Dependencies & supply chain
Vulnerable packages, whether they're reachable from your entry points, and a signed SBOM.
Reachability · SBOM · signing · VEX
What Verdict Runtime covers: code, dependencies, IaC, secrets, containers, cloud and Kubernetes posture, and live testing across the OWASP Web, API and LLM Top 10.
Every engine lands in one schema, deduplicated and correlated, so you read one report, not six.
Vulnerable packages, whether they're reachable from your entry points, and a signed SBOM.
Injection, auth, access-control and crypto defects, cross-checked by two engines.
Committed credentials, cloud and Kubernetes misconfiguration, hijackable CI workflows.
Authenticated testing, including broken authorization that only shows when two real accounts are compared.
Live adversarial testing of your model-backed features, judged against planted canaries and markers, not a model's opinion.
An agent that learns your app's real API traffic, then tests rules like double-redeemed coupons and replayed checkouts.
| OWASP | Check | What a finding proves |
|---|---|---|
| LLM01 | Prompt injection | A crafted instruction overrode the system prompt and returned an exact attacker-chosen marker. |
| LLM01 | Indirect prompt injection | An instruction planted in fetched content — not in the user's message — was followed. |
| LLM01 | Multi-turn escalation | Defences that hold on a single message fail across a real multi-turn conversation. |
| LLM02 | Sensitive information disclosure | A canary secret planted in your own data came back in a model response. |
| LLM03 | Plugin and tool enumeration | The model disclosed the real integrations it can reach when asked to list them. |
| LLM04 | Persistent data poisoning | Content written by one account changed what a different account was told, on a fresh session. |
| LLM05 | Improper output handling | Model output reached the page or a downstream system without escaping. |
| LLM06 | Excessive agency | The model invoked a sensitive tool outside the user's stated intent. |
| LLM07 | System prompt leakage | A known verbatim fragment of your own system prompt was recovered. |
| LLM08 | Cross-tenant retrieval leakage | Retrieval crossed a tenant boundary and returned another tenant's canary. |
| LLM08 | Knowledge-base poisoning | A document submitted through your own product changed later answers after sync. |
| LLM09 | Hallucination under pressure | The model produced confident technical detail about an entity that does not exist. |
| LLM10 | Unbounded consumption | Oversized input and long conversations were accepted with no effective cap. |
| Agentic | Agent code execution | The agent ran an attacker-supplied command through its own execution tool. |
| Agentic | Tool parameter injection | An authorised tool was re-invoked with an out-of-scope parameter value. |
| Agentic | Agent-to-agent trust | A message claiming another agent's identity was accepted without verification. |
| Agentic | Identity and guardrail erosion | Sustained reframing across turns moved the model off its assigned identity and limits. |
Seventeen of twenty-one checks shown. Every one requires your written authorisation before it sends a single request.
One repository, one report, no obligation: the findings, the evidence behind each one, the fixes we can prepare, and an honest note on what we couldn't check.