ARES / SHADOW AI
Ares hunts for AI across your reachable attack surface, interrogates supported interfaces, and validates the exposures an adversary could exploit. MITRE ATLAS mapping connects the evidence to the techniques behind the threat.
EVIDENCE BEFORE ACTION
Exposed models, overprivileged agents, and retrieval stores.
THE ARES METHOD
Build the assessment around how your environment operates.
02
Define authorized endpoints and network access. Provide the identities and credentials needed for the assessment.
03
Enable the prompt, retrieval, data-access, and agent-tool checks appropriate to your target.
04
Confirm scope and supported interactions. Finding a service does not authorize every test.
05
Launch and review the evidence with MITRE ATLAS context.
Five steps. One controlled assessment.
ASSESSMENT WORKFLOW / NOT A PERFORMANCE METRIC
Map the reachable surface and identify supported AI services from observed evidence.
Compare discovered endpoints with your AI register. Investigate what is known, missing, or newly exposed.
Launch an authorized assessment with the identities, modules, and access appropriate to the target.
Review findings and their evidence, with MITRE ATLAS context and the limits of what was tested.
Apply the appropriate response through your existing controls, then test again to evaluate the result.
MITRE ATLAS is a living knowledge base of adversary tactics and techniques involving AI. Ares connects supported findings to recognizable adversary techniques using the probe, finding type, and assessment vantage.
Can untrusted instructions redirect AI behavior?
LLM Prompt Injection, AML.T0051
Can a probe extract the assistant’s system prompt?
Extract LLM System Prompt, AML.T0056
Can an assistant be induced to invoke a function beyond its intended boundary?
AI Agent Tool Invocation, AML.T0053
Does an interface disclose agent tools or their definitions?
Discover AI Agent Configuration, AML.T0084
Can retrieval expose credentials from indexed material?
RAG Credential Harvesting, AML.T0082
Can an internal vector store disclose document content?
RAG Databases, AML.T0085.000
Does an inference endpoint expose an observable cost-control gap?
Cost Harvesting, AML.T0034
Mappings depend on the evidence and access available. These examples do not imply that every technique is reachable in every engagement.
A supported probe exists.
The probe ran with the access provided.
A finding was produced and tied to observed behavior.
A completed probe with no finding does not establish that a system is secure. An unreachable service is a coverage gap that needs attention.
Explore the ATLAS matrix, technique context, mitigations, and attributed incident stories. Supported report views and Navigator-layer exports carry coverage information into assessment discussions. The evidence remains specific to your environment.
Internet
Publicly reachable chat interfaces, inference APIs, gateways, and exposed AI services
Internal campaign agent
Reachable internal AI infrastructure, supported vector-store interfaces, model services, and agent platforms
Connected repository
AI-related code and configuration, model artifacts, dependency risks, and prompt-construction logic
Mobile build
Bundled models, AI runtimes, SDK evidence, and supported AI interactions observed during application assessment
Credentials, enabled modules, supported protocols, and network reach determine what can be tested. Connecting another vantage can reveal parts of the AI system that an external assessment cannot observe.
An asset name tells you where to look. A reproduced exposure tells you what needs to change.
Ares brings together the affected endpoint, observed behavior, captured evidence, severity, and relevant attack-technique context. Your defenders can use that evidence to decide whether to restrict access, remove an exposure, rotate a credential, narrow an agent’s permissions, or isolate a service through the controls they operate.
Then run the assessment again to validate the change.
Discover the service. Prove the exposure. Give defenders a path to containment.
Ares supports interdiction through discovery and adversarial validation. Containment actions are carried out through your organization’s security and infrastructure controls.
TALK TO ASSAIL
Find services outside your register and investigate their boundaries with evidence your defenders can act on.
Your environment. Your objectives. A mission built around both.
