Q9 Continuous is the continuous AI penetration testing product from Quinine Cybersecurity Ltd, for companies building and deploying AI. It runs AI-driven tests; every finding is reviewed by a person before it is reported. It carries your testing forward: the scope you authorised, the findings people reviewed, and the version of the system that was checked.
What We Test
Q9 Continuous runs AI penetration testing on your application within a scope you authorise in writing, and people at Quinine Cybersecurity review every reported finding.
Large language models, RAG pipelines, agentic AI and tool execution, APIs and application endpoints, AI application security controls and AI usage discovery, reported as human-reviewed findings with remediation guidance.
Q9 Continuous holds the agreed scope, reviewed findings and evidence, runs authorised re-tests and supported change signals, and lets an approved proof be checked publicly.
Automated checks on the platform support the people reviewing them. They do not replace an independent penetration test, and nothing on the platform is a certification.
From first test to continuity
Every test follows three steps. Q9 Continuous takes what they produce and keeps it attached to the system you are running.
We map your AI architecture and threat model, then agree in writing what is in scope.
AI-driven tests of the authorised scope, with every reported finding reviewed by a person.
Findings with severity, evidence and remediation guidance, walked through with your team.
The products
Starting prices depend on the agreed scope. Driftmark availability is confirmed before onboarding.
A one-week AI penetration test of an agreed application scope.
From £1,500one-week test
Re-testing after fixes and significant changes, within an authorised scope.
From £1,200per month
Change visibility for previously checked systems, and approved public proof.
From £99per month
Anyone with a proof reference can check whether an approved proof is still valid, and what it covers, without seeing client findings.
AI Watch and AI Proof require our approval before production use. Team and Vendors editions are in development and not yet available.
How the platform works
Three rules apply to everything that runs on Q9 Continuous, whichever product you use.
Nothing is tested until the people responsible for the system confirm the scope, environment and accounts in writing.
Automated checks produce signals. People decide what is a finding, how severe it is, and what it means for your system.
Results are tied to the version and date that were checked, with evidence references your engineers can follow.
What a proof means
A valid proof is provenance for a dated, reviewed check of a stated version. It is not a certification.
What We Test
Testing capabilities covered within an agreed Diagnostic or Continuous AI Pen Testing scope. Coverage is confirmed during scoping.
Next step
We will suggest a sensible starting point. Testing only begins once scope and written authorisation are agreed.