AI Agent Security Assessment Firms in 2026: A Comparison You Can Check

We searched for AI agent security assessment firms on 5 November 2026. The first page held vendor service pages, a paid directory, a certification scheme, and two standards bodies stating that no agreed method for assessing agents exists yet. The only lists of firms came from Astra, which ranks itself first and publishes no scoring method, and Mend, which lists itself first and states no basis for its order. The firms with the deepest public research on attacking AI agents did not appear at all.

This comparison follows the method we use for all of our comparisons: real firms, criteria you can verify from the outside, a source behind every fact, and no scoring. It differs from our other comparisons in one way. We build AI agents and we do not sell security assessments, so there is no Vindler entry. The last section says what we do instead and when you need one of the firms below.

Why agent security is a different assessment

A chatbot that answers questions can embarrass you. An agent that holds credentials, calls tools and acts on your systems can be steered into doing damage, and the steering can arrive inside a web page, a document or a GitHub issue the agent reads. We wrote about recent cases in AI agent security is application security: the serious incidents ran through ordinary application flaws, package supply chains and over-broad permissions, with prompt injection as the way in.

That changes what a useful assessment covers. Testing only the prompts, with jailbreak lists and refusal checks, misses most of the risk. The assessment has to reach the tools the agent can call, the credentials and scopes it holds, the MCP servers it connects to, and the web application and cloud around it.

Six criteria you can check from the outside

1. Public AI vulnerability research with a named target. Advisories, CVEs or write-ups against real AI products, such as a coding agent, an MCP server or an agentic browser. Explainers of the OWASP list do not count.

2. A scope that reaches the agent's tools, permissions and identity, and the application around it. Check whether the service page names tool or function calling, MCP, OAuth scopes or agent identity, alongside classic web, API and cloud testing in the same engagement.

3. Published reports of AI assessments. A client-approved report or a client-named write-up you can read.

4. A deliverable you can reproduce and retest. Proof-of-concept exploits, severity ranking, a retest after fixes, and artefacts you keep.

5. Open tooling you can run yourself. An open-source tool for testing LLM applications or agents, which lets you see the firm's thinking before you hire it.

6. Architecture advice as well as attacks. Published design patterns for agents, such as separating trusted from untrusted input or giving each tool the least privilege it needs, from people who have looked at how agent systems are built.

Every firm's service page names OWASP's LLM Top 10, MITRE ATLAS or the NIST AI RMF, so naming a framework tells you little. None of the firms below publishes a price.

The firms

Every fact below was collected on 5 November 2026 from the firm's own site and datasheets, its public research, GitHub, conference materials and press. Firms are grouped by the kind of buyer they fit, not ranked.

Research-led security firms

Trail of Bits (New York, founded 2012, remote-first) has the most public evidence of any firm here, on every criterion (about, AI/ML services). Its scope runs from training pipelines and model files to "deployed agent loops", and its deliverables include exploit proofs of concept, Semgrep and CodeQL rules tuned to the code it reviewed, and a retest after fixes; its four published AI reviews took between two and five weeks of effort each. Its public AI reviews include OpenAI's OpenClaw and Google's Private AI Compute in September 2026, and it published its pre-launch audit of Perplexity's Comet browser, where four prompt injection techniques exfiltrated Gmail data (write-up). Its research on MCP includes servers that attack you before you use them, and it has released open tools such as mcp-context-protector and Fickling (machine learning research). Best for a company shipping an agent or an AI product to the public that wants the deepest assessment available and a report it can show customers. Expect a waiting list and a price to match.

Doyensec (San Francisco and San Marino) has published the most direct work on agent identity that we found. The MCP AuthN/Z Nightmare covers OAuth and OpenID flaws in MCP, unauthenticated local WebSocket servers, and a consent gap in a draft authorisation standard, and Doyensec contributed security text to that draft. Its AI audit scope covers agents, sandboxed code execution, internal API access, access controls and excessive agency (service page). It does not publish client reports or headcount. Best for a team whose agent acts on behalf of users across systems, where authentication and authorisation are the main risk.

Compass Security (Jona, Switzerland, founded 1999, more than 70 people, CREST approved) has the most explicit published scope: AI agents, RAG and data sources, tool and MCP integrations, the surrounding application, and access control and authorisation, with the OWASP agentic guidance among its frameworks (service page, company, CREST). At Pwn2Own Berlin in May 2026 a Compass team exploited OpenAI Codex in the coding agent category (ZDI results). Best for a European company that wants a certified firm with a scope that names agents and MCP in writing.

Kudelski Security (the cybersecurity division of Switzerland's Kudelski Group) showed at Black Hat USA 2025 how far ordinary bugs go in AI tools: its researchers audited more than a dozen AI developer tools and found that most of the damage needed no prompt injection (slides and content). One finding, disclosed to CodeRabbit in January 2025, was a code analysis tool in its AI review pipeline running outside the sandbox; CodeRabbit disabled the tool within an hour and deployed a full fix within twelve (CodeRabbit's response). It sells an AI threat and risk assessment as part of a broader security portfolio (launch release), and we could not find its deliverables or scope in detail. Best for a buyer who wants the assessment to treat an AI tool as the software it is.

Established penetration testing firms with AI practices

NCC Group (Manchester, listed in London, £305 million revenue in the year to September 2025) published one of the early public write-ups of prompt injection, in December 2022 (research, annual report). Its AI lead, David Brauchler, presented architectural controls for agentic AI at Black Hat USA 2025 (slides), and its writing on secure AI architectures sets out trust separation patterns and least privilege per model, which makes it the strongest firm here on the sixth criterion. Its services cover AI red teaming, threat modelling and testing across the development lifecycle, including plugin endpoints (datasheet). We found no published client reports. Best for an enterprise that wants an established firm to help design the controls as well as test them.

Bishop Fox (Arizona, founded 2005) publishes the clearest description of one engagement covering both the AI and the application around it: LLM attacks alongside access control, cross-site and server-side request forgery testing, optional cloud testing for privilege escalation and runaway costs, and "insecure function/tool invocation" in the threat table (datasheet). The deliverable is a severity-ranked report with proofs of concept and a readout, with an optional targeted retest after fixes. It released Broken Hill, an open tool that automates one family of jailbreak attacks against open-weight models. Best for a company that wants its AI feature tested in the same engagement as the web application and cloud it runs in.

Praetorian (Austin, Texas) names agents, plugins, function calling and tool misuse in its LLM testing scope, includes follow-up verification after fixes, and lists NIST, MITRE ATLAS, OWASP and Google's SAIF as frameworks (service page). In February 2026 it released Augustus, an open-source scanner with more than 210 probes across 28 model providers, which a team can run before deciding to hire anyone. MCP is not mentioned on the service page, and we found no public AI vulnerability research with a named target. Best for a US company that wants a structured test with a retest and a tool to keep using.

Reversec (the former WithSecure consulting unit, independent since April 2025, holding CREST STAR and NCSC CHECK) states the point of this comparison on its own service page: most risks come from how models are integrated into systems and workflows, not from the models (launch release, service page). It offers penetration testing of LLM applications and of the infrastructure that supports them, and it maintains spikee, an open prompt injection testing kit that covers full application pipelines. Its earlier research on prompt injection against ReAct agents is no longer at its original address. Best for a UK or Nordic company that needs government-recognised certifications on the assessor.

AI-native vendors with a services arm

HiddenLayer (Austin, Texas, founded 2022) sells an AI security product and a professional services team alongside it, covering red teaming of agentic, generative and predictive AI and AI supply chain risk, with a claim of more than 100 engagements (services). Its research team publishes CVEs in AI coding tools, including a path traversal in Windsurf and an MCP symlink bypass in Qodo Gen (advisories), and techniques such as ShadowLogic backdoors in model graphs (research). Its scope says "agentic" without naming tools or permissions. Best for a company that wants an assessment and a monitoring product from one vendor. Expect the product to be part of the conversation.

Also considered

NetSPI launched AI and LLM penetration testing in 2023 and merged with Synack in October 2026 (service page); we found no public AI research with a named target and could not confirm how its scope treats agent tools. Include Security and Leviathan Security have no AI assessment service we could find. Palo Alto Networks Unit 42 sells an AI security assessment whose published scope is adoption risk and governance (Unit 42). Mindgard and Lakera lead with products, and Mindgard delivers red teaming through partners.

The comparison table

Where Vindler fits

We build AI agents, and we do not sell security assessments. Our one-week Production Readiness Review looks at whether an agent system is ready to run in production, and its agreement says explicitly that it is not a penetration test or a security audit. What we do on security is build it into the system: in the multi-agent assistant we worked on, every tool is fetched per request under the user's own credentials, so each action is scoped to that user's account, and destructive changes wait for human approval.

If your agent touches customer data, holds credentials or acts on other systems, have one of the firms above assess it before launch and again after major changes. Ask your builder, whoever it is, to give the assessor the architecture, the tool list with each tool's permissions, and test accounts. Most of the risk sits in those places.

How to run the evaluation in a week

Send three firms the same one-page description of your agent: what it reads, which tools it can call, which credentials it holds, and who can talk to it. Ask each one what it would test, how long it would take, what you receive, and whether a retest is included. A firm that answers with a list of jailbreaks has not read the page. A firm that asks about your tool permissions and where untrusted content enters has.

Method and corrections

All facts were collected on 5 November 2026 from each firm's website, datasheets and research blog, GitHub, conference materials and press. Every fact in a profile links to its source. Several headcounts and headquarters could not be confirmed from a first-party source and are left out. The full method shared by our comparisons is here.

If you work at a firm named here and a fact is wrong or out of date, write to [email protected] with "Comparison corrections" in the subject and a link to the source. We will correct it and record the change here, with the date.