AI / LLM Security Testing in Mumbai · BFSI & Fintech

Mumbai's banks, brokers, insurers and fintechs are moving AI from pilot to production faster than any other Indian sector — LLM customer-service assistants, RAG copilots over policy and product documentation, AI-assisted underwriting and lending decisions, and ML fraud-detection in the transaction path. Macksofy's AI practice, run from our Bandra Kurla Complex headquarters, tests those systems the way an attacker meets them: the live model, the retrieval pipeline, the tools an agent can invoke, and the training-data supply chain — mapped to the OWASP LLM Top 10 and MITRE ATLAS, with deliverables the AI-safety team and the CISO both accept.

In BFSI the stakes are different from a SaaS chatbot: an AI system here can move money, approve credit, price a policy or expose customer financial data. So we scope an agentic tool call the way we scope a transaction. On a bank engagement we chain prompt injection into tool-call abuse into data exfiltration — a poisoned document in the RAG corpus or a crafted customer message reaches the model as instructions, an agent is steered into a privileged action on the customer's behalf (the confused-deputy pattern), and account data, PII or system-prompt secrets leak through a channel the guardrail never inspected.

Regulators are catching up fast, and boards want to be ahead of them. The RBI has moved deliberately toward responsible-AI expectations for the financial sector (including its FREE-AI committee work on ethical and responsible AI enablement), SEBI is scrutinising AI/ML use by market intermediaries, and IRDAI is watching AI in claims and underwriting. Our reporting is written for that audience: model-risk framing an audit committee recognises, PII and fairness exposure spelled out in DPDP Act terms, and a control narrative that a Chief Risk Officer can carry into the quarterly cyber and model-risk review without a rewrite.

RAG and multi-tenancy are tested directly. Cross-customer or cross-desk retrieval leakage — one user surfacing another's embedded statements, KYC documents or positions because access control lives in app code the LLM path bypasses — is a failure we probe at the vector store's own authorization layer, alongside embedding-space adversarial queries and indirect injection via poisoned documents. For AI in the fraud or AML path we also test model-evasion and poisoning: whether a determined adversary can shape inputs to slip past the detection model or degrade it over time.

Agentic and function-calling systems get the deepest scrutiny because they can act inside regulated flows. We fuzz function-call schemas, test tool-chain confused-deputy paths where an agent wields a privileged tool with the customer's authority, enumerate and abuse exposed MCP servers, and attempt sandbox escape from any code-execution tool. Where an agent touches payments, beneficiary management or KYC, an unintended tool call is a money-movement or onboarding event — and we test velocity, authorization and reconciliation around it, the same money-movement-graph discipline we bring to Mumbai BFSI VAPT.

The supply chain underneath is in scope by default: provenance of HuggingFace weights and third-party embedding models, training-data poisoning in fine-tune pipelines, membership inference and model inversion to check whether a model trained on customer or transaction data leaks it, and cost-amplification (long-context, tool-loop) attacks that turn inference spend into a denial-of-wallet problem. Every High or Critical finding carries a manually validated reproducer prompt, a severity score, and a business-impact framing tied to the actual value or customer data at risk — not a generic scanner label.

We co-build the guardrails, not just catalogue the gaps. Each exploitable finding ships with a suggested guardrail prompt, an output-validator rule (PII, secrets, prompt-leak, toxicity), and a sandboxing or rate-limit pattern the platform team can deploy the same week — and, for banks running a SOC, we can pair exploitable findings with detection logic the SIEM team can deploy alongside the fix. Guardrail retesting inside 30 days is in the base statement of work. Delivery runs from BKC — onsite kickoff at any Mumbai BFSI office within the same business day, four-hour onsite SLA across the MMR including Thane and Navi Mumbai.