Prompt injection
Instructions hidden in content the system reads, overriding what it was told to do.
How it is tested
Directly through user input and indirectly through documents and retrieved content.
Two attack surfaces. Both tested.
Software has two attack surfaces now.
A scanner that finds SQL injection will not find prompt injection, and a penetration test scoped to endpoints will not find an agent talked into calling a tool outside its scope. Neither substitutes for the other.
Conventional
The application security surface that has always existed, and has not gone away.
- Injection, authentication and session handling
- Access control and privilege escalation
- Dependency and supply chain exposure
- Secrets and configuration
- Infrastructure and deployment posture
AI
The surface that exists only once a system sends context to a model or lets one act.
- Prompt injection, direct and indirect
- System prompt leakage
- Sensitive information disclosure
- Excessive agency and over-broad tool permissions
- Memory and context poisoning
- Vector store and retrieval weaknesses
The class of attack conventional tooling does not cover.
Tested adversarially against the deployed feature, not the model in isolation, and repeated on every change to guardrails or tool scope.
Test method
System prompt leakage
Extraction of the instructions or embedded values behind a feature.
How it is tested
Adversarial extraction. A secret found in a system prompt is a build defect.
Sensitive information disclosure
Model output revealing data the requesting user was never entitled to see.
How it is tested
Across roles and permission boundaries, not only against an unauthenticated caller.
Excessive agency
A feature able to take actions beyond what its function requires.
How it is tested
By attempting actions outside the intended scope with the feature's own credentials.
Tool misuse
Coercing a tool-using feature into calling a tool it should not.
How it is tested
Through argument injection and goal manipulation.
Memory and context poisoning
Attacker-controlled content persisting into later sessions and shifting behaviour.
How it is tested
Across sessions rather than within one.
Retrieval and vector weaknesses
Poisoned or over-permissioned retrieval returning content the user should not reach.
How it is tested
Against the retrieval layer directly, not only through the model.
Agentic supply chain
Tools, plugins and connected services introduced into an agent's reach.
How it is tested
By examining what the agent can call, and the trust it extends to each.
Structured against the OWASP Top 10 for LLM Applications (2025), the OWASP Top 10 for Agentic Applications (2026) and MITRE ATLAS.
Data handling across a distributed delivery team.
Winjit delivers from India and the United States. The controls that make that work are stated here rather than left to a questionnaire.
India
United States
Access scope
Access to a client environment is granted per engagement, scoped to the systems the work requires, and revoked when an engineer rolls off.
Data residency
Client data stays in the client's environment by default. Any processing outside it is named and agreed in writing before work starts.
Device and network controls
Client code is worked on from managed devices over controlled network paths, under the access rules agreed for the engagement.
Personnel controls
Engineers are background verified and work under confidentiality terms, and access is withdrawn when they leave the engagement.
Certifications and standards are shared with their issuing body, current status and scope during a vendor security review.
What we are tracking right now.
There is no comprehensive federal AI statute in the United States. States have legislated separately, and sector regulators have folded AI into existing cybersecurity frameworks. Winjit maintains this picture because delivery decisions depend on it.
Current as of September 2026
Regulatory posture by industry: Insurance Finance Health Tech PropTech
Start with a security review.
A review of one repository, one service or one AI feature. It returns prioritised findings with severity and a remediation path. No fee for the first review.
What Winjit needs to run it
Book a security review
Read access to one repository or one deployed feature, and a conversation with whoever owns it.
Questions security and compliance teams ask.
AI features are tested adversarially against their own threat model, covering prompt injection, system prompt leakage, sensitive information disclosure, excessive agency, tool misuse, memory poisoning and retrieval weaknesses. Testing runs against the deployed feature and repeats on every change to guardrails or tool scope.
Yes. A penetration test scoped to an application's exposed surface will not detect prompt injection, tool misuse or memory poisoning, because those attacks operate through content the system reads rather than through its network surface. Both are required.
Client data stays in the client's environment by default, whoever is working on it. Where an engagement requires processing outside it, the location and the controls are agreed in writing before work starts, and access is scoped to the systems the work requires.
A findings register with severity and state, an AI security test report, a remediation record with retests, a dependency and licence inventory, and a data flow map covering any path that reaches a model provider.