Skip to the main content.
Contact Insicon Cyber
Linkedin YouTube

AI Assurance

Know your AI risk before attackers do.

Insicon Cyber AI Assurance is an AI security testing and runtime protection service for Australian and New Zealand organisations deploying AI in regulated environments.

Led by Insicon Cyber's experienced Australia-based team. Executed by the Insicon Cyber aSOC. Powered by F5 AI Red Team and F5 AI Guardrails.

What is AI Assurance?

AI Assurance is Insicon Cyber's AI security service that combines adversarial testing of AI systems with runtime protection enforcement and fractional CISO advisory. It is built for the class of threats — prompt injection, jailbreak chaining, data exfiltration via AI, multi-agent privilege escalation — that traditional security controls cannot detect.

AI systems are non-deterministic. You cannot firewall a conversation. Web application firewalls, conventional penetration testing, and standard SIEM monitoring were designed for predictable, code-based systems. Large language models, AI agents, and generative AI applications introduce a fundamentally different attack surface — one that requires a different class of testing and a different class of protection.

AI Assurance is available in two tiers:

  1. a one-off assessment (AI Assurance: Assess) and

  2. an ongoing subscription with continuous testing and always-on protection (AI Assurance: Continuous).

The harness is where the risk lives

Most discussion of AI security focuses on the model itself. That is not where most of the risk lives.

The risk lives in the harness: the software layer that connects an AI model to your organisation's systems, data, and tools. The harness is what lets an AI agent read files, query databases, send messages, call APIs, trigger workflows, and interact with other agents. Without it, the model can only produce text. With it, the model can do things.

That capability is also the attack surface. Australia's Australian Signals Directorate (ASD) made this point directly in its Agentic AI Harnesses guidance, published September 2026. ASD identified the harness as the component organisations can most directly govern, secure, and control — and the one that most frequently lacks adequate controls.

Source: ASD Agentic AI Harnesses — cyber.gov.au

What a harness looks like in practice

Harnesses take different forms depending on how the AI system was built. What they have in common is that they extend the model's reach into your environment. In Australian and New Zealand organisations, the most common harness patterns are:

Protocol-level frameworks. MCP (Model Context Protocol) is the current dominant standard for connecting AI models to external tools and data sources. Most serious agentic deployments being built or purchased right now are MCP-based. MCP servers grant models access to file systems, APIs, calendars, databases, and enterprise applications. The trust boundaries between MCP servers and host systems are one of the most actively exploited attack surfaces in agentic AI.

Orchestration frameworks. LangChain, LangGraph, and LlamaIndex wire together sequences of model calls, tool calls, memory retrieval, and decision logic. A significant proportion of enterprise AI being deployed across Australia and New Zealand runs on these frameworks, whether the vendor discloses it or not.

Vendor-built agentic products. Microsoft Copilot, Salesforce Agentforce, and ServiceNow AI agents are packaged harnesses. The model connects to your Microsoft 365 environment, your CRM, or your ITSM platform. The harness is present and active — simply abstracted behind a product interface, which is precisely why many organisations cannot tell you what it can access, what it has done, or whether the access controls are appropriate.

Cloud-native agent platforms. AWS Bedrock Agents, Google Vertex AI Agent Builder, and Azure AI Foundry provide managed harness infrastructure inside the respective cloud environments, with native access to cloud storage, databases, identity services, and APIs.

Custom integrations. Larger organisations and software vendors build their own integration layers. More control, more responsibility, and substantially more risk if the team building it has not worked with AI-specific attack patterns before.

What ASD says to do about it

ASD's guidance identifies five categories of harness risk: privilege, design and configuration, behavioural, structural, and accountability. In plain terms: the model can access too much, the configuration creates unintended exposure, autonomous actions produce unexpected outcomes, the system is too complex to audit, and nobody can tell you what happened after the fact.

The recommended controls are least-privilege access, identity and access management applied to AI agent identities, secure design from the outset, monitoring and audit logging integrated with incident response, human oversight of high-impact actions, and phased adoption with validated controls before broader deployment.

These are governance requirements. They require evidence. That evidence has to come from somewhere.

Source: ASD Agentic AI Harnesses (September 2026) — cyber.gov.au

What AI Assurance tests

AI Assurance: Assess maps your harness configuration before testing it. We identify what implementation pattern your AI systems use, what systems and data the harness can reach, what trust boundaries exist between agents, and what access controls are in place. We then test those boundaries adversarially.

This is the work that vendor security attestations do not cover. When your AI vendor says their platform is secure, they are describing the model and the platform infrastructure. The harness — the system prompts, the tool integrations, the trust boundaries between agents — is your organisation's implementation. That implementation is entirely your responsibility and entirely untested until someone tests it.

AI Assurance: Assess tests the implementation layer. AI Assurance: Continuous monitors it ongoing, with F5 AI Guardrails enforcing runtime protection as the threat landscape evolves.

If you have deployed agentic AI and you do not know what harness pattern it uses, that is the first question AI Assurance: Assess answers.

The AI security threat landscape in Australia and New Zealand

AI adoption across Australian and New Zealand mid-market organisations is accelerating. Customer service chatbots, internal copilots, HR automation tools, and agentic workflows are being deployed into regulated environments that were designed for a different threat model.

Prompt injection

Prompt injection is an attack technique where a malicious input manipulates an AI system into behaving in an unauthorised way — disclosing sensitive data, bypassing access controls, or executing unintended actions. Prompt injection attacks are semantic in nature; they cannot be blocked by traditional signature-based security controls. For Australian organisations subject to the Privacy Act 1988, a successful prompt injection attack resulting in personal data disclosure may trigger mandatory notification obligations under the Notifiable Data Breaches scheme.

Jailbreak chaining and token compression

Jailbreak attacks use structured conversational sequences to bypass the safety guardrails built into AI models. Token compression attacks hide malicious instructions in formats that AI systems can process but human reviewers cannot see. Both attack techniques are evolving rapidly and require continuous testing updates — not a point-in-time annual assessment — to remain effective as a detection tool.

Agentic AI and multi-agent privilege escalation

Agentic AI systems — workflows where AI agents take autonomous actions on behalf of users — introduce a new category of privilege escalation risk. An agent that is manipulated via prompt injection can execute tool calls, access back-end systems, and interact with other agents in ways the deploying organisation never intended. Documented incidents include cross-organisation data exposure via MCP server logic flaws and back-end system access granted incorrectly via compromised agent trust chains.

Training data poisoning and model integrity

Data poisoning attacks introduce malicious data into the training pipeline of AI models, corrupting their outputs in ways that are difficult to detect post-deployment. For organisations fine-tuning or retraining models on proprietary data — including sensitive client or patient data — training data integrity is a material security obligation.

Powered by F5 AI Red Team and F5 AI Guardrails

F5 AI Red Team

F5 AI Red Team is an adversarial testing platform that simulates real-world AI attacks at unprecedented speed and scale. It combines three testing types: agentic resistance testing (dynamic, multi-turn campaigns that emulate sophisticated real-world attackers), signature attacks (tens of thousands of real-world prompts updated every month), and operational attacks (validating resilience under crash, resource exhaustion, and latency stress). Findings are delivered as prioritised remediation reports with security scores, severity classifications, and natural-language explainability of how and why each attack succeeded.

F5 AI Guardrails

F5 AI Guardrails provides runtime protection for AI applications and agents — blocking prompt injection, data exfiltration attempts, and jailbreak techniques as they occur in production. AI Guardrails operates as the enforcement layer that converts Red Team findings into active protection policies. Where Red Team identifies the vulnerability, Guardrails closes it in real time.

AI Assurance: two tiers to match your requirements

AI Assurance: Assess

One-off assessment. Point-in-time. Boardroom-ready output.

A structured, time-boxed AI security assessment that maps your AI attack surface, tests deployed systems against real-world adversarial techniques, and delivers a risk-scored remediation roadmap. Delivered in three to four weeks. Led by a fractional CISO. Executed by the Insicon Cyber aSOC.

What AI Assurance: Assess covers

  • AI system inventory and attack surface mapping across models, applications, and agents
  • Adversarial testing: prompt injection, jailbreak chaining, data exfiltration, token compression, multi-agent privilege escalation
  • Operational stress testing: latency, resource exhaustion, and availability under adversarial pressure
  • Risk-scored findings report with severity classifications and attack evidence
  • Prioritised remediation roadmap with fractional CISO commentary
  • Regulatory gap analysis mapped to APRA CPS 234, CPS 230, ISO 42001, and the Australian Privacy Act 1988 or NZ Privacy Act 2020 as applicable

What you receive

A boardroom-ready report with an executive summary suitable for board and audit committee presentation, a technical appendix with full findings, severity classifications, and successful attack evidence, and a CISO-authored remediation roadmap with prioritised actions and regulatory mapping. AI Assurance: Assess findings also serve as the technical evidence base for ISO 42001 gap assessment and risk treatment planning.

AI Assurance: Continuous

Ongoing subscription. Always-on testing. Always-on protection.

Continuous adversarial testing of AI systems combined with F5 AI Guardrails runtime protection, integrated into the Insicon Cyber aSOC. AI security posture updates as the threat landscape evolves. Quarterly fractional CISO reviews translate findings into governance reporting for boards and risk committees.

What AI Assurance: Continuous covers

  • Monthly F5 AI Red Team campaigns — tens of thousands of real-world attack prompts, updated every month
  • F5 AI Guardrails runtime enforcement: blocking prompt injection, data exfiltration, and jailbreak attempts in production
  • Integration with Insicon Cyber aSOC for alert triage, incident escalation, and 24/7 monitoring
  • Monthly security score trending report and executive summary
  • Quarterly fractional CISO advisory session covering findings, regulatory updates, and board-level risk narrative
  • Continuous alignment to OWASP LLM Top 10, OWASP Agentic Top 10, and ASD AI security guidance

The closed-loop advantage

Every AI Assurance: Continuous campaign automatically feeds findings into F5 AI Guardrails runtime policies. When a new attack technique is identified in testing, the corresponding protection is enforced in production without waiting for the next manual update cycle. This closed loop — test, find, protect, re-test — is the core operational advantage of AI Assurance: Continuous over point-in-time assessments.

From Assess to Continuous

AI Assurance: Assess is the recommended entry point for organisations without an existing AI security testing programme. The Assess engagement establishes the attack surface baseline and generates the findings that configure F5 AI Guardrails for the Continuous tier. Clients who complete an Assess engagement begin AI Assurance: Continuous with a pre-configured protection baseline — accelerating time-to-protection and providing a quantified starting posture for board reporting.

Assess establishes your baseline. Continuous defends it.

How Insicon Cyber delivers AI Assurance

Every AI Assurance engagement is led by an experienced Australia-based practitioner. They translate adversarial testing results into language boards and audit committees can act on. The Insicon Cyber SOC handles technical execution, alert triage, and escalation.

Fractional CISO leadership

Our Executive Leadership have advised boards and executive teams across Australian and New Zealand financial services, aged care, and healthcare organisations for over a decade. Every AI Assurance report is authored and presented by a CISO-level practitioner.

Insicon Cyber aSOC execution

The Insicon Cyber autonomous Security Operations Centre (aSOC) operates 24/7 across Australia and New Zealand, powered by Google SecOps. AI Assurance: Continuous integrates directly with the aSOC, ensuring AI-specific alerts are triaged and escalated within the same operational framework as all other security monitoring. Australian data sovereignty maintained throughout.

ANZ regulatory mapping on every engagement

Every AI Assurance report maps findings to the regulatory obligations relevant to the client's sector and jurisdiction: APRA CPS 234, CPS 230, the Australian Privacy Act 1988, the NZ Privacy Act 2020, and ASD guidance. Boards receive a report they can table. Audit committees receive the evidence trail they need.

AI Assurance and ISO 42001: a natural connection

ISO/IEC 42001:2023 requires organisations to implement AI risk assessment and AI system impact assessment processes. AI Assurance: Assess findings provide the technical risk evidence that directly informs both processes — accelerating ISO 42001 gap assessment and strengthening risk treatment documentation.

Organisations running AI Assurance: Continuous feed monthly security score data and quarterly CISO briefings directly into their ISO 42001 management review process, providing an auditable, continuous evidence base for surveillance audits.

Learn about Insicon Cyber ISO 42001

Find out what attackers would find in your AI systems

Talk to one of Insicon Cyber's fractional CISOs about an AI Assurance: Assess engagement. No-cost initial briefing. Scoped to your AI environment and regulatory obligations.

Part of the Insicon Cyber AI Security & Governance practice, alongside ISO 42001 and Managed Compliance.

Contact Insicon Cyber

Frequently asked questions about AI Assurance