AI and LLM Red Teaming Services
AI red teaming (or LLM red teaming) is the adversarial security testing of AI and LLM systems — human operators attack live models to surface prompt injection, jailbreaks, data leakage, tool/agent abuse and unsafe outputs before attackers do. Berghem red-teams AI systems using the Promptware Kill Chain, OWASP LLM Top 10 and MITRE ATLAS.
What is AI red teaming
AI red teaming is an offensive exercise with a defined objective — for example, extracting customer data through the assistant, executing an unauthorized transaction via an agent, or poisoning a copilot's long-term memory — conducted against the real system, in production or an equivalent environment, under rules of engagement agreed in writing.
Unlike a scanner or a battery of automated prompts, the campaign is run by people who adapt each step to how the system responds. The operator combines direct and indirect prompt injection, tool and plugin abuse, system prompt extraction, persistence in vector stores, and command-and-control channels hidden in documents retrieved through RAG.
The result is not a list of vulnerabilities: it is a demonstration of which attack chains work end to end against your generative AI, how long each one took, what your SOC saw (or did not see), and which controls would have broken the chain earlier.
AI red teaming vs AI pentest
The two services are complementary. AI pentesting measures exposure — how many flaws exist and how severe they are. Red teaming measures resilience — whether an adversary with an objective can reach the end and whether you notice in time.
| Criterion | AI pentest | AI red teaming |
|---|---|---|
| Question it answers | Which vulnerabilities exist in my LLM, RAG, plugins and infrastructure? | Can a motivated adversary reach a business objective without being detected? |
| Primary metric | Exposure: number, severity (CVSS) and OWASP LLM Top 10 category of each finding | Resilience: complete chains to the objective, time to detection and response effectiveness |
| Scope | Defined and broad: the ten OWASP LLM Top 10 categories over a bounded system | Objective-driven: any path that reaches the target, including people, processes and integrations |
| Approach | Systematic and coverage-oriented — finds as many flaws as possible in the contracted time | Objective-oriented — chains flaws like a real attacker, with stealth and persistence |
| Typical duration | About 4 weeks, from kickoff to report | 4–8 weeks, with a continuous exploitation phase |
| SOC involvement | Usually notified; the focus is the system, not detection | Tested — optionally in purple team mode, validating detection and response live |
| Core deliverable | Vulnerability report with PoC and a prioritized remediation plan | Executive and technical report per attack chain, campaign replay and a 90-day plan |
| When to choose | Before launch, after relevant changes, or as a periodic control | When the system has already been pentested and you need to validate defense, detection and response |
Haven't run a pentest yet? Start with the AI and LLM pentest and move up to a Red Team campaign once the basic controls are in production.
Red Team for AI is part of Berghem, the AI security company for AI and LLM systems in Brazil and LATAM.
How does an AI red teaming engagement work?
An AI red team engagement moves through four connected stages: reconnaissance, attack scenarios, chaining and reporting. Human operators run every stage — automation only supports them — so the campaign adapts to what your systems actually do instead of following a fixed checklist.
Red teaming an LLM application is not the same as red teaming a network. The attack surface is language: system prompts, retrieved documents, tool descriptions, agent memory and the conversations your users have every day. Our operators treat each of those inputs as a potential entry point and each model output as a potential exit for data or unauthorized actions. The goal is not a list of prompts that make the model misbehave, but a demonstration of what a motivated adversary could achieve against your business — and whether anyone would notice while it happened.
Every engagement starts with a two-day threat modeling workshop with your team. Together we inventory the AI systems in scope, identify the crown jewels an attacker would target — customer data, transaction flows, internal tools, privileged integrations — and agree on adversary objectives, rules of engagement and success criteria. From that point the red team operates as an external attacker would, with a direct channel to your security team open for the whole campaign.
Reconnaissance
We map the AI attack surface from the outside in: which models are in use, what the system prompt reveals, which tools and functions the agent can call, which data sources feed the RAG pipeline and which third-party integrations sit behind it. Passive OSINT and active probing establish the starting position of a realistic adversary.
Attack scenarios
Using the OWASP LLM Top 10 and MITRE ATLAS as coverage maps, we design scenarios tied to the objectives agreed in threat modeling: direct and indirect prompt injection, jailbreaks and guardrail bypass, system prompt and data leakage, tool and function abuse, memory poisoning and supply chain attacks against models and packages.
Chaining
Isolated findings become an operation. Following the Promptware Kill Chain we chain initial access into escalation, reconnaissance, persistence, command-and-control, lateral movement and objective completion — proving impact with canary data rather than real records. This is where red teaming differs from a pentest: we measure how far an attacker gets and whether your detection and response react.
Reporting
Every chain is documented stage by stage with payloads, screenshots, logs and reproducible PoC. You receive an executive report, a technical report, an interactive campaign replay and a 90-day remediation plan, followed by a debrief with your engineering, security and product teams.
Which frameworks guide our AI and LLM red teaming?
We anchor every campaign to three public references, so findings arrive in a language your security, compliance and engineering teams already share.
Promptware Kill Chain
The seven-stage model we use to structure an AI attack from the first prompt injection to objective completion: initial access, escalation, reconnaissance, persistence, command-and-control, lateral movement and objective. It turns isolated prompt tricks into an end-to-end operation that can be measured, detected and replayed.
OWASP LLM Top 10
The reference list of the most critical risks in LLM applications — prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency and system prompt leakage among them. We use it as the coverage map for attack scenarios and as the classification for every finding we report.
MITRE ATLAS
MITRE's knowledge base of adversary tactics and techniques against AI-enabled systems, structured like MITRE ATT&CK. We map each executed technique to ATLAS so your SOC can build detections and your blue team can compare AI incidents with the rest of the threat landscape.
Frameworks give structure; operators give judgment. The techniques catalogued in OWASP and ATLAS are starting points — the value of a red team lies in combining them against your specific stack, your specific guardrails and your specific business flows.
Five phases
One coordinated operation
We work like a motivated adversary — not like a scanner. Each phase has clear deliverables, and you follow the operation in real time through our dashboard.
Threat modeling
We map your AI stack, identify the crown jewels and define adversary objectives together with your team.
Reconnaissance
OSINT, attack-surface enumeration, identification of models, plugins, exposed data and third-party integrations.
Exploitation
Promptware Kill Chain activated — prompt injection, escalation, credential harvesting, persistence via agent memory.
Objectives & impact
Lateral movement, simulated exfiltration, compromise of business flows. We document each path with evidence.
Report & debrief
Executive report, technical walkthrough, campaign replay, and a remediation plan prioritized by impact.
Methodology: OWASP LLM Top 10 and MITRE ATLAS
Every campaign is planned on two public references: the OWASP Top 10 for LLM Applications, which classifies the vulnerabilities we exploit, and MITRE ATLAS, which organizes the tactics and techniques of an adversary against AI systems. The Promptware Kill Chain is the thread that ties the two into an attack narrative.
In practice, each stage of the Promptware Kill Chain is mapped to ATLAS tactics and OWASP categories: initial access uses direct and multimodal prompt injection (LLM01) and corresponds to the Initial Access and AI Model Access tactics; escalation exploits excessive agency and tool-call abuse (LLM06), covering Execution and Privilege Escalation; reconnaissance extracts the system prompt and privileged context (LLM07) under the Discovery tactic; persistence poisons memory, vector stores and embeddings (LLM04, LLM08) under Persistence; command and control uses indirect channels in documents and content retrieved through RAG, under Command and Control; lateral movement propagates the instruction across agents and orchestration queues, documented with Execution and Collection and cross-referenced to MITRE ATT&CK's Lateral Movement; and actions on the objective demonstrate exfiltration through a legitimate channel (LLM02), under Exfiltration and Impact.
Two families of technique cut across every stage: evasion of guardrails and safety classifiers, recorded as Defense Evasion, and supply chain attacks on packages, models and datasets (LLM03), recorded as Resource Development. Each executed technique receives the corresponding ATLAS identifier and OWASP category in the technical report, so your team can map controls directly onto the framework they already use.
Which attack techniques do AI red teamers actually use?
Every technique below was observed in real 2025–26 incidents or academic research. All are executed with explicit authorization and blast-radius containment.
Prompt injection multimodal
Hidden instructions in images, PDFs, audio, and metadata. Breaks the trust boundary between data and instructions.
Tool / function abuse
Chaining of legitimate tool calls to reach unauthorized capabilities — file system, email, transactions.
Model & system prompt leak
Extraction of system instructions, privileged context, and model details via adversarial prompts.
Memory poisoning
Injection of persistent instructions into long-term memory, vector stores, and context shared across sessions.
Indirect prompt channel
Command-and-control channel via shared documents, comments, or content retrieved by RAG.
Agent-to-agent contagion
Propagation across agents via inter-agent calls, message queues, and shared orchestration contexts.
Data exfil via legitimate channel
Sensitive data leaving through responses, summaries, or actions that appear legitimate to detection.
Guardrail bypass
Encoding, role-play, long context, logic puzzle attacks, and safety classifier evasion.
Supply chain
Malicious packages, backdoored models, poisoned datasets — attacking before deploy.
AI red teaming in Brazil and LATAM
Berghem is headquartered in São Paulo and delivers AI red teaming across Brazil and Latin America, with a European presence through Berilo. Our operators work in Portuguese, Spanish, English and Italian — and that matters more than it sounds. Prompt injection, jailbreaks and social engineering of an LLM are language attacks: a model that resists English payloads is frequently exposed to the same techniques written in Portuguese or Spanish. We test the assistants your customers actually talk to, in the languages they actually use.
Regional context shapes the scenarios. Brazilian financial institutions operate under Banco Central cybersecurity requirements and LGPD, and fintechs, retailers, healthcare providers and telcos across LATAM are deploying customer-facing LLM assistants faster than their security programs can follow. We design adversary objectives around the data and flows that carry regulatory and business risk in your jurisdiction, and we write reports your auditors and regulators can read.
Working in the same time zone as your team means live coordination during the campaign, purple-team sessions with your SOC in business hours and a debrief in the room instead of an emailed PDF. For multinational groups we run the same methodology from São Paulo and from Europe, so a Brazilian subsidiary and a European headquarters receive comparable results.
Related services: AI and LLM pentest · AI security services · Red Team and attack simulation
What do you receive from an AI red teaming engagement?
Every campaign ends with four deliverables, each written for a different audience: leadership, engineering, the SOC and the program owner responsible for remediation.
Executive report (15–25 pp)
Business-language impact summary, risk map, top 5 attack paths, prioritized recommendations, and estimated financial exposure.
Technical report (60–120 pp)
Each attack chain documented stage-by-stage, with payloads, screenshots, logs, and reproducible PoC for the engineering team.
Campaign replay
Interactive visual timeline of each executed stage, operator decisions, and windows where the defense would have detected had observability been active.
90-day remediation plan
Prioritized actions (high/medium/low), suggested owners, estimated effort, and dependencies between controls. We revisit at 90 days to validate.
How are AI red team operations kept under control?
Every campaign starts with documented rules of engagement, blast-radius containment, and a direct channel with your response team if anything escapes scope.
Surgical scope
Systems, test accounts, time windows, and action types approved in writing before any execution.
24/7 red line
Direct channel between the campaign lead and your security team — we pause the operation at any moment.
No real data exfiltrated
We demonstrate exfiltration capability with canaries and synthetic data. Nothing sensitive leaves your perimeter.
Reversibility
Every modification to memory, configuration, or state is documented and rolled back at the end of the operation.
SOC coordination
"Purple team" mode available — we operate in coordination with your SOC to validate detection and response in real time.
Compliance & legal
Contract with NDA, legal authorization, data segregation, and auditable report for regulators and auditors.
AI red teaming: frequently asked questions
What is AI/LLM red teaming?
How is it different from an AI/LLM pentest?
Do you red-team agentic and RAG systems?
How long does an AI red team campaign take?
Is it safe to red-team production AI systems?
Which frameworks do you use for AI red teaming?
What do you receive at the end of the campaign?
Ready to find out what a motivated adversary can actually do?
2-day threat modeling workshop to start — leave with surface map, top 5 hypothetical attack paths, and a complete campaign proposal.
Schedule workshop