Find the risks in AI before attackers or regulators do.
We test the AI your customers and staff use for security, reliability, fairness and governance. You get the evidence your board and regulator will ask for.
Not ready to talk yet? The readiness check takes three minutes, with no call needed.
- Your AI Risk Scorecard in two to four weeks, at a fixed price
- The first external company on the Scottish Government's AI Register
- Led by people who have built and run AI in production
Clients and past work
- Scottish Government
- NHS 24
- Alliance Health
- Thoughtworks
- Crimson
Who it's for
Most organisations come to us when someone asks: "How do you know your AI is safe?"
Usually a client, insurer, board or procurement team, about a customer chatbot, an internal assistant or an agent working in their systems.
AI doesn't make more mistakes than people. It makes them faster, louder and harder to unwind.
Most organisations have AI in use before anyone has tested how it fails: a chatbot that can be talked into revealing data, an assistant that gives staff confident wrong answers, or an agent with access to systems nobody is watching. Testing once at launch isn't enough, because AI changes every time the underlying model is updated.
This is already happening.
- AI SecuritySeptember 2026
Spain's data protection authority reports the first breach notified to it that was allegedly carried out by an AI agent. The agent logged in, found weaknesses in the application, changed personal data and accessed invoices.
Source: AI Incident Database(opens in a new tab) - AI GovernanceJune 2026
An OpenAI agent under testing reaches a non-public Australian Medicare statistics portal. The agency only finds out in September.
Source: BISI(opens in a new tab) - AI Reliability2024
A tribunal holds Air Canada liable after its chatbot gives a customer wrong information about bereavement fares.
Source: Moffatt v. Air Canada, 2024 BCCRT 149(opens in a new tab) - AI Fairness and Inclusion2013 to 2021
The Dutch tax authorities' risk algorithm uses nationality as a risk factor. Tens of thousands of families are falsely accused of childcare benefit fraud, with ethnic minorities hit hardest. The government resigns over the scandal in January 2021.
Source: Amnesty International(opens in a new tab)
These failures were all found after the damage was done. Independent testing finds them first.
Why FireBreak
What you'd get elsewhere, and what we do differently.
A large consultancy
What you typically getBroad advisory across strategy, policy and implementation, usually over months, and often from a firm that also sells AI delivery.
What FireBreak doesSenior specialists test one thing, how your AI fails, to a fixed scope of 80 checks. We don't build, sell or implement AI.
A penetration tester
What you typically getTests your networks and applications. Most don't test how the AI itself behaves: whether it can be manipulated, gives wrong answers or treats groups differently.
What FireBreak doesWe test the AI's behaviour across security, reliability, fairness and governance, with a CREST-accredited partner for the infrastructure.
The AI vendor's own testing
What you typically getTests the model in general, not your configuration, your data or your users. And it's the vendor marking its own work.
What FireBreak doesWe test your deployment the way your customers and staff actually use it, with nothing to gain from the result.
Waiting until something goes wrong
What you typically getMost AI failures are found by customers, journalists or regulators, as in the cases above.
What FireBreak doesWe find them first, and give you evidence that you looked.
Certification and standards
CREST-accredited partners
Our security testing partners hold CREST accreditation, the recognised standard for penetration testing.
Mapped to the EU AI Act
Every finding is mapped to the EU AI Act, ISO/IEC 42001, UK GDPR and the Equality Act 2010.
On the Scottish Government's AI Register
The first external company on the register.
Why FireBreak
Led by people who have answered to boards for technology risk.
“FireBreak told us plainly where our AI plans carried risk and what had to be in place before we scaled. That independent view gave our leadership team the confidence to move forward.”
What we test
Three risks tested. One layer of evidence around them.
Security, reliability, and fairness and inclusion are the risks we test. Governance sits around them as the evidence that you have tested them and addressed what was found.
Select an area to see what we check.
Risk tested
AI Security
Can the AI be manipulated, or made to expose information or take actions it shouldn't?
We test:
- Prompt injection, both typed and hidden in documents, emails or web pages the AI reads
- Jailbreaks
- Leakage of personal or confidential data
- Agents with more access than the job needs
- Poisoned source content
Governance only holds up if the other three have actually been tested. Without testing, it's just paperwork.
How it works
Five steps, two to four weeks.
Agree outcomes
We agree what “good” looks like for your use of AI and your risk appetite.
Benchmark
We compare your AI against known failure patterns from live AI systems.
Test
We test across all four areas and rank every finding by severity.
Recommend
Clear, prioritised guidance your team or chosen provider can act on.
Re-test and prove
Once changes are made, we re-test to confirm they work, and hand over the test harness so you can verify results yourself.
Where to start
The AI Risk Scorecard
One AI system, tested across security, reliability, fairness and governance, and mapped to the EU AI Act. A board-ready report in two to four weeks, at a fixed price.
- Report in
- Two to four weeks
- Your team's time
- About 4 hours
- Price
- Fixed, agreed before we start
What's included
- One chatbot, assistant or AI agent in scope
- Testing across all four areas, every finding ranked by severity
- Mapping to the EU AI Act, ISO/IEC 42001, UK GDPR and the Equality Act 2010
- A board-ready report and evidence pack
- One re-test after you've made changes
- The test harness, so you can re-run every test yourself
Pages from the sample report. Illustrative, not a real client.
See what you get
Get the full sample report by email
Each area rated, every finding ranked by severity and mapped to the EU AI Act, ISO/IEC 42001, UK GDPR and the Equality Act 2010, with the key EU AI Act dates.
Independent by design
We never assess systems we built, and we never sell fixes for what we find. So we have no reason to find problems that aren't there, and no reason to miss ones that are.
Questions buyers ask
Find out where your AI stands in two to four weeks.
Someone is already asking about your AI, or you're ready to scope a test.
You want a quick view of where you stand first. Three minutes, no call needed.
Take the free readiness check