Data access boundaries
What the model and its tools can read and write, traced to each credential.
AI Production Readiness Review
Put your AI feature into production without handing it the keys.
A five-day review of one AI feature or agent. Fixed price, A$6,500 ex GST.
When this matters
The questionnaire has an AI section now.
An enterprise prospect sends a security questionnaire. Half a page is new: AI questions. Or the agent you built last quarter is about to get write access to customer data. Somebody has to sign it off, and the deal date does not move.
What the review covers
Six checks. One feature.
API keys and secrets
Where keys live, who can read them, and what leaks in logs or error paths.
Prompt injection and guardrails
Hands-on tests of injection, cross-tenant reads and confused-deputy tool calls.
Inference cost runaway
Rate limits, budgets and alerts. What one bad loop costs before anyone notices.
Logging and audit trail
Whether you can answer who asked, what the agent did and which data it touched.
Security questionnaire answers
Draft answers to the AI section of an enterprise vendor questionnaire.
Day 1 to Day 5
What happens each day.
- 01
Day 1
Kick-off call. Read-only access confirmed. We map every tool, key and data store the feature touches.
- 02
Day 2
Access and secrets review. Every credential traced to the scope it holds and the scope it needs.
- 03
Day 3
Control tests on your non-production environment: injection, cross-tenant, tool abuse.
- 04
Day 4
Cost and logging review. We model the worst runaway and check what your alerts would catch.
- 05
Day 5
Written report and 60-minute readout. You leave with a fix list and draft questionnaire answers.
What you get on day 5
- Agent Blast Radius Map: the worst single call and worst chain.
- Tool Permission Ledger: scope held against scope needed.
- Findings Register with severity, effort and owner per line.
- AI cost guardrail check with recommended limits and alerts.
- Draft answers to the AI section of your questionnaire.
- A 60-minute readout with your engineers.
What we need from you
- Read-only access to the cloud account the feature runs in.
- A non-production environment that matches production.
- The tool list or manifest, and the system prompt.
- The questionnaire, if one has arrived.
- An engineer on your side for about two hours across the week.
Limits matter
Out of scope
- More than one AI feature or agent. Extra features are quoted.
- Fixing the findings. That is a separate fixed-price sprint.
- Model training, fine-tuning or model weights.
- Testing in production without written authorisation.
- Any certification or attestation. We are not an auditor.
Risk reversal
What if we find nothing serious?
If we find nothing serious, you get that in writing, with the evidence behind it. That is still a useful document: it is what you attach to the questionnaire. The fee is fixed either way, and we do not pad the report to justify it.
Proof, not adjectives
Work you can check before you book.
- We reported the Elsevier API hijacking covered by DataBreaches.net on 22 September 2026.
- Our ASD ISM controls for AI agents guide maps each control to a check.
- The illustrative report (PDF) shows the Findings Register format, built from synthetic findings.
- All three offers side by side on the pricing page.
Questions before you book
Practical answers.
How much does the AI Production Readiness Review cost?
A$6,500 ex GST, fixed, for one AI feature or agent. More features are quoted before you commit.
How long does it take?
Five working days from kick-off, once read-only access is in place. The readout is on day 5.
Do you need production access?
No. We work from read-only cloud access and a non-production environment that matches production.
What if you find nothing serious?
You get that in writing with the evidence. The fee stays fixed. We do not pad a report to justify a price.
Will this satisfy our enterprise customer?
It gives you evidence and draft answers. Acceptance is their call, so send us their exact questions before we start.
Which clouds and models do you cover?
AWS, Azure and Google Cloud, with hosted or self-hosted models. The review is about access and cost, not a single vendor.
Last reviewed: