Mindgard

The red teamer attacks the customer's AI endpoints, chatbots and agents, with presets for OpenAI, Anthropic, Azure and Hugging Face targets and listed support for Docker and AWS, and it runs from CI/CD workflow integrations, the CLI and the Burp Suite extension. Targets are reached with the customer's own API keys, request templates and response selectors. Tests cover the prompts, memory, data sources, guardrails, MCP or A2A servers and permissions around an agent, not only the model.

SourceMindgard, mindgard.ai, /automated-ai-red-teaming and docs.mindgard.ai/user-guide/testing-via-cli; docs.mindgard.airead 2026-10-06

The red teamer follows a fixed adversary workflow of reconnaissance, exploitation planning and execution, chaining one shot and multi step attacks, and its adaptive attack agents learn from each response and change tactics. The platform runs its four stages, Discover, Recon, Attack and Defend, again as systems change. Customers choose the targets, the attacks and the goal of a multi turn test, but they cannot build a flow of their own.

SourceMindgard, mindgard.ai, /automated-ai-red-teaming and docs.mindgard.ai/user-guide/testing-via-cliread 2026-10-06

Reconnaissance profiles the customer's AI systems, covering models, agents, tools, guardrails and system prompts, into a map of the estate, with recon types for guardrails, system prompt extraction, tool discovery, input and output encoding, output formatting and output rendering. Attacks draw on Mindgard's attack library and its own research, which has publicly identified more than 150 AI vulnerabilities, building on a decade of AI security research that began at Lancaster University. Recon results are kept per project, but there is no store the customer fills with its own documents.

SourceMindgard, mindgard.ai and docs.mindgard.ai/llms.txtread 2026-10-06

Findings go to the customer's team with remediation guidance, and the team decides what to fix. Runtime protection identifies and responds to attacks in real time, and no step has a person approve a response before it happens. Testers choose which attacks run, can run a subset of the library, and set the technique and goal of each multi turn test.

SourceMindgard, mindgard.ai, docs.mindgard.ai/llms.txt and /user-guide/testing-via-cliread 2026-10-06

Mindgard holds AICPA SOC 2 Type 2 certification. SAML single sign on can be enabled on request, so a team signs in through its own identity provider, such as Microsoft Entra, Okta or Google Workspace. Projects are shared by role, with an owner who created the project, admins who add, change or remove members, and members who view results and run tests. There is no audit log of activity on the platform. The framework mapping Mindgard offers applies to the customer's findings, not to Mindgard itself.

SourceMindgard, docs.mindgard.ai/user-guide/enterprise-setup, /user-guide/sharing-projects and mindgard.airead 2026-10-06

Each finding comes with clear evidence, attacker context and remediation guidance mapped to OWASP, MITRE ATLAS, the NIST AI RMF and the EU AI Act. Test results group flagged events by threat category and show every interaction in a test with its input, its output and Mindgard's observations, each event flagged or cleared, and the attack list downloads as CSV. The MITRE ATLAS Adviser rolls up risk across every test in the organization. There is no trace of the steps or tool calls inside the customer's agents.

SourceMindgard, mindgard.ai/automated-ai-red-teaming, docs.mindgard.ai/user-guide/test-results and /user-guide/reportingread 2026-10-06

Within a run, the adaptive attack agents learn from the target's responses and change tactics, and each project keeps its tests, findings and recon results. The agents keep no memory from one run to the next.

SourceMindgard, mindgard.ai/automated-ai-red-teaming and docs.mindgard.ai/llms.txt; mindgard.airead 2026-10-06

Every customer is assigned to a Mindgard instance, and instances run in several parts of the world to meet data residency requirements, though the regions are not named. The CLI and the Burp Suite extension run in the customer's environment and proxy every model interaction, while Mindgard's SaaS application plans the attacks, judges them and stores the results. Testing runs from CI/CD, the CLI, Burp Suite or a single click against the customer's endpoints. HTTPS proxies are supported and SOCKS proxies are not. There is no self hosted or customer cloud option.

SourceMindgard, docs.mindgard.ai/user-guide/enterprise-setup and /user-guide/system-architectureread 2026-10-06

A prebuilt attack library ships with the platform, "an ever growing list of LLM/ML attack techniques", with named jailbreaks such as Crescendo, ActorAttack, AsciiArtAttack and DevModeV2, prompt injection encodings such as Ascii85 and ANSI escapes, and violation tests such as PromptAlignment and MaliciousGeneration.

AI safety datasets come ready to use, customers can generate or bring their own datasets and run a subset of attacks, and a remediation library covers sixteen defenses, from guardrails and output filtering to differential privacy. Mindgard sells no prebuilt agents for a customer to adopt.

SourceMindgard, docs.mindgard.ai/llms.txt; docs.mindgard.airead 2026-10-06

Red teaming runs continuously as AI systems change and on pipeline runs through CI/CD workflow integrations, and runtime protection responds to attacks in production as they happen. Tests can also start from the web app, the CLI, the Python SDK, the Burp Suite extension or a single click.

SourceMindgard, mindgard.ai/automated-ai-red-teaming and docs.mindgard.ai/llms.txtread 2026-10-06

Any target model can be tested, with ready presets for OpenAI, Anthropic, Azure and Hugging Face, but Mindgard offers no model choice or routing for its own operation. It does not name the models behind its own attack planning.

SourceMindgard, mindgard.ai and docs.mindgard.ai/user-guide/testing-via-cliread 2026-10-06

Developers get a Python SDK, a CLI reference and an API reference covering projects, tests, findings, datasets, multi turn tests and reconnaissance, and Mindgard publishes an OpenAPI specification. The CLI installs from PyPI and runs reconnaissance, single turn and multi turn tests against a target set inline or in a config file, and a Burp Suite extension brings the same tests into a penetration tester's tools. The API can create findings as well as list them.

SourceMindgard, docs.mindgard.ai/llms.txt and /user-guide/testing-via-cli; docs.mindgard.airead 2026-10-06

Mindgard runs continuous automated red teaming of the customer's AI agents and systems, before deployment and in production, including multi step attacks across agents, tools, APIs and data sources. Each run returns findings, evidence and remediation, and multi turn tests run from the CLI and the API with a technique and goal the tester sets.

Policies let the customer write the guidelines its application must follow, checked by regex refusal and policy violation observations that add flags or filter out irrelevant ones. The weaknesses it looks for include prompt injection, jailbreaks, system prompt leakage, model extraction, unsafe tool use, excessive agency and data or memory poisoning.

SourceMindgard, mindgard.ai/automated-ai-red-teaming, docs.mindgard.ai/user-guide/policies/overview and /user-guide/testing-via-cliread 2026-10-06

Testing runs against inference and API endpoints, and a guide covers testing chatbot applications. Its agents do not control a browser or computer.

SourceMindgard, mindgard.ai and docs.mindgard.ai/llms.txtread 2026-10-06