LLM security audit for the AI feature you have already built

I do LLM security audits for teams whose product, support tool or internal app already calls a language model. I check four things that go wrong quietly: prompt injection, a spend nobody capped, answers nobody can trace, and quality nobody measures.

You get a written report with each finding ranked by risk and shown with evidence, and a fix list in the order I would do it.

Send a brief See pricing

Starts at: €1,500 for one feature
Typical length: 1 to 2 weeks
You receive: A written report ranked by risk, and a call to go through it
I need from you: Read-only access to the code, a staging environment and an hour with whoever built it

audience

Who this is for

Founders, agencies and small teams who added an LLM feature and have not had anyone look at it closely.

A contractor built the support bot in a hurry. It works in the demo, and nobody has looked at what a user can make it say or do.
You put a chatbot on a client’s website and now worry about the API bill if someone scripts it.
The feature runs, but nobody can tell you how often it is wrong, or whether last month’s prompt change made it better.
A client, or your own security person, asked “is it safe?” before the internal assistant over your documents and CRM goes live.

checks

What I check

Prompt injection protection

Prompt injection is when text the model reads (a customer message, a web page, an email, a CRM field) contains instructions and the model follows them. I list every place outside text enters a prompt, and what the model can do once it has been fooled: call a tool, write a record, show another user’s data, render a link. Then I try realistic attacks on a staging copy and show you the ones that worked.

AI cost control

A model call costs money every time it runs. I find every path that triggers one: loops, retries, agent steps, public endpoints, oversized inputs, long outputs. For each I check what stops it running up a bill. Caps belong in code, enforced before the call, with the provider’s own spending limit behind them as a backstop.

Logging you can use

When a user says an answer was wrong, can you see what went in, what context was retrieved, what came out and why it was refused? I check what you log, what you should not log (keys, personal data), and whether a failed call is visible at all.

LLM evaluation

If you cannot measure quality, every prompt change or model upgrade is a guess. I build a small baseline of real cases from your own use, with a script that scores them, so you can compare before and after. Even twenty to forty well-chosen cases make a change visible.

deliverables

What you get

A written report: Findings ranked by risk. Each has the evidence (what I tried, what happened, where in the code) and a suggested fix with a rough effort.
A map of the feature: One page showing where text enters, where output goes and what the model can touch.
An evaluation baseline: Twenty to forty cases and a script that scores them, so you can re-run it after any change.
A fix list, in order: What I would do first, second and third. Small fixes I can apply within the engagement if you ask; larger ones I quote separately.
A readout call: We go through the findings together, and you can ask follow-up questions for two weeks afterwards.

schedule

How it runs

Before anything is agreed
Brief
You send a brief describing the feature and what worries you. I reply within two working days with whether an audit is the right next step, and a fixed price.
Your part Say what the feature does, who can reach it and what it can touch.
Week 1
Access
I get read-only access to the code and a staging environment, plus a provider key with its own spending limit for my tests, so nothing touches your production key. I spend an hour with whoever built the feature.
Your part Read-only repository access, a staging environment, and an hour with the builder.
Weeks 1 to 2
Map and probe
I map where outside text enters a prompt and where the model’s output goes. Then I test: realistic injection attempts, every path that costs money, and what the logs show after a failure.
Your part Answer questions as they come up.
Week 2
Baseline
I write the evaluation cases with you, run them and record the first score, so you have a number to compare against after every future change.
Your part Someone who knows what a good answer looks like checks the cases.
End of week 2
Report and readout
You get the written report and a call to go through it, then two weeks in which you can ask follow-up questions.
Your part Read the top findings before the call.

limits

What I will not do, and when an LLM is the wrong tool

I will not certify anything as secure or injection-proof. No one can: there is no complete defence against prompt injection today. I tell you what an attacker or a bad input can do, what limits the damage and what to change.
This is not a penetration test of your infrastructure, a compliance certification or legal advice. I cover the language-model part of your system. For SOC 2, ISO 27001 or a legal review, hire a firm that does that work.
I will not test production, or use real customer data, without your written agreement. The default is a staging environment and fake data.
If the feature does not need a language model, I will say so in the report. Sometimes the safest fix is a rule in plain code.

evidence

Proof from my own projects

The checks above rest on techniques I built into my own two projects: the AI service delivery coordinator and the EU AI Act assistant. Spend caps enforced in code, untrusted input quoted, refusals logged with the check they failed, and evals with their own cost limits. They are projects I built myself, not client audits. An audit applies the same checks to someone else’s code, with the limits written down.

The README of the EU AI Act assistant states what its own citation check does not catch: a real citation attached to invented prose. I would write the same kind of limit into your report. Read that case study or the coordinator’s.

price

What it costs

from

€1,500

for one LLM feature in one Python codebase, at a fixed price once I have read your brief.

what pushes the price up

How many places call a model, and how many different prompts there are.
Whether the model can use tools or write to other systems. Those features have more to check.
The size of the codebase around the feature.
No staging environment, so that I have to help set one up first.
A larger evaluation baseline than twenty to forty cases.

Fixes are quoted separately, so you know the audit price before you see a single finding.

See all four packages and the payment terms.

Questions people ask

How much does an LLM security audit cost?

From €1,500 for one LLM feature in one Python codebase, at a fixed price after your brief. More places that call a model, more prompts, and a model that can use tools or write to systems all raise it. I quote fixes separately, so the audit price is known up front.

See the pricing page

How long does it take?

1 to 2 weeks from the day I have access to the code and a staging environment. Waiting for access is the usual cause of delay.

Do you need our production keys or customer data?

No. I use a staging environment, fake or anonymised data, and a provider key of my own with a spending limit. If you cannot give me a staging environment, tell me in the brief: it changes the plan and may change the price.

Can you guarantee prompt injection cannot happen?

No, and be wary of anyone who says they can. There is no complete defence today. The aim is to limit what a fooled model can do: no write access it does not need, untrusted text kept apart from instructions, outputs checked in code, and spend and actions capped. The report shows where your feature stands on each.

Which model providers and frameworks do you cover?

The review is of how your code calls a model, so it applies to OpenAI, Anthropic, Google and others. I have built with OpenAI models and LangGraph. I review Python backends. If yours is in another language, tell me in the brief and I will say whether I can review it properly.

Who sees our code?

Me, on my own machine, under an NDA if you need one. If your policy forbids sending code to a third-party AI provider, tell me in the brief and I will work to that policy, or tell you I cannot.

Can you fix what you find?

Yes. Small fixes, such as adding a spend cap or a log line, I can do within the engagement. Larger ones I quote as fixed-price work. You can also hand the list to your own developers; it is written for that.

What happens after the audit?

The report and the evaluation baseline are yours. If you want the baseline kept running, every prompt or model change reviewed and spend watched, that is a retainer, from €1,800 a month. It is optional.

Show me the LLM feature you are unsure about.

Send a short brief: what the work is, who does it now, and what it costs you. I reply within two working days with a rough scope, a price range and whether AI is the right tool for it at all.

Send a brief

Or write to keel.agents@gmail.com.