AI Attack Testing for Small Businesses

What we test

• Prompt injection: instructions hidden in emails, documents and web pages that an AI assistant reads and then follows, such as summarizing a confidential file to an outsider.
• Consent phishing: a convincing app that asks staff to "allow access" to their mailbox or drive. No password is stolen, so sign-in protection alone does not stop it.
• AI-assisted impersonation: messages, and where agreed, voice, that imitate an owner or director asking for a payment, a password reset or a file.
• AI tool sprawl: note-takers, browser extensions and assistants with broad access to mail, calendars and files, and what each one can see.

Why it matters now

Most small firms added AI tools quickly: a note-taker on calls, an assistant in the inbox, an extension in the browser. Each one can read your data, and some can act on it. An attacker who can put text in front of that tool, in an email, a shared document or a meeting invite, may be able to steer it. Regulators and insurers are starting to ask how you control this. The answer starts with knowing what your tools would do.

How we run it

Testing starts with a signed authorization that sets the scope, dates and contacts. We use test content and accounts we control, never real client data, and we test your tools and settings, not the AI provider's own systems. Findings come with plain fixes: settings to change, apps to remove, and the lines your AI usage policy should include.

Who does the work

Christian Ririe leads every compliance engagement personally. He spent 15 years at the World Bank, where he worked with its Internal Audit department on the yearly audits, testing servers and systems for vulnerabilities. We test to the public NIST SP 800-115 guide and OWASP testing methods.

We use AI to draft, scan and test, and every deliverable is reviewed, tailored and owned by TechFort. That is how a small firm gets a complete program at a fraction of what it usually costs.