What is an LLM vulnerability scanner?

An LLM vulnerability scanner sends batteries of adversarial probes — jailbreaks, prompt injections, PII extraction attempts, harmful-content requests — at a target LLM and grades the responses. The output is a vulnerability + optimization report with per-probe evidence, severity, and a prioritized fix list.

Which LLMs can I scan with FilterPrompt?

OpenAI, Anthropic, Google Gemini, Azure OpenAI, plus any OpenAI-compatible endpoint — Ollama, Groq, Mistral, Together AI, OpenRouter, Perplexity, Hugging Face, vLLM, or your own custom endpoint. Bring your own keys per tenant.

What kinds of vulnerabilities does FilterPrompt test for?

Jailbreaks (DAN, role hijack, translation smuggling), direct and indirect prompt injection, system-prompt extraction, harmful-content compliance, PII / secret leakage, bias & fairness, RAG poisoning, agent/tool abuse, output quality, and robustness — categories map to the OWASP LLM Top 10.

How are probes graded?

Each probe declares an evaluator: regex match, refusal-check, contains-check, or an AI judge (Gemini 3 Flash). Pass/fail comes with severity, category, the exact prompt sent, the model's full response, and the evaluator's reason — fully auditable.

How much does a scan cost?

1 credit per probe executed. New accounts get 1 welcome credit on signup. Pay-as-you-go credit packs after that — credits never expire. Connecting LLMs and creating tenants is free.

Best Practices for LLM Security: A 30-Item Checklist for Production GenAI

Best Practice · 2018-11-27 · 15 min read · FilterPrompt Team

Thirty concrete, testable best practices for LLM security — from prompt design and provider-key hygiene to logging, tenancy, and incident response.

Most LLM security best-practice posts are vague. This one is not. Below are 30 concrete, testable items you can audit your stack against this afternoon. Each item maps to a specific control your team can ship.

Prompt design (1–6)

1. Treat every token not from your trusted system prompt as untrusted input
2. Wrap untrusted input in clearly delimited blocks the model is told never to override
3. Embed a canary token in your system prompt and alert if it ever appears in a response
4. Avoid mixing instructions and data in the same message when possible
5. Use the system role for instructions, the user role for input, and never blend them
6. Keep system prompts short — long system prompts get diluted and easier to override

Input gating (7–12)

7. Block known-injection patterns at the scanner before any LLM call
8. Score prompts with a semantic injection detector, not just regex
9. Redact PII on the input side before shipping prompts to your provider
10. Strip secret-looking strings (API keys, tokens) from prompts unconditionally
11. Cap prompt length per tenant to prevent prompt-flood abuse
12. Reject prompts that contain zero-width characters or unusual unicode

Output validation (13–18)

13. Block markdown images pointing to non-allowlisted hosts
14. Strip JS-protocol links from markdown responses
15. Detect and block leaked system-prompt fragments in responses
16. Redact PII on the output side, not just the input side
17. Validate structured outputs (JSON schemas) before returning to the client
18. For tool-calling models, allowlist the tools the model can actually invoke

Tenancy and keys (19–24)

19. One scanner key per tenant. Never share keys across customers
20. Encrypt provider keys at rest. Mask in the UI after first save
21. Per-tenant rate limits and monthly token quotas, enforced at the proxy
22. Per-tenant rule sets — your enterprise rules are not your free-tier rules
23. Rotate scanner keys on a schedule and on every employee departure
24. Bring-your-own provider keys when possible

Logging and audit (25–30)

25. Log every request with verdict, rules fired, tokens used, latency, and cost
26. Redact PII inside the log itself — do not create a new compliance liability
27. Per-tenant log retention configured to match the tenant's contract
28. Webhook on every block so your security team sees attacks in real time
29. Sample 50 blocks per week and have a human review for false positives
30. Quarterly red-team exercise against your own scanner — the only honest test

Deployment and Infrastructure Security Considerations

Securing your LLM deployment extends beyond just the model itself. The infrastructure hosting your GenAI applications, from API gateways to data storage, must adhere to stringent security standards. This includes network segmentation, hardened operating systems, and meticulous access controls to prevent unauthorized access and data exfiltration. A robust security posture at the infrastructure layer forms the bedrock of a trustworthy AI system, ensuring that even if an LLM is compromised, the blast radius is contained.

Organizations should treat LLM infrastructure with the same criticality as sensitive financial or customer data systems. This often means leveraging existing cloud security best practices, but with an added layer of scrutiny due to the evolving threat landscape specific to AI. Continuous monitoring of infrastructure logs and metrics for anomalies is paramount, alongside regular vulnerability assessments and penetration testing of the entire application stack.

Model Risk Management and Lifecycle Security

The lifecycle of an LLM extends from data ingestion and training to deployment and continuous retraining. Each phase introduces unique security risks that demand specific mitigation strategies. Model risk management isn't a one-time assessment; it's an ongoing process of evaluating and addressing potential vulnerabilities, biases, and unintended behaviors that could emerge as the model evolves or interacts with new data. This includes rigorous validation protocols before any model version is pushed to production.

Understanding the provenance of training data, the integrity of the training pipeline, and the potential for model inversion attacks or data poisoning is critical. Establishing clear governance around model updates and version control is a non-negotiable requirement for maintaining security and compliance. Without a structured approach to model lifecycle security, even well-secured infrastructure can serve a compromised or vulnerable AI model.

Maintain clear data lineage for all training data, including sources and preprocessing steps.
Implement access controls for model training environments and artifacts.
Scan model weights and artifacts for malware or embedded malicious code.
Perform adversarial robustness testing on new model versions before deployment.
Ensure secure versioning and rollback capabilities for all deployed models.
Regularly audit the model's behavior for drift or unexpected outputs that could indicate compromise.

Regulatory Compliance and Ethical AI Safeguards

The regulatory landscape for AI is rapidly evolving, with frameworks like the EU AI Act, NIST AI RMF, and OWASP LLM Top 10 providing critical guidance. Compliance isn't merely about avoiding penalties; it's about building trust, demonstrating accountability, and ensuring ethical deployment of GenAI. Organizations must proactively integrate these regulatory requirements into their security and development workflows, rather than treating them as an afterthought. This holistic approach ensures that AI systems are not only secure but also fair, transparent, and aligned with societal values.

The EU AI Act, for instance, categorizes AI systems by risk level, imposing stricter requirements on high-risk applications, including conformity assessments, risk management systems, and human oversight. NIST AI RMF offers a more operational framework for managing AI risks across the lifecycle. The OWASP LLM Top 10, on the other hand, provides a developer-centric view of the most critical security vulnerabilities. Combining these perspectives helps create a comprehensive compliance strategy.

Incident Response and Recovery for GenAI Systems

Even with the most robust security measures, incidents can occur. A well-defined incident response plan tailored for GenAI systems is crucial. This plan must go beyond traditional IT incident response, accounting for the unique characteristics of LLMs, such as subtle model degradation, prompt injection leading to sensitive data exposure, or adversarial attacks altering model behavior. Rapid detection, containment, eradication, and recovery are paramount to minimize damage and maintain user trust.

The response plan should include specific playbooks for different LLM-specific incident types. For example, a prompt injection incident might trigger a review of specific input filters, an immediate alert to the security team, and a temporary rollback to a known-safe model version. Post-incident analysis must focus not only on the technical root cause but also on identifying systemic weaknesses that allowed the incident to occur, feeding back into improved security controls and model development practices. Regular tabletop exercises are essential to test and refine these plans.

Establish clear roles and responsibilities for GenAI incident response teams.
Develop specific playbooks for LLM-related incidents (e.g., data leakage, model poisoning, adversarial attacks).
Integrate LLM monitoring and alerting with existing SIEM/SOAR platforms.
Ensure backup and recovery procedures for model artifacts, training data, and infrastructure configurations.
Practice isolated environment forensics for compromised LLM components to prevent further spread.
Implement a communication plan for stakeholders, including user notification protocols for data breaches or service disruptions.

Advanced Threat Detection and Hunting

The dynamic and often opaque nature of LLMs necessitates advanced threat detection and proactive hunting techniques that go beyond signature-based approaches. Adversaries are constantly developing new injection methods, data exfiltration strategies, and ways to manipulate AI systems. Organizations need to invest in behavioral analytics, anomaly detection, and semantic analysis tools that can identify subtle deviations from normal LLM interaction patterns or unexpected outputs, even without pre-defined attack signatures.

This involves building sophisticated monitoring dashboards that track metrics like sudden increases in token usage, unusual API call sequences, or responses that deviate significantly from expected topics or sentiment. Threat hunting for LLMs means actively probing the system for weaknesses, simulating adversarial attacks using red-teaming methodologies, and continuously researching new AI-specific vulnerabilities to stay ahead of the curve. Combining automated detection with human expertise is key to uncovering sophisticated attacks.

Secure Integration with Enterprise Systems

LLMs rarely operate in isolation; they integrate with a myriad of existing enterprise systems, from CRM and ERP to knowledge bases and internal APIs. Each integration point represents a potential attack surface. Ensuring secure data exchange, robust authentication and authorization mechanisms between systems, and careful management of privileges is critical to prevent lateral movement of attackers or unauthorized data access. The principle of least privilege must be rigorously applied not just within the LLM's direct environment, but across its entire integration ecosystem.

This includes validating the security posture of any third-party services or data sources that the LLM interacts with, managing API keys for these connections with extreme care, and implementing secure coding practices for all integration logic. Vulnerabilities in a connected system can cascade, allowing an attacker to leverage the LLM as a pivot point. Regular security audits of integration layers and data flows are essential to maintain a secure and resilient GenAI architecture.