Close the gaps agents open in your attack surface.
When AI agents can send emails, call APIs, update databases, and run code, security isn't optional. We design controls that stop prompt injection, govern permissions, test against adversarial attack, and give you evidence for compliance.
The AI Security Problem
Your prototype is secure. Your production AI is not, because agents introduce risk that traditional application security doesn't cover.
Security threats that traditional controls can't stop
Agents can be manipulated through prompts, prompted to reveal secrets, given permissions they shouldn't have, or chained to execute dangerous actions. Your firewall, database encryption, and API auth don't cover this.
No visibility into what your AI is doing
When an agent makes decisions, it's hard to know why or whether it's following policy. You can't audit agent actions or detect when something went wrong until customers report the breach.
Compliance gaps you can't explain
Customers, partners, and regulators ask for security evidence. You can't show them that prompt injection is tested, secrets are protected, or agent permissions are enforced. You're blocked on deals until you can.
What Changes When AI Can Take Action
The moment your agent can trigger workflows, call APIs, or modify data, you need security controls that traditional app security doesn't provide.
Agent autonomy creates risk
An agent can choose which tools to use, chain actions together, and act without user approval. That power also creates attack surface.
Secrets are easy to leak
Model outputs aren't code — they're text. Secrets, API keys, and PII can be embedded in prompts, leaked in completions, or exposed in logs.
Traditional access control isn't enough
You can secure the database, but if an agent has access, it can be prompted to exfiltrate data or told to delete records by a malicious prompt.
You need to know what happened
When an agent does something unexpected, you need an audit trail. Which prompt triggered it? Which tool was called? Did it follow policy?
AI Security Threat Model
Six threat categories that define AI application risk (OWASP LLM Top 10 and OWASP AISVS foundation).
Prompt Injection
Users or retrieved content override your system instructions. Direct prompt injection is when a user tries to bypass policy. Indirect prompt injection is when malicious instructions are hidden in documents or web content the agent later reads and acts on.
Secret Leakage
Prompts, memory, logs, or model completions expose API keys, tokens, PII, system instructions, or hidden context. Attackers can extract secrets through jailbreaks or by asking the agent directly.
Excess Permissions
Agents have more tool access than they need. An email agent shouldn't be able to delete records. A reporting agent shouldn't access customer PII. Without least-privilege guardrails, compromise is wide.
Unsafe Tool Execution
Tools are called with attacker-controlled arguments, produce unexpected outputs, or execute without validation. An agent told to run a shell command could execute arbitrary code.
Data Exposure
Agents fetch data with weak access controls, return more data than intended, or expose tenant data across customer boundaries. Retrieved data leaks into logs or model outputs.
Runtime Threats
Cost exhaustion (an attacker runs a loop until your bill spikes), rate-limit abuse, denial of service, or supply-chain compromise through model updates or tool dependencies.
AI Security Architecture
Six layers that build a secure AI system.
Identity
Every agent, tool, and API caller is authenticated. Agents are scoped to a tenant, user, or session so they don't act across boundaries.
Authorization
Agents have specific permissions for specific tools. An agent that sends emails doesn't update records. Policies are enforced in code, not documents.
Permissions
Each agent has a permission matrix that limits which tools it can access, which databases it can query, and which actions require human approval.
Data Access
Data returned to agents is filtered and validated. Secrets aren't included. Tenant boundaries are enforced. Audit trails track what data agents accessed.
Tool Controls
Tools validate their inputs before execution. Dangerous actions (code execution, data deletion) require explicit approval. Tool calls are logged and can be replayed.
Runtime Protection
Input guardrails detect prompt injection. Output guardrails prevent secret leakage. Execution guardrails stop unsafe tool calls. Budgets limit cost exhaustion.
What Crescent Secures
We don't just run tests. We design security into your system end to end.
Threat model your agent: Map your system to OWASP LLM Top 10. Identify which threats apply.
Test for prompt injection: Both direct (user input) and indirect (retrieved content). Build a regression suite.
Design agent permissions: Which agents can call which tools. Read/write separation. Approval gates for sensitive actions.
Protect secrets: Remove API keys, credentials, and PII from prompts and logs. Scope credentials to specific tools. Rotate regularly.
Add guardrails: Input validation, output filtering, tool argument validation, execution approval, budget limits.
Test adversarially: Red teaming to find novel attacks. Jailbreak resistance. Tool misuse scenarios.
Produce compliance evidence: Security review report, test results, permission matrix, audit trail templates. You'll have documentation for OWASP AISVS Level 2 and buyer security questionnaires.
Security Controls
Layers of defense that stop common attacks.
Input guardrails
Detect and block prompt injection attempts in user input before they reach the model.
Retrieval guardrails
Validate and filter content fetched from databases or APIs. Prevent indirect prompt injection through retrieved data.
Execution guardrails
Validate tool arguments before execution. Block dangerous function calls. Require approval for sensitive actions.
Output guardrails
Filter model outputs to prevent secret leakage. Detect and redact PII. Block off-policy responses before they reach users.
Budget limits
Prevent cost exhaustion by capping token usage, tool calls, or API spend per agent, per request, or per day.
Security Testing
Repeatable test suites that catch failures before they reach production.
Prompt Injection Suite
Direct attacks ("Ignore previous instructions"). Indirect attacks ("Call this phone number" hidden in a document). Jailbreak attempts. Policy-bypass tests.
Tool Misuse Tests
Illegal arguments. Unexpected outputs. Chained dangerous actions. Permission escalation attempts.
Data Leakage Tests
Can secrets be extracted? Can PII be returned? Can system prompts be revealed? Can tenant data cross boundaries?
Regression Suite
Every finding becomes a test case. Re-run before each release to ensure the control still works.
AI Red Teaming
Adversarial testing to find attacks you didn't anticipate.
Regular security testing runs known test cases. Red teaming assumes an intelligent adversary and discovers novel attack vectors through creative manipulation.
Automated red teaming using tools like PyRIT to systematically probe attack surfaces
Human-led red teaming: security engineers attack your agent with creative, context-aware techniques
Jailbreak-resistant evaluation: test model robustness against known jailbreak patterns
Finding writeup: detailed documentation of each successful attack and remediation
Governance Integration
Security controls and governance are linked. Policy enforcement requires technical controls.
Governance policy says "agents can't access customer PII without approval." Security implements that with data access controls, approval gates, and audit trails. Both are necessary for a compliant system.
Policy → security control mapping (each policy has a corresponding technical enforcement)
Approval workflows for policy exceptions (when policy can't be automated, require explicit approval)
Audit trail templates (every agent action is logged with who, what, when, and why)
Deliverables
What you receive from a Crescent AI security engagement.
Security Validation
How you know security controls are actually working.
Pre-deployment testing
Before a release, run the security test suite. Confirm each control still blocks its threat.
Production monitoring
Log agent actions, guardrail blocks, and approval decisions. Set alerts for suspicious patterns (repeated injection attempts, excessive tool calls, unusual data access).
Quarterly red teams
Ongoing adversarial testing to catch new attack patterns as models evolve and attacker techniques advance.
Compliance audits
Annual reviews against OWASP AISVS to confirm you're maintaining baseline controls as your system scales.
Who This Is For
Five kinds of teams that are dealing with AI security risk.
AI-Native Startups
Pre-revenue to $20M ARR, shipping AI-native product
B2B SaaS
Adding AI to an existing product surface
Enterprise Engineering
Internal platform teams scaling AI org-wide
Digital-First Enterprises
200-3,000 employees integrating AI across a cloud-native product
Global Capability Centers
Captive engineering centers building internal AI tooling and developer platforms
Case Studies & Evidence
The security artifacts we produce are the evidence your system is safe.
Real production AI engagements produce security deliverables that serve as compliance evidence and risk documentation:
Security Review Report
Findings mapped to OWASP LLM Top 10 and OWASP AISVS. Severity, proof of concept, and remediation for each finding. Signed off by security team.
Prompt Injection Test Results
Documented test cases for direct and indirect prompt injection. Results showing which attacks succeeded, which were blocked, and what controls prevented them.
Permission Audit
Matrix of agents, tools, and permissions. Verification that every agent has only the permissions it needs.
Red Team Report
Novel attacks discovered and remediated. Each finding includes attack walkthrough and fix verification.
Secrets Audit
Verification that no secrets are stored in prompts, memory, or logs. Credential scoping and rotation policy.
Related Services
Security is one of eight engineering disciplines. These often run in parallel.
FAQ
Know what your agent is vulnerable to before an attacker does.
A security review gives you a threat model, test results, and compliance evidence. You'll know what breaks, how to fix it, and what to tell customers about your controls.
NDA available on request · Scoped engagements · No surprise fees