Testing types
AI red teaming companies: who tests LLM apps and agents
AI red teaming companies that test LLM apps and agents: eight dataset providers, the publisher and two specialists, with scope, method and sources. Nov 2026.
Short answer
Providers that test LLM apps and agents include pentest platforms and consultancies, AI-security specialists and the publisher of this site. Eight of the 14 providers in our dataset state AI application testing, and each entry below cites its own page. Scope, human involvement and report format differ, and no provider here is ranked.
AI red teaming companies test LLM apps, agents and the systems around them for flaws such as prompt injection, data leakage and misuse of tools. We checked eight providers from our dataset that state AI application testing, the publisher of this site and two AI-security specialists on 9 November 2026. Each entry cites the provider's own page. We do not rank them.
What does an AI red team engagement test?#
It tests the whole AI feature, the model and everything around it. NIST AI 600-1 defines AI red teaming as "a structured testing exercise used to probe an AI system to find flaws and vulnerabilities such as inaccurate, harmful, or discriminatory outputs, often in a controlled environment and in collaboration with system developers."
OWASP's GenAI Red Teaming Guide (January 2025) names four areas: model evaluation, implementation testing, infrastructure assessment and runtime behavior analysis. Pentest vendors on this page focus on the implementation and runtime areas, such as retrieval permissions, tool use and output handling. Read each page for the scope it states.
Which providers from our dataset test AI applications?#
The dataset field scope.ai_apps is "yes" for eight of the 14 providers. We checked each provider's own AI page. The table is alphabetical, with the publisher last.
| Provider | What its page says about AI testing | Human role stated | Engagement shape |
|---|---|---|---|
| Aikido | An Agent/MCP pentest type for "MCPs, chats, RAG, tools, memory, or other LLM features"; prompt injection appears in the tested vectors | AI agents run the test; human-led CREST pentest on request | Fixed or scoped price per assessment |
| Cobalt | An AI and LLM pentest in three tiers: prompt injection, isolated LLM, RAG-enabled LLM. Covers attack-surface mapping, behavioral probing, exploitation and retrieval testing | Humans lead; automation handles groundwork | Part of the Cobalt platform; findings are live |
| Escape | AI red teaming inside its AI pentesting product, live from 21 October 2026. Tests chatbots and MCP servers, with multi-turn jailbreaking and impact checks | Described as AI-run | Runs in the same pentest as the web app |
| HackerOne | H1 AI Red Teaming (AIRT): objective-based, scoped adversarial testing of AI models and systems | Researchers from a community the docs size at over a thousand AI-focused researchers, plus a Solutions Architect | A 15- or 30-day project, about a week of scoping and a week of reporting |
| Pen Test Partners | Tests "the AI implementation, the surrounding application, the data it can access, the actions it can perform": prompt injection, RAG permissions, agent tool misuse, output handling | Manual techniques, structured test cases, tooling where appropriate | Standalone or an extension to an existing pentest |
| Synack | AI and LLM pentesting with results that follow the OWASP AI/LLM Top 10: prompt injection, model theft, training data poisoning, insecure plugin design | Vetted Synack Red Team researchers | PTaaS, with findings in real time |
| Terra Security | An AI Red Teaming product to "test AI applications, Copilots, LLMs, MCPs, and agent behavior" | AI agents with human oversight, per our dataset | The homepage gives no method detail |
| TurboPentest | OWASP LLM Top 10 coverage "for AI agents, prompt injection, and model-specific attack surface"; the page does not use the term AI red teaming | Self-service AI agents; humans not stated | Credit-based tests |
| Excession Labs, the publisher | Assesses LLM applications and AI agents; see airedteamingservices.com | Excession Labs scopes the work, checks the evidence for each finding and writes the report | Scoped assessments; no prices published |
Excession Labs publishes PentestCompare. It appears here as one entry with the same fields as the others. We do not claim past AI red team engagements for it, because we have no verified delivery history to cite.
The other six providers do not state AI application testing on the pages we checked: BreachLock, Hadrian, Horizon3.ai, Parameter, Secure Ideas and XBOW, with ai_apps set to "unknown". That means the pages do not say, not that the provider does not test.
Which specialist firms focus on AI security?#
Two AI-security firms publish red teaming offers that go beyond pentest platforms. We checked their own pages, and we cite only what they state.
HiddenLayer's services page describes AI red teaming that aims to "emulate real-world adversarial attacks against your agentic, generative, and predictive AI applications", using techniques such as model manipulation, prompt injection and inference attacks. It lists remediation playbooks and findings mapped to frameworks including the NIST AI RMF and the EU AI Act. The page gives no pricing, engagement length or sample report format. It also carries marketing results figures that we did not verify and do not repeat.
Mindgard calls itself "an AI security platform" with AI red teaming as its central feature and describes a platform that acts as "an autonomous red teamer" with four stages: Recon, Attack, Remediate and Assure. The home page links to AI red teaming services without describing them. It lists deployment through CI/CD or Burp Suite. The page does not name MITRE ATLAS or OWASP.
Other AI-security vendors exist. We list only firms whose own pages we read.
How do you choose an AI red teaming provider?#
Choose by what you need tested, then by who does the work. Four checks separate the providers above.
- Scope. Does the provider test your app, your agent's tools and your retrieval layer, or the model alone? Cobalt, Pen Test Partners and Escape describe retrieval, tool and MCP testing in their pages. Ask for the same detail from any provider.
- Method and evidence. Ask for the OWASP LLM Top 10 category of each finding and the conversation or request that proves it. Escape says it keeps the full conversation as evidence. Cobalt's sample finding carries an OWASP LLM category, a CWE ID and a CVSS score.
- Human role. HackerOne and Synack describe human researchers. Terra and Escape describe agent-led testing. Aikido offers a human-led option on request.
- Report. Ask for a sample. Use the sample report guide and the questions to ask a pentest provider.
Test conditions matter for LLM apps because model output varies. Synack's page says its researchers "test and then test again, taking into account non-deterministic interactions". Ask any provider how it handles repeat runs, and what it records.
For background on methods, see what AI red teaming is on our publisher's AI red teaming site. For tools you run yourself, see the automated pentesting tools guide.
Questions
Is AI red teaming the same as an AI pentest?
The terms overlap and vendors use them differently. NIST AI 600-1 defines AI red teaming as a structured testing exercise to probe an AI system for flaws such as inaccurate, harmful or discriminatory outputs. Pentest vendors usually frame the work around security flaws such as prompt injection and data leakage. Ask each provider what it tests.
Do any laws or standards require AI red teaming?
The EU AI Act uses the term adversarial testing, in Article 55(1)(a), and it binds providers of general-purpose AI models with systemic risk. We found no standard that names a pentest of your own LLM app as a requirement. Check with counsel for your case.
How long does an AI red team engagement take?
It varies by provider and scope. HackerOne's docs describe a 15- or 30-day testing project with about a week of scoping before and a week of reporting after. Most other providers in this list do not publish a duration.
Sources
- Cobalt: AI and LLM pentest (checked 9 November 2026)
- HackerOne docs: H1 AI Red Teaming (AIRT) (checked 9 November 2026)
- Synack: AI and LLM pentesting (checked 9 November 2026)
- Pen Test Partners: artificial intelligence testing (checked 9 November 2026)
- Escape: launching AI red teaming (21 Oct 2026) (checked 9 November 2026)
- Terra Security home page (checked 9 November 2026)
- Aikido AI pentest (checked 9 November 2026)
- TurboPentest home page (checked 9 November 2026)
- HiddenLayer services (checked 9 November 2026)
- Mindgard home page (checked 9 November 2026)
- Excession Labs: AI red teaming services (checked 9 November 2026)
- NIST AI 600-1 (definition of AI red teaming) (checked 9 November 2026)
- OWASP GenAI red teaming guide (checked 9 November 2026)