August 26, 2026
0 mins readImagine getting three separate security reports back for your new enterprise AI assistant:
Your web vulnerability scanner reports zero open doors.
Your model evaluation framework runs jailbreak prompts and reports a passing safety score.
Your static code analyzer flags a command-execution function in a backend utility, but ranks it as low severity because no direct HTTP route touches it.
On paper, the application looks ready for production, but in reality, a threat actor bypasses your guardrails in minutes. How? By using the AI model as an intermediary. The attacker steers the LLM to invoke the internal utility tool, thereby bridging an untrusted prompt directly to the backend execution sink.
Each security tool reported the truth within its narrow field of view, yet the system remained exploitable end to end. This is the reality of chained risk in modern AI architectures.
Chained risk breaks the isolated-vulnerability model
Traditional AppSec was built on a simple premise: find a flaw in a component, patch it, and assign a severity score based on its isolated metadata, but AI applications break this model entirely. In an environment built on prompt templates, vector retrieval (RAG), dynamic tool calls, and Model Context Protocol (MCP) endpoints, security risks rarely live inside a single isolated module. Danger emerges instead along the seams between layers:
Known-taxonomy chains: Conventional defects, such as an unvalidated API parameter or SSRF, sequenced together through AI interactions to escalate privileges.
Cross-layer behavioral emergence: Complex interactions where no component malfunctions, no CVE exists, and every system performs as designed, yet the sequence produces material business harm — data exfiltration, unauthorized transactions, or destructive actions taken with a user's authority.
To defend against chained risk, security leaders must stop treating vendor tools as interchangeable commodity purchases and organize their strategy around three distinct testing lenses.
The three lenses of adversarial AI testing and why just one isn’t enough
To evaluate an AI application stack effectively, a security program must ask three fundamentally different operational questions through three lenses:
DAST — What is exposed?
AI penetration test — What is exploitable, and how often?
AI red team — What can an adversary accomplish?
Lens 1: DAST, mapping the surface
Dynamic Application Security Testing maps the exposed endpoints of a running system in a way that is broad, fast, inexpensive, and deterministic. The job of a DAST tool is to tell you where your attack surface begins. The blind spot, however, is that DAST does not understand semantic trust, meaning it cannot predict how a probabilistic model will interpret or act on payload data downstream.
Lens 2: AI penetration testing, validating exploitation
AI pentesting takes exposed targets and applies targeted behavioral techniques to prove exploitability. Because AI outputs are probabilistic, Lens 2 runs repeated trial sweeps (N) to establish statistical confidence, proving that a guardrail bypass succeeds 30% of the time rather than as an isolated fluke. AI pentesting focuses on component-level boundaries, meaning it tells you whether a single tool call can be manipulated. The blind spot is that AI pentesting does not trace how that exploit moves through a multi-step business process.
Lens 3: AI Red Teaming, demonstrating business impact
AI Red Teaming takes an objective-driven, adversarial stance. AI red teaming does not run a checklist of prompt injections. It sets an objective — exfiltrate a customer database or initiate an unauthorized funds transfer — and chains primitives across the application, model, tool, and data layers to achieve it. Red teaming's limitation, however, is cost. It is resource-intensive and slow, so using it to find basic misconfigurations or missing authorization checks spends specialist budget on work that automation already handles.
The three lenses differ across structural security program design properties
Dimension | Lens 1: DAST | Lens 2: AI pentest | Lens 3: AI red team |
|---|---|---|---|
Question answered | What is exposed? | What is exploitable, and how often? | What can an adversary accomplish? |
Nature | Deterministic, known-class | Proof-of-exploit | Goal-directed, behavioral |
Scope | Application layer (plus inventory targets) | Component, technique, and seam | Objective and end-to-end path |
Chained risk target | Maps individual links in Known-Taxonomy Chains | Proves Conventional Defect Chains; Tests Cross-Layer Seams | Tests Cross-Layer AI Behavioral Chains end-to-end |
Evidence produced | Trigger confirmation | Deterministic reproduction / Probabilistic success rate | Narrative path to a business objective |
Context dependency | Low: Operates black-box by design | High: Efficiency improves with every context ladder rung | Moderate: Benefits from architecture & prior scan data |
Primary owner | AppSec or Platform Engineering | AppSec or External Specialist | CISO |
The three lenses compared across the dimensions that matter for program design.
The solution: orchestration over isolation
Running these three lenses as disconnected vendor engagements, on separate schedules, producing isolated PDF reports, creates the exact visibility gaps that attackers exploit.
True security assurance requires a unified testing harness:
DAST maps the surface and feeds valid endpoints into the pentest.
AI pentesting validates component boundaries and converts confirmed exploits into automated regression checks.
AI red teaming focuses its budget on novel cross-layer attack chains, handing newly discovered primitives back down to the automated suite.
When the three engines share a common architecture, every assessment makes the next one faster, cheaper, and more accurate.
Want the full operational and economic blueprint?
This framework is only the starting point. Building a continuous, audit-ready AI testing program means mastering the underlying economics, routing policies, and context architectures.
Excited to learn more? The companion whitepaper, Chained Risk: The Operating Model and Economics of Adversarial Testing, covers:
The four AI layers and six shared foundations – The architectural blueprint for unifying DAST, AI pentesting, and red teaming under a single harness.
The context ladder – How sharing architecture diagrams and prompt schemas cuts decision-grade call volume from 15,500 to roughly 2,000 calls per assessment.
The six cost levers – Practical math for balancing trial depth, API token burn, and human specialist time.
A deterministic routing policy table – Executive-ready rules for scheduling assessments against code commits, agency shifts, and risk tiers.
WHITEPAPER
Chained Risk: The Operating Model and Economics of Adversarial Testing
Three lenses, one harness. What it takes to build, operate, and scale an assessment program that proves what an attacker can actually reach.