Question 1

What is a RAG system?

Accepted Answer

RAG stands for Retrieval-Augmented Generation - an AI architecture where a large language model (LLM) first retrieves relevant documents or knowledge snippets from an external data source (retrieval) and then incorporates them into response generation (generation). The model "hallucinates" less, as it accesses current, context-specific knowledge. Typical use cases: internal knowledge bases, AI-assisted customer services, compliance chatbots, and document analysis systems. The vector database (e.g., Pinecone, Weaviate, Chroma, pgvector) stores the semantically-encoded document embeddings.

Question 2

What is document poisoning?

Accepted Answer

Document poisoning is an attack on RAG systems in which an attacker deliberately injects malicious content into the knowledge base. Since the LLM trusts the retrieved context, the attacker can control the model's behavior through poisoned documents: causing it to output false information, exfiltrate sensitive data, or hide prompt injection instructions that execute on the next retrieval. This attack is particularly dangerous because it compromises the data source - not the model itself - which classic security solutions often do not detect.

Question 3

How secure are vector databases?

Accepted Answer

Vector databases such as Pinecone, Weaviate, Chroma, Qdrant, or pgvector present specific security risks that go far beyond classic database security: insufficient access controls at the embedding level, inadequate tenant isolation (multi-tenancy weaknesses), missing input sanitization for document uploads, unencrypted embeddings at rest and in transit, and missing audit logs for retrieval operations. Additionally, under certain circumstances, the original text can be reconstructed from embeddings (model inversion at the embedding level). A dedicated RAG security test systematically examines all these vectors.

Question 4

What is indirect prompt injection in RAG?

Accepted Answer

Indirect prompt injection (OWASP LLM01 - indirect variant) is the most dangerous attack on RAG systems: an attacker places instructions in an external document that the RAG system later retrieves and passes to the LLM as context. The model interprets these instructions as legitimate requests - without the actual user knowing anything about it. Examples: hidden instructions in public PDFs, manipulated websites that are crawled, or malicious email attachments in automated workflows. Consequences range from data exfiltration and identity theft to remote code execution when the AI agent has tool access.

Question 5

Which RAG architectures do you test?

Accepted Answer

We test all common RAG implementations: simple single-stage RAG (query → vector search → LLM), advanced RAG (re-ranking, HyDE, multi-query), agentic RAG with tool use and multi-step reasoning, knowledge graph RAG (Neo4j, Amazon Neptune), hybrid RAG (vector + BM25 search), self-RAG, and corrective RAG. We are familiar with common frameworks (LangChain, LlamaIndex, Haystack, DSPy, AutoGen) and leading vector databases (Pinecone, Weaviate, Chroma, Qdrant, Milvus, pgvector, Redis Vector). The test approach is individually tailored to your specific architecture.

Question 6

What does a RAG security test cost?

Accepted Answer

A dedicated RAG security test starts from EUR 10,000 as part of a comprehensive AI security assessment (from EUR 15,000). The price depends on the complexity of your RAG architecture: number of data sources, retrieval strategies, connected agent capabilities, and compliance requirements. Within 48 hours you receive a binding fixed-price offer - no hourly rates, no additional charges. The result is an audit-ready report with compliance mapping to OWASP LLM Top 10, MITRE ATLAS, and EU AI Act.

Question 7

How do I protect my RAG system?

Accepted Answer

The most important security measures for RAG systems: 1) Strict input validation and sanitization of all documents before ingestion into the vector database. 2) Robust access controls at the embedding and document level (row-level security). 3) Detection and filtering of prompt injection patterns in retrieved contexts (contextual guardrails). 4) Tenant isolation in the vector database for multi-tenant systems. 5) Audit logs for all retrieval operations with anomaly detection. 6) Output validation and grounding checks against hallucinations and unexpected behavioral changes. 7) Regular integrity checks of the knowledge base for unauthorized content. An AWARE7 security test delivers a prioritized remediation roadmap for all these measures.

Question 8

Do I need a separate RAG test or is an LLM pentest sufficient?

Accepted Answer

A classic LLM pentest tests model behavior - prompt injection via user input, jailbreaking, guardrail bypass, data exfiltration from the model. A RAG system has additional attack surfaces that an LLM pentest does not cover: vector database security, the retrieval pipeline, document ingestion, and the security of all data sources. We always recommend a dedicated RAG security test for RAG-based systems - either standalone or as part of a comprehensive AI security assessment that combines both.

Question 9

Is a RAG security test relevant for the EU AI Act?

Accepted Answer

Yes. If your RAG system is deployed in a high-risk AI context (Article 6 EU AI Act - e.g., automated decisions on credit, insurance, employment, critical infrastructure), Article 15 requires demonstrably robust security measures against data manipulation and adversarial attacks. RAG systems with poisonable knowledge bases are explicitly relevant in the context of training data poisoning and data governance (Article 10). Our report is designed as an auditable compliance document and maps all findings to the relevant EU AI Act articles, OWASP LLM categories, and MITRE ATLAS techniques.

How secure is your RAG system?

The Four Main Attack Vectors on RAG Systems

Document Poisoning

Vector Database Manipulation

Retrieval Manipulation

Indirect Prompt Injection

How a RAG system works - and where attacks target

What we test in your RAG system

Document Poisoning & Data Poisoning

Vector Database Security

Indirect Prompt Injection

Retrieval Pipeline Testing

RAG Guardrail Assessment

Agentic RAG & Tool Security

Our approach to RAG security testing

Architecture Analysis & Threat Modeling

Data Sources & Ingestion Path Analysis

Document Poisoning & Injection Tests

Vector Database & Retrieval Tests

Exploitation & Reporting

Transparently calculated

RAG Security Test

AI Security Assessment

What sets us apart from other providers

Research and teaching as our foundation

Digital sovereignty: no compromises

Fixed price within 24h: predictable project timelines

Your dedicated contact

Frequently Asked Questions about RAG Security

How secure is your RAG system really?