RAG security testing must follow the authorized path from source trust and access filters through ingestion, retrieval, output, and citation, with every exception tied to an owner.

A RAG answer carries the security decisions made at the source, access filter, ingestion step, retrieval path, output, and citation. We exercise that chain for poisoning, manipulation, and exfiltration within an authorized boundary. Findings stay linked to their evidence, owner, exception decision, and retest.

The findings cover the RAG path you authorized us to test, not the whole system. Linked poisoning and exfiltration results, boundary evidence, remediation retests, and a residual-risk log stand behind each claim.

Map the RAG security boundary Explore AI security

Some of the 500+ brands we've worked with

See all references

We first agree what sits inside the RAG boundary and how test data may be handled. Each representative failure case is then traced from source to citation, with remediation evidence attached to the original finding.

Authorize source-to-output scope
We document source trust, access filters, ingestion and retrieval routes, exfiltration concerns, citation behavior, dependencies, constraints, baseline evidence, and who is set up to accept or reject the result.
AI assist
Approved sources and ingestion paths are inventoried to draft the first boundary map.
Human gate
Has your data owner approved the sources, access rules, retrieval routes, outputs, and evidence handling? Your data owner confirms the sources, filters, and retrieval paths authorized for testing.
Exercise representative failure cases
In the approved environment, we run reviewed cases for poisoning, retrieval manipulation, exfiltration, and citation behavior. Only the controlled inputs and results needed for review are retained.
AI assist
Inside the fixed data and action limits, an agent may run approved cases and record the outcomes.
Human gate
Does a second authorized run produce the same finding from the controlled inputs and RAG state? Only after a Zeo security specialist reproduces the exfiltration or poisoning result does it become a finding.
Attach each exception to source
Observed behavior is compared with the agreed acceptance conditions. Every exception stays connected to the source, filter, ingestion step, retrieval route, output, or citation responsible for the result.
AI assist
Evidence is sorted by source, filter, ingestion step, and retrieval route for reviewer inspection.
Human gate
Which verified exceptions must close before your security lead will accept the tested RAG state? Your security lead reviews the verified exceptions and picks which ones require remediation before acceptance.
Repeat the changed route
After remediation, we rerun the affected cases and place the new result beside the original evidence. The handoff records the residual risk, accountable owner, stop state, and next review trigger.
AI assist
Approved remediation evidence becomes a draft retest summary that a specialist checks against the original finding.
Human gate
Has a named authority decided which risks block acceptance, which remain residual, and who owns the next review? Your designated owner decides whether an exception closes or remains residual risk.

Every deliverable follows the tested route from source and access decision through ingestion, retrieval, output, citation, exception, and retest.

Test evidence
Poisoning, exfiltration, and remediation findings pack
Verified findings and linked retests for source trust, access controls, ingestion poisoning, retrieval manipulation, exfiltration, and citations.
Risk register
Authorized RAG boundary and dependency inventory
Authorized sources, representative cases, dependencies, constraints, baseline evidence, assumptions, and unresolved inputs behind the test.
Report
Poisoning-path and citation exception findings
Cases reviewed against the acceptance conditions, with each critical exception attached to the affected RAG component.
Decision record
Residual-risk owners and next-review log
Conditions and decision state for the tested scope, with named owners, remaining risk, and the next review or stop point.

Choose this when retrieved material can cross an access boundary, alter an answer, expose data, or point the user to the wrong source.

A good fit when

Source trust, access filters, ingestion, retrieval, and citations sit with different teams, so no one owns the complete RAG attack path.
Your poisoning concerns keep appearing in review, but no authorized case has tested how tainted content moves from ingestion to citation.
A verified exfiltration or poisoning result reaches several owners, yet nobody knows who can close the exception or accept residual risk.
The source-to-citation path is mapped, but poisoning, retrieval manipulation, and exfiltration cases have not exercised every authorized link.
The representative poisoning cases cover ingestion and citation, while retrieval-manipulation dependencies and baseline evidence remain incomplete.
Acceptance checks identify critical exceptions, but remediation retests, named owners, and the final handoff are not connected.
Boundary evidence is retained, yet reviewers cannot trace a finding from its controlled input to the affected source, filter, or citation.

Better handled as other work when

You want poisoning, exfiltration, and citation findings to decide certification or regulatory acceptance. Audit and legal conclusions stay with your data authority.
You need assurance that every future source, ingestion event, retrieval route, or answer will be safe and accurate, although only authorized cases were tested.
You need production operation, new data acquisition, or remediation delivered, because this engagement ends at the authorized RAG test boundary.

If one of these is closer to your situation, start here instead: Explore AI security

It's hard to test a system well if you've never had to keep one running. We operate production AI ourselves, so our evaluation, security testing, and LLMOps work starts from what actually breaks. The people on it are senior engineers, and Zeo has been doing client work since 2011.

Content we've produced on this topic

Articleby Burak PehlivanWhat is WebMCP? Agentic Web and Websites Interacting with AI Agents Articleby Yiğit KonurMCP Server Architecture: State Management, Security & Tool Orchestration

Promptfoo
the plugin suite testing the retrieval pipeline itself for poisoning and leakage
Lakera Guard
the RAG-specific runtime layer flagging exfiltration attempts inside retrieved context
Mindgard
the continuous red-team engine covering document/RAG agents as a named use case
Giskard
the reproducible scan scoped to what a RAG application actually returns

Walk us through the source and retrieval map, access rules, known concerns, and the owner who can act on what the test reveals. The review follows the path from source to citation.

Inspect the RAG boundary

What has to be known before RAG security testing?

Start with the authorized view of source trust, access filters, ingestion and retrieval routes, exfiltration concerns, citation behavior, constraints, and data-handling rules. Named owners, representative cases, baseline evidence, and a decision-maker for the result complete the boundary.

Does the review cover every source and retrieval route?

Only when each source and route is expressly inside the authorization. Otherwise, we agree a representative boundary and report its coverage. The result applies to the tested sources, filters, ingestion and retrieval paths, outputs, and citations. Later changes need new evidence.

What supports the RAG acceptance decision?

The decision record combines the agreed acceptance results, critical-exception states, evidence coverage across the boundary, and the completeness of the handoff. Serious poisoning, manipulation, exfiltration, and citation gaps are reviewed one by one. An overall pass cannot close an unresolved consequential finding.

How does a RAG finding close?

Closing a RAG finding means rerunning the affected case, attaching the new evidence to the original record, and recording whether the designated owner closed the exception or kept the residual risk open.

By team

By industry

By tool

RAG Security, Data Exfiltration & Poisoning Testing

How we work

Authorize source-to-output scope

Exercise representative failure cases

Attach each exception to source

Repeat the changed route

What you get

Poisoning, exfiltration, and remediation findings pack

Authorized RAG boundary and dependency inventory

Poisoning-path and citation exception findings

Residual-risk owners and next-review log