AI-Powered VAPT for SaaS Products: A Practical Guide

In September 2025, researchers at Noma Security showed how a $5 domain could turn a Salesforce AI agent against its own customer. 

The attack hid instructions in a lead form's description field, which accepts up to 42,000 characters. When a legitimate user later asked Agentforce to process the lead, the agent followed the hidden instructions and sent CRM data to a domain that Salesforce's content security policy still trusted but whose registration had lapsed. Noma scored the flaw 9.4 (critical). Salesforce patched it. A few months earlier, Aim Security had found a zero-click flaw in Microsoft 365 Copilot, CVE-2025-32711, which Microsoft also fixed. The pattern is plain: SaaS products with AI features have attack paths that classic testing never covered, sitting on top of the old ones. This guide explains how SaaS AI VAPT should adapt to the way your product is actually deployed.

 

 

What SaaS AI VAPT Covers?

We use the phrase to mean two things, and a good engagement addresses both.

* Testing a SaaS product that has AI in it. 

Vulnerability assessment and penetration testing (VAPT) of the web application, APIs, cloud setup, and identity, plus the LLM layer, retrieval systems, and agent integrations that now sit beside them.

 

* Using AI to test faster. 

AI-assisted tooling can widen coverage and speed up routine work. We return to its limits later.

 

The OWASP Top 10 for LLM Applications (2025) gives the AI-specific vocabulary: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. For the API layer, the OWASP API Security Top 10 (2023) still leads with broken object level authorization. A SaaS test needs both lists.

 

 

Pattern One: Multi-Tenant SaaS

*The core risk is one customer reaching another's data. OWASP defines broken object level authorization (BOLA) as attackers changing object IDs in requests to access other users' objects, and it sits first on the API list for good reason. Test it with at least two tenants and several roles, across every endpoint that takes an identifier, and include broken property-level and function-level authorization, such as ordinary users calling administrative functions.

 

* What AI adds: if an assistant retrieves documents to answer questions, check that retrieval respects tenant boundaries. A shared vector store without strict filtering is the multi-tenant bug in new clothing, and the OWASP list names vector and embedding weaknesses for this reason. Ask the assistant questions designed to surface another tenant's content.

 

 

Pattern Two: API-First SaaS

* Your API is the product, so it is the main target. Test authentication, object and function authorization, rate limiting, and the inventory itself: undocumented or forgotten endpoints appear on the OWASP list as improper inventory management. Unsafe consumption of third-party APIs is another entry.

 

* What AI adds: model-backed endpoints cost money per call. Test for unbounded consumption: can one user run up compute or token costs, or exhaust capacity for others?

 

 

Pattern Three: Embedded Assistant Over Customer Data

This is the pattern behind both incidents above. An assistant that reads customer content can be steered by it. Test for:

* Direct and indirect prompt injection. Hide instructions in every ingestion channel: support tickets, emails, uploaded files, form fields, shared documents. EchoLeak worked by an attacker emailing the target, with no click needed, and Copilot acting on the email when the user later asked a related question.

 

* Output-based exfiltration. ForcedLeak relied on the agent embedding data in an image tag pointing to an attacker's domain. Test what the interface will render, which domains it allows, and whether any allowlist entries are stale.

 

* Sensitive information and system prompt leakage. Try to extract other users' data, internal instructions, and credentials embedded in prompts.

 

* Guardrail evasion. Aim Security reported that EchoLeak avoided prompt-injection classifiers by phrasing the email as if written to the recipient, with no mention of AI. Filters are controls to test, not guarantees.

 

 

Pattern Four: Agents, Tools, and Integrations

* When the assistant can act, the stakes change from disclosure to action. Test what each tool call can do, which credentials it holds, and whether a human must approve irreversible steps. OWASP's Top 10 for Agentic Applications, released in December 2025, covers goal hijack, tool misuse, and identity and privilege abuse.

 

* SaaS integrations deserve special attention. Group-IB's 2026 report describes a single stolen OAuth token in the Drift, Salesloft, and Salesforce incident, which it lists as affecting 700 organisations. Review OAuth scopes, token lifetimes, and what a compromised integration could reach.

 

 

Pattern Five: Single-Tenant and Customer-Hosted Deployments

* Dedicated or customer-VPC instances shift the risk to consistency. Test for configuration drift between instances, shared secrets reused across customers, and the deployment pipeline that creates them. Check support and administrative access paths, since one over-privileged operator account can reach every customer.

 

 

Where AI Helps the Tester, and Where It Does Not

AI-assisted testing is real. 

XBOW, an autonomous AI-powered penetration testing tool, became the first non-human bug hunter to reach the top of HackerOne's US leaderboard, with 285 vulnerabilities reported. Notably, its team used deterministic, non-LLM code to validate findings because they found language models weak at validation. They also acknowledged remaining false positives, mainly for business logic flaws, and cautioned that AI pen testers are "not panacea."

 

That matches our view. AI tooling is useful for breadth: enumeration, fuzzing, and repetitive checks. The hardest SaaS findings, such as tenant isolation failures, authorization logic, and chains that combine small weaknesses, still depend on a human who understands how your product is supposed to work.

 

 

Planning the Engagement

* Provide at least two test tenants and accounts across each role, so isolation can be tested properly.

* Share an inventory of AI features: models used, data sources, tools, and integrations.

* Document data flows, including what is sent to third-party model providers.

* Agree rules of engagement, especially for prompt-injection and agent tests that touch real systems.

* Retest after fixes and major releases. AI features change quickly, and a new connector can reopen a closed path.

 

 

Where ILLUME Intelligence Can Help

ILLUME Intelligence's AI Penetration Testing (AI VAPT) and LLM Security Testing services cover the model, retrieval, and agent layers, while our Penetration Testing covers the application, API, and cloud foundations beneath them. Our Secure AI Development service helps your engineering teams build these checks into the release cycle. A scoped review of one product and its AI features is a practical first step.

 

 

The Bottom Line

SaaS AI VAPT is classic testing plus a new layer, shaped by how your product is deployed. Multi-tenant products need isolation tested hardest, assistants over customer data need injection tested across every input, and agents need their permissions and integrations tested. Use AI to speed the routine work, and keep humans on the logic that makes your product yours.

---

Comments

---

No Comments Found.