Secure AI retainer
Prompt injection
Can text in an email, ticket or web page make your agent act?
Security Assessments · AI
AI security assessment for small business.
Find what your AI tools and agents can reach, what they leak, and how to lock them down. One fixed price, set after a short scoping call.
- NIST AI RMF
- ISO/IEC 42001
- OWASP LLM Top 10
AI agent security assessment
Six things we check. Every one written down.
Each card shows where it is delivered. The $10,000 review is the NIST AI RMF and ISO/IEC 42001 gap review. Hands-on testing runs on the Secure AI retainer, scoped on a call.
Secure AI retainer
Agent permissions
What each agent can read, send, change or delete, and under whose credentials.
Secure AI retainer
Data leakage
Where customer and company data flows into AI tools, and where it should not.
Secure AI retainer
Shadow AI
Extensions, bundled assistants and personal accounts nobody approved.
Governance review
Guardrails
What an agent may do alone, what needs a human, and what it never touches.
Governance review
Audit trail
Whether you can reconstruct what an agent did, on what basis, and when.
NIST AI RMF gap assessment
Mapped to the frameworks your customers ask about.
NIST AI RMF
Govern · Map · Measure · Manage
Gaps scored across all four functions and ranked by risk.
Used for board and customer assurance
ISO/IEC 42001
AI management system
Readiness review of the policies, roles and controls the standard expects.
Certification by an accredited registrar
OWASP LLM Top 10
Top 10 for LLM Applications
Your agents and AI features checked against each risk on the OWASP list.
Feeds the findings register
What you get
Four documents. Yours to keep.
The inventory and findings register come from Secure AI retainer work. The gap map comes from the review; the roadmap and readout come with Assessment & Roadmap.
- 01AI inventorySecure AI retainerEvery AI tool and agent, its owner and the data it can reach.
- 02Findings registerSecure AI retainerEach finding with severity, how to reproduce it and a fix owner.
- 03Framework gap mapGovernance reviewGaps against NIST AI RMF, ISO/IEC 42001 or both, scored.
- 04Roadmap and readoutAssessment & RoadmapWhat to fix first, walked through with leadership.
- 01ScopeTools and agents listed, fixed price agreed
- 02AssessInterviews, configuration and testing
- 03ScoreEach gap rated and risk-ranked
- 04PlanRoadmap drafted
- 05ReadoutWalkthrough with leadership
AI security assessment pricing
Published prices. Fixed after scoping.
Start here
AI security & governance review
NIST AI RMF and ISO/IEC 42001 review.
from $10,000
Framework gap review only. Agent and prompt-injection testing is on the Secure AI retainer.Full assessment
Assessment & Roadmap
One framework, scored gap analysis, roadmap and readout.
50 to 300 people
$15,000 to $40,000
Typically 3 to 6 weeksEnterprise, 300+
Scope this
$50,000 to $125,000
Typically 6 to 12 weeksOngoing
Secure AI retainer
Prompt-injection and agent testing, the AI inventory and the findings register, scoped against your stack on a call.
from $2,600
per month. Fractional CISO and AI security audit included in Command, $14,625 per month.Where you land depends on how many tools, agents and integrations are in scope. Every assessment price is on the Security Assessments page.
FAQ
Before you book.
How much does an AI security assessment cost?
Published prices start at $10,000 for an AI security and governance review against NIST AI RMF and ISO/IEC 42001. A full one-framework assessment and roadmap for a 50 to 300 person organization is $15,000 to $40,000. A short scoping call sets a fixed price before work begins.
Is this a NIST AI RMF gap assessment?
It can be. NIST AI RMF is one of three frameworks we assess against, with ISO/IEC 42001 and the OWASP Top 10 for LLM Applications. Each gap is scored and ranked by risk.
Do you test AI agents for prompt injection?
Yes, as part of a Secure AI retainer scoped against your stack on the call. It is not part of the $10,000 review. Agents are tested against the content they actually process, such as email, tickets and web pages, and each finding records what the agent could reach. Scope, window and stop conditions are agreed in writing first.
Are you an auditor or certification body?
No. TheZaraAI is an advisory practice. ISO/IEC 42001 certification is issued by an accredited registrar. We get you ready and write down the evidence.
Who does the work?
Jax Scott, founder of TheZaraAI: a woman and U.S. Army veteran with more than 20 years in military and enterprise security, and former Deputy CISO and VP of Cybersecurity at Pearson. Nothing is subcontracted.
Start with a fifteen-minute scoping call.
Tell us which AI tools and agents you run. We will tell you what to assess and what it will cost.