By William Price, Founder of Bastion Cyber Group·Published ·Updated
If your team has put a chatbot, copilot, or agent into production, the fastest way to understand its real risk is to attack it the way an adversary would. Here's a practical starting point for a first red-team pass.
Start with the orchestrator, not the model
The model rarely causes the breach on its own. The risk lives in what surrounds it: the tools it can call, the data it can retrieve, and the actions it's allowed to take. Map those first, then test each boundary.
The four checks that find the most
Prompt injection — direct, and indirect via retrieved documents or tool output.
Data exfiltration — can the system be steered into revealing data it shouldn't?
Tool abuse — unbounded or unexpected tool calls, and privilege misuse.
Jailbreaks — multi-turn attempts that single prompts miss.