The short answer
Buy the assessment that answers your release decision. A penetration test looks for exploitable weaknesses in an agreed technical scope. An AI security assessment can also examine retrieval, model behaviour and agent permissions. A governance review examines responsibilities and evidence. These scopes overlap, but the labels alone do not tell you what will be tested.
Start with a decision, not a scanner
Write down what you need to decide: whether an internal assistant can access customer files, whether an agent may update the CRM, or whether a supplier integration is ready for a pilot. Then name the systems, users and actions involved. A quote for an unspecified ‘AI audit’ leaves too much room for mismatched expectations.
Our suggested brief has five lines: business purpose, data involved, permitted actions, release deadline and accountable decision-maker. Attach an architecture sketch and identify the environment available for authorised testing. Keep production customer data out of initial enquiry forms.
Compare the evidence each scope should produce
For a web or API penetration test, ask which authentication flows, roles, endpoints and tenant boundaries are included. For an AI assessment, add retrieval permissions, unsafe tool actions, misleading outputs and external content that can influence the model. For governance work, ask which decisions, records and control owners will be reviewed.
OWASP describes excessive agency as risk arising from excessive functionality, permissions or autonomy. NIST’s AI RMF offers a voluntary framework for managing AI risk. Neither reference turns a limited engagement into a complete compliance assessment. [1][2]
Use a small acceptance matrix
The following is our illustrative procurement worksheet, not a claim about a client engagement. For each row, agree the setup, expected result, evidence and person accepting the outcome. Include both allowed and denied requests: a system that refuses everything is not a usable control.
A release decision worksheet
| Decision to test | Evidence to request |
|---|---|
| Can one customer retrieve another customer’s information? | Allowed and denied retrieval cases, including source links and cached answers. |
| Can an assistant perform an unapproved write? | A controlled test showing the action is blocked at the tool or service boundary. |
| Can the team explain a failed control? | A reproducible finding, named owner and an agreed retest condition. |
Make the report useful after the meeting
Request a finding register with affected component, prerequisites, observed behaviour, business consequence, suggested remediation and limitations. Ask for enough evidence to reproduce a finding safely, with secrets and personal data removed. Separate confirmed findings from hypotheses that need more access or time.
Agree whether remediation support and retesting are included. A successful retest concerns the tested fix in the tested version; it does not certify every path through a changing AI system. Record unresolved issues, compensating controls and who accepts residual risk before expanding access.
Before you accept the proposal
- Name the applications, model configuration, integrations and test environment.
- Set written authorisation, data-handling rules and stop conditions.
- Specify test coverage, exclusions and the evidence format.
- Agree how critical findings are escalated during the engagement.
- Separate initial assessment, remediation and retest costs.
Questions buyers ask
Is an AI assessment a replacement for a penetration test?
Not automatically. An AI feature still depends on web, API and cloud controls. Agree coverage of both conventional attack paths and AI-specific behaviour, or commission complementary scopes.
What makes a quote comparable?
Compare environments, identities, integrations, manual testing, deliverables and retest allowance. A lower price can reflect a narrower scope; ask what decision the work actually supports.
Need to define the right test?
Bring the product, its data flows and the decision blocking release. We can scope the assessment and the evidence your team needs.
Explore security testingKeep exploring
Sources and editorial method
SundAI editorial guidance, prepared with AI assistance. Source claims are linked; worksheets and scenarios are our suggested planning tools, not observed client outcomes. This article is not a certification or a legal opinion. Sources checked on 16 October 2026.