Services

Two engagements. The same standard of evidence.

Sunshield tests networks, and the AI systems companies connect to their data. Both are scoped, authorized, and written for the people who have to act.

01 · Automated and manual

Network Penetration Testing

External and internal testing of the network you own. Scanners cover the ground. Manual testing decides which exposures are actually exploitable.

Request a Scope

A network penetration test at Sunshield is a scoped attempt to see how far an attacker could get, with evidence your team can verify. Automated tooling maps hosts, services, and common weaknesses. Manual work follows the paths that change the outcome: trust between systems, exposed management planes, and identity routes that a scanner lists but does not understand.

Automated coverage

Discovery and vulnerability identification across the in-scope ranges, so the engagement does not depend on someone remembering every host.

Manual testing

Hands-on validation of the issues that matter. We confirm impact, drop the noise, and follow access only inside the written scope.

What this is not

A raw scanner export. If a finding would not change a decision, it does not lead the report.

In a typical scope

External perimeter and internet-facing services
Internal networks when you provide access
Remote access paths that are part of the scope
Identity and trust relationships when they are in bounds

What you receive

An executive summary a non-specialist can read
Findings with severity, impact, and evidence
Remediation guidance an engineer can assign
A debrief, then one retest of the items you fix

Boundaries

Denial-of-service testing is out of scope unless a statement of work says otherwise
Social engineering and physical intrusion are separate engagements
We do not test systems you cannot authorize

What we need from you

Written authorization and a named point of contact
Asset lists, ranges, and explicit exclusions
A testing window and emergency contact
Credentials or access methods, if authenticated testing is in scope

02 · Security testing

AI Chatbot & Company AI Systems

Testing for chatbots, internal assistants, and retrieval systems that can see company data or take actions. The scope is the deployment, not a generic model.

Request a Scope

Companies are connecting assistants to tickets, files, and internal tools. Sunshield tests whether that system can be talked into revealing data it should hold, calling tools it should refuse, or treating untrusted content as instructions. We scope the model, the data it can reach, and the actions it can take.

The system, not the slogan

We test the assistant you deployed: its instructions, its data sources, its tools, and the accounts allowed to use it.

Data and actions

The questions are practical. Can a user reach another team’s data? Can untrusted content steer the assistant? Can a tool be invoked outside its intended use?

Evidence for the owners

Findings name the condition, the impact, and the change that closes it, written for the people who operate the system.

In a typical scope

Customer-facing and internal chatbots
Assistants connected to documents, tickets, or knowledge bases
Tool and plugin use, including actions the assistant can trigger
Access control between users, roles, and data sources

What you receive

A scope that names the system, data, and actions under test
Findings with evidence and business impact
Fixes ranked by what an attacker could actually reach
A debrief with the team that owns the assistant

Boundaries

We do not train or fine-tune models
We do not publish prompts, payloads, or exploit detail in the marketing site or in a public report
Production testing stays inside the hours and rate limits in the scope

What we need from you

A test environment, or written approval for production with limits
Roles that represent real users, including a low-privilege account
A description of connected data and tools
A contact who can explain intended behavior when we are unsure