Cybersecurity
RAG security
RAG lets a model answer from your documents. It also gives an attacker a new path: whatever a user can make the system retrieve, they can read. We test whether retrieval respects the same permissions your document systems do.
The problem this service solves
Many RAG systems ingest every document into one index with the permissions of a service account. When a user asks a question, retrieval finds the most similar passages regardless of whether the user could open those documents. The model then summarizes them. The access control that protected the SharePoint site or wiki is gone.
Ingestion is the other weakness. If anyone can add content to a source the system trusts, they can plant instructions or false facts that surface in other people’s answers.
What is in scope
-
Authorization at retrieval
Whether permissions are stored with chunks and enforced at query time, and how group changes propagate.
-
Ingestion pipeline
Who can add content, how it is sanitized and how provenance is tracked.
-
Indirect injection and poisoning
Planting instructions or false content and observing the effect on answers.
-
Vector store security
Access control, tenant separation, network exposure and encryption of the vector database.
-
Embedding exposure
What embeddings reveal and who can read or export them.
-
Output controls
Citations, redaction of sensitive fields and handling of confidential labels.
-
Logging
Records of queries, retrieved sources and answers, with privacy-appropriate retention.
How the work runs
Map
Trace the data.
-
1
Pipeline review
Follow documents from source to index to answer, noting identity and permission handling at each step.
Test
Cross the lines.
-
2
Cross-user retrieval
Ask questions as users with different access and compare what is surfaced.
-
3
Poisoning and injection
Add test content and observe the effect on other users’ answers.
-
4
Infrastructure testing
Test the vector store and connectors like any other service.
Improve
Fix.
-
5
Design recommendations
Per-user filtering, source-level permissions, ingestion controls and monitoring.
What you receive
- Data flow diagram with trust boundaries
- Cross-user retrieval test results
- Ingestion and poisoning findings
- Vector store and connector findings
- Authorization design recommendations
- Retest
Tooling and technique
Platforms listed are those commonly found in RAG systems. We do not endorse or resell them.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Architecture diagram and connector list
- Test users with different permissions
- A non-production index with representative content
What this service is not
- Search quality tuning
- Data classification projects (though we can recommend one)
What changes afterwards
- Retrieval honors source permissions
- Content from untrusted sources is isolated or labeled
- Answers can be traced to sources
Questions people ask
Is per-user filtering hard?
It depends on the connectors and index. The common approach stores access lists with each chunk and filters at query time. Keeping those lists current is the real challenge.
Can embeddings be reversed into text?
Research has shown that text can sometimes be partially reconstructed from embeddings, so we treat them as sensitive data and protect them like the documents themselves.
Related
-
LLM security assessments
Test chatbots, copilots and LLM-backed features for prompt injection, data leakage, unsafe output handling and excessive permissions.
-
AI security architecture
Design the controls around AI features: gateways, identity, data boundaries, evaluation, monitoring and governance.
-
Identity governance
Joiner-mover-leaver processes, access reviews, role design and entitlement cleanup for workforce and application access.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response