take on personal projects or student work. I check systems that have AI in them.
Technical founders of B2B services with 20–100 employees
The product uses AI, and an investor review is coming up. You launched a chatbot or document search, and it sometimes gives strange answers. Nobody has checked the MCP servers.
A single leak can sink the product
Advertising agencies with budgets of $500k to $5M a month
AI tools collect customers' personal data, and 152-FZ applies to it. Tracking systems give away the server's address through DNS history. Without a signature on CAPI data, fake conversions get through. I know this world from the inside: I managed a $1.34M ad budget.
If an ad account with $200k in it gets blocked, a month of work is lost
Online stores with 1,000+ orders a month and AI in customer support
An AI agent chats with customers, and their emails, phone numbers and addresses end up at OpenAI. Customers can talk a voice bot into giving out a 99% promo code.
A leak of customer data brings a fine and damages your reputation
Government clients, banks, fintech
Since 1 September 2025, significant CII objects must use software from the register of Russian programs (Federal Law No. 58-FZ of 07.04.2025). Presidential Decree No. 166 limits the purchase and use of foreign software. The duty lies with the object's owner: if the object is covered, using Cursor, Claude or OpenAI on it is a formal violation. Deep penetration testing requires an FSTEC license, which I don't hold. On these projects I design the solution and consult, and I work with such clients through a legal entity.
CII requirements are mandatory for the owner of a significant object
I check the AI part of a system
Information security companies protect the whole network and monitor events. My work is the AI part of the system and everything connected to it. Here is who handles what:
Information security companies
The whole IT perimeter: network protection, event monitoring, defense against targeted attacks
I check the AI part of the system: models, document search, MCP servers. A full audit costs 400,000 ₽ to 1.1M ₽
Bug bounty platforms
Independent researchers look for vulnerabilities in a live system and are paid for each finding
I check the system against an agreed plan and am personally responsible for the result. I hand over a report with recommendations and can stay on for ongoing support
Penetration testers
Networks, web applications and infrastructure: Burp, Nessus, nmap
I test against the OWASP LLM Top 10. I run AI systems around the clock myself and have seen prompt injection in live traffic
In-house security teams
Corporate IT: the directory, the perimeter, intrusion detection
I look at your AI and automation with an outside eye and add to what your security team does
Why you can trust me with this check
Four things come together in my work: development at large companies, my own AI systems in daily use, ad buying with large budgets and a working knowledge of Russian requirements.
I run AI systems myself, every day
More than ten of my own AI systems run around the clock. I've seen their failures from the inside: budgets overspent when conditions changed sharply, an algorithm stuck on an unusual case, indirect prompt injection through an RSS feed, an MCP server going down in live use
$1.34M in ad budgets
I worked as an ad buyer in two large teams (names under NDA). Daily work taught me how fake engagement and fraudulent traffic work, how tracking works and how to protect data sent through CAPI
7 years in large companies
Baltic Shipyard, IPL Consulting, Asertiva Solutions. I know how security works in large companies with long approval chains, and I speak the same language as a CTO or a head of security
I look at a system the way an attacker would
Buying ads means fighting bots, fake engagement and traffic fraud every day. I've seen how ad and web systems get abused, so I test a system by asking myself how I would break it
I read Russian requirements in the original
152-FZ, 187-FZ on CII, FSTEC orders, Roskomnadzor guidance: I read the primary sources myself. I check that the requirements are met in practice, in the running system
Start with the express diagnostic
It costs 45,000 ₽ and takes 1 working day. You'll learn your five main risks and whether you need a full audit.
Start with the 5,000 ₽ audit: a written report and a payback estimate
I'll tell you what to automate first, when it will pay for itself and whether your task needs AI at all. Sometimes it doesn't.
Or just ask a question. During business hours I reply within 2 hours