Shipping an AI feature changes a product's risk profile even when nothing else in the codebase changes. A chatbot, an AI search assistant, or an LLM-powered support tool introduces a new input surface that traditional application security testing does not fully cover, and a new place where customer data can leak through a model response instead of a database breach.

AI Security Kenya is product-level security advisory for teams that have shipped, or are about to ship, an AI-powered feature — reviewing the feature as a whole system, not just the underlying model.

Who this is for

Product and engineering teams in Kenya integrating a large language model, AI chatbot, AI search, or an AI-assisted workflow into a customer-facing or internal product. Particularly relevant if you are:

Exposing an AI chat or assistant interface directly to end users or customers.
Connecting an AI feature to internal data, customer records, or paid APIs with usage-based billing.
Using third-party AI vendors or SDKs where API keys, prompts, and response data leave your infrastructure.
Under pressure to ship an AI feature quickly, where security review was not part of the original scope.

What gets reviewed

Review Area	What Is Examined
Model Access Control	Who and what can call the model, at what privilege level, with what data attached to the request.
Prompt-Injection Exposure	Whether untrusted user input or retrieved content can override system instructions or trigger unintended actions.
Data Leakage	Whether model responses, logs, or third-party API calls expose more customer data than the feature requires.
Vendor & API Key Hygiene	Key scope, rotation, storage, and exposure in client bundles or repository history.
Output Handling	Whether AI-generated output is trusted downstream in ways that create injection or automation risk.
Rate & Cost Abuse	Whether the AI feature can be abused to drive unbounded cost or denial of service against your account.

The boundary: permission before testing

RULES OF ENGAGEMENT

No assessment begins without a signed scope defining exactly which AI features, endpoints, and environments are in scope, the testing window, and the escalation contact. Testing is non-destructive by default and stays inside the agreed scope as a matter of policy, not negotiation.

What you receive

AI feature attack-surface map: every input, integration, and data touchpoint the AI feature can reach.
Findings register: prompt-injection and data-leakage issues with severity and reproduction evidence.
Vendor exposure review: API key scope and storage risk across every third-party AI provider in use.
Remediation guidance: specific, prioritised fixes ranked by risk against effort.

Related, deeper technical services

For AI features built on Retrieval-Augmented Generation, see RAG Security. For autonomous AI agents that call tools or take actions, see AI Agent Security. For the underlying n8n/automation review methodology, see Secure Automation & AI Workflow Review.

How engagements start: the 48-Hour Secure Digital Workflow Assessment

Most clients begin with the 48-Hour Secure Digital Workflow Assessment, a fixed-fee, fixed-scope discovery engagement, delivered jointly with HarLyn Digital Partners, that establishes the current-state map and identifies whether a deeper AI security review is warranted.

START HERE

Engagements begin with a fixed-scope scoping call. Clear decisions before code, and no obligation to proceed to follow-on build work.

Request a Scoping Call →