AI / LLM Security Testing in Bengaluru · SaaS & GCC

Bengaluru builds more of India's production AI than anywhere else — the LLM copilots inside B2B SaaS, the RAG assistants embedded in fintech apps, and the agentic tooling being stood up inside US and EU global capability centres. Macksofy's AI practice tests those systems the way an attacker meets them: not a generic web pentest with the word 'AI' bolted on, but a targeted assault on the model behind your chatbot, the retrieval pipeline that feeds it context, the tools your agent can invoke, and the fine-tune and embedding supply chain underneath. Every finding is mapped to the OWASP LLM Top 10 and MITRE ATLAS so your AI-safety lead and your CISO read the same report.

The Bengaluru buyer is technical and hands-on — AppSec leads and staff engineers who shortlist vendors that publish methodology and OSCP/OSWE-grade credentials, not procurement decks. So we lead with the attack chain, not the brochure. On a typical product engagement we chain prompt injection into tool-call abuse into data exfiltration: a poisoned support-ticket or a crafted RAG document reaches the model as instructions, the agent is coaxed into invoking a privileged function on the user's behalf (the confused-deputy pattern), and customer data or system-prompt secrets leak out through an output channel the guardrail never inspected.

RAG is where most Bengaluru SaaS products are quietly exposed. Multi-tenant retrieval is the recurring failure — one tenant's query surfacing another tenant's embedded documents because the vector store's access-control lives in application code the LLM path bypasses. We test cross-tenant retrieval leakage directly, run embedding-space attacks (adversarial same-meaning queries that dodge keyword filters), probe indirect injection via poisoned corpus documents, and review the vector DB's own authorization model rather than trusting the app layer to enforce it.

Agentic and function-calling products get the deepest scrutiny because they can act, not just talk. We fuzz function-call schemas, test tool-chain confused-deputy paths where the agent wields a privileged tool with the user's authority, enumerate and abuse exposed MCP servers, and attempt sandbox escape from any code-execution tool the agent can reach. For fintech agents that touch money movement or KYC, an unintended tool call is not a chatbot glitch — it is a transaction, and we scope it as one.

The supply chain underneath the model is in scope by default. We review the provenance of HuggingFace weights and embedding models, look for training-data poisoning vectors in fine-tune pipelines, and run membership-inference and model-inversion tests to see whether the training corpus leaks PII — a live DPDP Act exposure for any Bengaluru product handling Indian customer data, and a GDPR one for GCCs serving EU users. Cost-amplification is tested too: long-context and tool-loop abuse that turns your inference bill into a denial-of-wallet attack.

Bengaluru GCCs carry the extra weight of a parent's AI-governance program — NIST AI RMF, ISO/IEC 42001, and increasingly the EU AI Act's high-risk-system controls. We format the engagement so the India centre's evidence drops straight into the parent's governance framework: a threat model mapped to OWASP LLM Top 10 and ATLAS, per-finding reproducer prompts, and a control-mapping annex the group CISO's team can attest against without a translation layer. For Series-A to Series-D SaaS entering enterprise sales, the same report answers the AI-security section of the customer security questionnaires that now gate every deal.

We don't just hand back findings — we co-build the guardrails. Every exploitable finding ships with a suggested guardrail prompt, an output-validator rule (PII, secrets, prompt-leak, toxicity classifiers), and a sandboxing or rate-limit pattern your platform team can deploy the same week. Guardrail retesting inside 30 days is in the base statement of work: we re-run the attack against your fix at no extra cost, because a guardrail that was never adversarially retested is a guardrail you're only guessing about. Senior consultants run the engagement end to end and fly in for kickoff and readout — same-week onsite from Mumbai, no bait-and-switch staffing.