Fraud vendors and third-party AI
Your AI feature passed the pilot. Now the bank's vendor review wants proof, not promises.
The business sponsor wants to sign, then the third-party risk team asks: can user input manipulate your model, can it leak one customer's data to another, and what do you keep and for how long? Written answers describe what you meant to build. The reviewer wants to know what the live system did when someone actually tried to break it, so the follow-ups keep coming and the quarter slips.
Built for Software and AI vendors selling an AI feature into banks or insurers; founders, CTO, Head of Security, Head of Sales Engineering
The problem in numbers
What the public record shows
Every figure links to the page it came from, with its date.
13%
of organizations surveyed had an attack that affected their AI models or applications, per IBM's 2025 Cost of a Data Breach Report
ibm.com, 2025-07-30
97%
of breached organizations with an AI-related incident said they lacked proper AI access controls, per IBM's 2025 Cost of a Data Breach Report
ibm.com, 2025-07-30
42
financial services and technology companies the US Treasury interviewed for its 2024 report on AI-specific cybersecurity risks in the financial sector
home.treasury.gov, 2024-03-27
What you get
The deliverables
You get a dated attack test of your live AI feature, run with written permission, covering prompt injection, data leakage and retention, and an answer pack that cites only what was observed.
A dated attack test
Your live AI feature tested in an agreed test setup, with the date and version recorded for every attempt.
Prompt injection results
What happened when someone typed instructions to override the feature, and when instructions were hidden inside a file, record or email it reads.
Leakage and retention results
Whether one customer's data could be pulled out from another's account, whether the feature reveals its own instructions, and whether a deleted test record really disappears.
An answer pack for the reviewer
Answers to the bank's questions that cite only what was observed, including anything that failed, and say plainly what was not tested.
How it runs
Testing window agreed on a short call after written permission, start to finish
Testing window agreed on a short call after written permission
Written permission and scope
You sign off on which feature, which test accounts and which attacks are in scope. Nothing starts before that.
Attack test
Direct and hidden prompt injection, attempts to extract the feature's instructions, cross-customer leakage, action limits and a deletion check, each dated and recorded.
Answer pack and readout
You get the answer pack and a call to go through results, so you can fix anything found before the reviewer sees it.
Consent. This runs only with written consent from your company before anything starts. Nothing is sent to anyone outside the agreed scope.
Method
How the answer is produced
Evidence, not assurances
Every answer points to a test that was run, on which version and date, and what happened, so the reviewer can check evidence instead of weighing claims.
Test what the feature reads, not only what users type
Typed attacks are only half of it. Documents and emails that carry their own instructions are a known attack route, listed by OWASP as indirect prompt injection under LLM01 in its Top 10 for LLM applications, so the test covers what the feature reads too.
Two accounts, one planted secret
A distinctive string is planted in one test account and hunted from another, through questions, search and summaries, to show whether data crosses between customers.
Bounded findings
The pack does not certify the feature or call it safe. An honest, limited finding keeps more credibility with a reviewer than a broad promise.
Why Amir
Designed and led by someone who has built fraud models in production
The patents closest to this problem:
Amir is a named inventor on US 12,634,298 B2 (Security posture management methods and systems using threat detection and response data, filed at Skyhawk Security; granted).
Amir is a named inventor on US 12,634,298 B2 (Security posture management methods and systems using threat detection and response data, filed at Skyhawk Security), background in security testing only.
View on Google PatentsAmir is a named inventor on EP 4744195 A2 (Methods and systems for threat assessment based on expected pathways of malicious actors, filed at Skyhawk Security; pending).
Amir is a named inventor on EP 4744195 A2 (Methods and systems for threat assessment based on expected pathways of malicious actors, filed at Skyhawk Security, pending), related to thinking in attacker routes.
View on Google PatentsThese patents were filed at the companies named. They show the problems Amir has worked on; they are not Riskernel products.
Is this you
You probably need this if
- A bank or insurer's third-party risk team sent a questionnaire with questions on prompt injection, data leakage or retention.
- You recently shipped an AI assistant, copilot or summarizer that reads customer documents or records.
- Your answers to security questions are written assurances with no date, version or test behind them.
- Your feature reads uploaded files, emails or web pages, and nobody has tested what happens when they contain instructions.
- Several customers share the same deployment, and nobody has tried to pull one customer's data out from another's account.
Questions
Before you reach out
Will you attack our production system?
Only what you approve in writing, normally a test account or test tenant on the live version of the feature.
Does this certify our feature as secure?
No. It records what was tried and what happened, so the reviewer can judge with evidence.
What if you find a problem?
You see it first, and you can fix it and have it retested before the pack goes to the bank.
What do you need from us?
Written permission, two or more test accounts, a short description of what the feature can read and do, and the reviewer's questionnaire if you have it.
Scope AI Feature Attack Test for Bank Review with Amir
Tell Amir what you run and what worries you. He replies with a short scope outline.