QuinineCybersecurity
Book a Diagnostic
Q9 Continuous capability

Retrieval-augmented generation (RAG) security testing

Your RAG pipeline connects your AI to your most sensitive data. Q9 Continuous tests for unauthorised document retrieval, embedding poisoning, vector index enumeration, metadata leakage and filter bypass. If your AI can access it, Q9 Continuous finds out whether an attacker can too.

Book a Diagnostic Explore Q9 Continuous
Capability
02 / Retrieval-augmented generation (RAG)
Coverage
Confirmed during scoping
Tested in
Q9 Continuous, with human review
Mapped to
OWASP Top 10 for LLM Applications, MITRE ATLAS

01What it does

What it does

RAG security testing is adversarial testing of a retrieval-augmented generation pipeline: how documents are ingested and embedded, how the vector store is queried and filtered, and what the model is allowed to see on behalf of each user.

The question is simple: if your AI can access it, can an attacker? Q9 Continuous tests the access controls, isolation and integrity of the knowledge your model draws on, then gives you hardening guidance your engineers can act on. Every finding is reviewed by a person, and coverage is confirmed during scoping.

RAG pipeline test surfaceDocuments are ingested into a vector store. A user query passes through the retriever and access filters, retrieved chunks join the prompt, and the model answers. Test points sit on ingestion, the vector store, filters, retrieval and the answer.KNOWLEDGE BOUNDARYDocumentsINGESTIONUser queryPER-USERVector storeEMBEDDINGSRetrieverACL FILTERSPromptCONTEXTModel answerCITATIONST1T2T3T4T5
RAG testing follows the data: what goes into the index, who can pull it back out, and what the model repeats.

02Risk register

Risks we evaluate

What Q9 Continuous tests for within your agreed scope. Coverage is confirmed during scoping; not every item applies to every deployment.

  • 02.01Unauthorised document retrievalWhether a user can get the pipeline to return documents they should not be able to see.
  • 02.02Embedding and data poisoningWhether content placed in the knowledge base can steer answers or carry hidden instructions.
  • 02.03Vector index enumerationWhether the contents or structure of your vector store can be mapped from the outside.
  • 02.04Metadata leakageExposure of file names, authors, paths or other metadata attached to retrieved chunks.
  • 02.05Filter bypassWays around tenant, role or document filters applied at query time.
  • 02.06Knowledge base isolationSeparation between tenants, teams or data classifications sharing the same infrastructure.
  • 02.07Vector database access controlsHow the store itself is authenticated, authorised and exposed.

03Who needs it

Who needs it

  • Teams running internal knowledge assistants over company documents, tickets or wikis.
  • Products that let customers query their own data through an AI interface.
  • Organisations with multiple tenants, teams or data classifications sharing one retrieval stack.

04Approach

How Q9 Continuous tests it

Every test follows the same path, agreed in writing before any testing starts.

Our full approach

  1. Discovery

    We map your AI architecture, understand your threat model, and define what’s in scope based on your risk appetite and compliance obligations.

  2. Agreed scope & written authorisation

    Scope, environments, accounts and testing windows are agreed in writing. Nothing is tested without written authorisation from the people responsible for the system.

  3. Testing

    Q9 Continuous runs AI-driven tests against the authorised system, tailored to your deployment.

  4. Human-reviewed findings

    Every finding is reviewed by a person before it reaches you, with severity, context and stated limitations.

  5. Reporting & remediation

    Severity ratings, reproduction steps and remediation guidance your engineering team can act on, plus an executive summary for board-level reporting.

  6. Re-testing where agreed

    Where agreed, fixes are re-tested within the authorised scope through Continuous AI Pen Testing.

Testing runs on Q9 Continuous: fixes and significant changes can be re-tested within the authorised scope, and Q9 Driftmark (early access) can show when a checked system changes. Automated checks complement, and do not replace, independent penetration testing.

05Deliverables

What you receive

  • A detailed findings report with severity ratings and reproduction steps
  • Hardening recommendations for retrieval, filtering and ingestion
  • An executive summary for board-level reporting
  • Findings mapped to the OWASP Top 10 for LLM Applications
  • A clear statement of what was in scope, and of any testing limitations

Each test is a point-in-time check of an agreed scope. It is not a certification and does not guarantee that every risk has been found.

What We Test

Everything Q9 Continuous tests