AI & Bedrock Security Audit: LLMs, RAG and agents in 2 weeks

Context

Most SMBs I meet went from AI POC to production in under 6 months. Bedrock, a RAG built on OpenSearch or pgvector, agents calling internal APIs with the service’s own permissions, system prompts containing sensitive business rules. All built fast, by a team discovering LLM-specific risks as it goes.

The result is often functional but exposed: the RAG returns documents the user has no right to see, a prompt injected into a PDF makes the agent take an action, Bedrock logs contain personal data, the model’s IAM role can invoke any model in any region. It holds, until the first customer incident or the first question from an auditor.

This audit is a 2-week security baseline, production focus. The scope: what runs, who accesses it, what the model can do and see, and how to make it defensible.

Who it’s for

• An AI platform in production (chatbot, RAG, agent, classification) on customer or internal data
• A Bedrock, SageMaker, Azure OpenAI or self-hosted LLM stack (Mistral, Llama)
• A RAG pipeline on OpenSearch, pgvector, Pinecone or equivalent
• Agents with access to tools: internal APIs, databases, third-party systems
• A customer, investor or auditor question about AI security
• An open question about what a malicious user could extract from the system

What’s delivered

Week 1 — Mapping and architecture

• Inventory of models, prompts, data sources, agents, tools and integrations in production
• Bedrock (or equivalent) architecture review: least-privilege IAM on models, Guardrails, PrivateLink, KMS encryption, invocation logging and personal data in logs
• Flow mapping: who sends what to the model, what the model can read, what it can trigger
• Vector index access review and per-tenant or per-user permissions

Week 2 — LLM threats and action plan

• Structured review against the OWASP Top 10 for LLM Applications: direct and indirect prompt injection, data leakage via RAG, excessive agent autonomy, data poisoning, system prompt leakage
• Targeted tests on the most likely scenarios for your context (injection via documents, Guardrails bypass, exfiltration through tools)
• Agent and tool permissions: least privilege, human confirmation, tenant isolation
• Baseline of a reproducible evaluation pipeline including security cases, so regressions are caught before production
• 30/60/90-day action plan prioritised across 4 axes: security, data confidentiality, operability, compliance

What’s not included

• Implementing the recommendations (covered by the retainer or a specialised engagement)
• Training a custom model or fine-tuning
• Exhaustive automated red teaming of the model (can be added as a complementary engagement)
• AI Act regulatory compliance, covered by the dedicated AI Act offer

Format and timeline

Fixed price set after a 15-minute scoping call, 2 weeks from kick-off to deliverable.

The audit naturally leads into a security retainer to drive execution of the action plan if needed.

Why Distribuée

6 AWS certifications including 3 Professional/Specialty (Solutions Architect Pro, DevOps Pro, Security Specialty), Generative AI Developer Professional in progress. Senior DevSecOps. Distribuée’s angle on AI: mission-critical rigor applied to a stack that was often built fast. The model is a production component like any other, with an identity, permissions and logs.