KSSZEIBEL DIGITAL

Security testing

Application & AI Security Testing

Security testing examines how an application handles access, data and unexpected behaviour. I am developing this specialisation around web applications, APIs and AI-powered systems, where weaknesses can affect users and the organisations operating them.

01

Web Application Security

Application testing looks at how users sign in, what they can access and how the software handles unexpected input. Particular attention is paid to weaknesses that could expose data or allow actions outside intended permissions.

  • Authentication and session management
  • Access control and authorisation
  • Input validation
  • Common web application vulnerabilities
  • Sensitive data exposure
  • Security misconfigurations

02

API Security

APIs can expose functions and data that are not visible in a normal interface. Testing examines whether requests are authenticated, permissions are applied correctly and each user can reach only the intended information and actions.

  • API authentication
  • Endpoint and object-level authorisation
  • Excessive data exposure
  • Input handling
  • Security configuration
  • Common API security weaknesses

03

AI Application Security

AI-powered applications introduce behaviour that conventional software testing may not cover. The focus is on how instructions, retrieved information and connected tools can influence what a system reveals or does.

  • Prompt injection and instruction manipulation
  • Sensitive information disclosure
  • AI chatbot security
  • Retrieval-augmented generation risks
  • Tool permissions and agent actions
  • Application-level safeguards

04

Findings & Remediation

Useful findings need more than a list of issues. A properly scoped assessment should explain what was observed, why it matters and what can be changed to reduce the risk.

  • Clear descriptions of identified issues
  • Supporting technical evidence
  • Context around potential impact
  • Prioritised remediation recommendations
  • Discussion of practical fixes
  • Verification of agreed remediation work

Assessment process

Defined scope before any testing.

For suitable future work, I would use a documented process that keeps the target, boundaries and expected output clear from the start.

Testing only takes place with explicit written permission from the system owner and within agreed boundaries.

  1. 01

    Establish the application scope

  2. 02

    Confirm authorisation and testing boundaries

  3. 03

    Review the relevant security controls

  4. 04

    Document and assess any findings

  5. 05

    Explain practical remediation steps

  6. 06

    Verify agreed fixes where appropriate

Security testing enquiries

A specialist area in development.

I am developing this area of Szeibel Digital through practical application, API and AI security training. Independent specialist assessments are not yet an established service. I am open to discussing suitable projects, supervised testing opportunities and collaboration with development teams.

Discuss a security requirement