Quinine Cybersecurity · London
Quinine Cybersecurity builds Q9 Continuous, a platform for AI security testing, re-testing and evidence. Find weaknesses in LLMs, RAG systems, agents and their supporting APIs through authorised testing with human-reviewed findings.
01Our product
Start with a one-week Diagnostic, then keep testing as your AI changes. Every finding is reviewed by a person before it is reported.
From £1,500 one-week test
A one-week, deep AI penetration test of an agreed scope.
Explore DiagnosticFrom £1,200 per month
Ongoing authorised testing and re-testing after fixes and significant changes.
Explore Continuous TestingFrom £99 per month
Change monitoring against a previously checked state, and approved signed public proof.
Explore DriftmarkStarting prices depend on the agreed scope.
02How it works
Nothing is tested before scope is agreed and authorised in writing.
Understand the application and security requirements.
Confirm testing boundaries in writing.
Test the agreed AI system.
Review findings, evidence and severity.
Re-test fixes and significant changes.
Preserve evidence and verify approved public proof where supported.
03What we test
The parts of an AI system an attacker would use. Coverage is confirmed during scoping.
Prompt injection, jailbreaks, unsafe model behaviour and the data a model can reach.
Retrieval pipelines, vector stores, document access boundaries and poisoned content.
Agents, the tools they call and the permissions they act with.
The APIs and model endpoints around your AI, including authentication and object-level access.
Access, data flows, trust boundaries, secrets and monitoring around an AI application.
Finding the AI systems and integrations in use, so they can be brought into scope.
04Evidence and proof
Every result records what was tested, when, and what was not covered.
A proof is not a certification and does not guarantee security. Automated platform checks complement, and do not replace, an independent penetration test.
Methods and reports reference OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, ISO/IEC 27001, UK GDPR and the EU AI Act. Framework alignment
Alignment means our methods and reports reference these frameworks. It is not a certification, and an assessment does not by itself make a system compliant.
05Who it is for
A single test goes stale as models, prompts and integrations change.
You ship AI features every sprint. Re-testing after significant changes keeps your findings current.
Dated, human-reviewed evidence supports your risk and assurance work as AI systems evolve.
One record of scope, findings and re-tests shows what was checked and what has changed since.
06Founder
Founder & CEO
I am an MSc Cybersecurity postgraduate from NCSC-certified Lancaster University. I built Quinine Cybersecurity because I saw the same pattern across every organisation deploying AI: the models shipped fast, the security came later, and the gap kept growing. Quinine exists to close that gap. We provide hands-on AI security testing for companies that take their AI deployments seriously.
07FAQ
The continuous AI penetration testing platform from Quinine Cybersecurity. It holds the agreed scope, reviewed findings and evidence, runs authorised re-tests, and lets an approved proof be checked publicly.
A one-week AI penetration test of an agreed scope. We confirm the boundaries, test instruction, data and tool boundaries, then walk your team through findings with evidence, limitations and a route to re-test fixes.
Both. Q9 Continuous runs AI-driven tests; every finding is reviewed by a person before it is reported.
After the Diagnostic, once the scope is agreed in writing. It then re-tests fixes and significant changes within that authorised scope.
Supported change signals for a previously checked system, compared with the checked state, so you can see when a re-check is due. Q9 Driftmark is in early access; edition, scope and availability are confirmed before you join.
No. A signed proof states what was checked, for which version and when. It is not a certification and does not guarantee security.
08Next step
Start with a Q9 Continuous Diagnostic, or talk through your application and scope first. Submitting an enquiry never authorises or starts any testing.
Please do not send credentials or confidential findings through the enquiry form.
