Views:

AI Scanner is an automated security testing tool that finds vulnerabilities in your AI applications before attackers do. It runs controlled prompt attacks against your AI models, including prompt injection, jailbreak, and data extraction techniques, and reports identified vulnerabilities, with the full chat transcript as evidence.

Attack coverage is aligned with recognized industry standards, including the Open Worldwide Application Security Project (OWASP) Top 10 for Large Language Model Applications and the MITRE Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS). You can also score your AI application's readiness against the OWASP AI Security Verification Standard (AISVS). For more information, refer to Framework scans.

What is AI Scanner

AI Scanner is packaged as a feature of the TrendAI™ Artifact Scanner (formerly TMAS) CLI. You run scans from a system of your choice, such as a laptop, CI runner, or server, against your own AI applications, and review the results in TrendAI Vision One™ or in local report files.
At the heart of every scan is the judge (an LLM-as-a-Judge), a large language model (LLM) that reads each attack response and decides whether the attack achieved its objective, so you do not have to review thousands of conversations manually. By default, a TrendAI™-hosted judge in your TrendAI Vision One™ region handles this work. You can also configure a custom judge.
Attacks are read-only. The built-in (Managed) attack content is information-gathering only. It never modifies or deletes data, and never triggers destructive actions against the target. For Custom and Agentic scans, you author the prompts, so you control exactly what is sent. Only scan applications you own or are authorized to test.

How an AI scan works

Every AI scan follows the same loop:
  1. Define the target. Point AI Scanner at the AI application under test: an OpenAI-compatible model endpoint, an Amazon Bedrock, Azure OpenAI, or Google Vertex AI deployment, or any AI application with an HTTP API.
  2. Select what to attack with. Select built-in attack objectives or a curated attack preset such as OWASP, supply your own pre-written prompts, or let an attacker model probe the target adaptively.
  3. Run the attack. AI Scanner sends the attack prompts from your machine to the target, at a concurrency you control.
  4. Evaluate every response. The judge scores each response against the attack's objective to determine whether the attack succeeded.
  5. Review the results. Results upload to TrendAI Vision One™, and can also be written to local comprehensive report files.

Scan types

AI Scanner offers three scan types, and a single scan can combine them. When it does, they run in the order Managed, then Custom, then Agentic. You can author any of the three scan types in the interactive wizard. Writing YAML by hand is optional.
Scan type
What it sends
When to use it
Managed
Attack prompts generated from a built-in catalog, shaped by the techniques and modifiers you select.
A fast, low-cost, reproducible baseline against built-in attack objectives.
Custom
Prompts that you author in advance, sent to the target exactly as written.
Testing specific payloads: known jailbreaks, regression cases, or attacks from previous engagements.
Agentic
Attack prompts generated and refined by an attacker model that observes each response and adapts across multiple attempts.
Well-guarded targets that refuse one-shot prompts. Requires a 64-bit system.
For a comparison of features by scan type, refer to Feature availability by scan type. To author Custom and Agentic scans, refer to Custom prompts and Agentic attacks.

Feature availability by scan type

Capability
Managed
Custom
Agentic
Attack prompts from the built-in catalog
Yes
-
-
Attack presets (OWASP, MITRE, AISVS)
Yes
-
-
Techniques and modifiers applied to prompts
Yes
- (prompts are sent verbatim)
- (the attacker model chooses its own approach)
LLM-as-a-Judge evaluation
Yes
Yes
Yes
Regex evaluator (pattern matching, no LLM)
-
Yes
Yes
Attacker model required
-
-
Yes
Automatic sensitive-data (PII) detection in responses
Yes (with the Sensitive Data Disclosure objective)
- (use the regex evaluator)
- (use the regex evaluator)
PII redaction in stored and uploaded results
Yes
Yes
Yes
In this table, detection identifies sensitive information in responses and reports it as a finding. Redaction removes or masks sensitive information in stored results and replaces it with labeled placeholders.

Deployment options

You can run AI Scanner in two deployment modes:
  • TrendAI™-hosted (default): The scan executes from your machine through the TrendAI™ Artifact Scanner CLI, and a TrendAI™-hosted judge in your TrendAI Vision One™ region evaluates the responses. You can also configure a custom judge. For more information, refer to Configure TrendAI™-hosted AI scan settings.
  • Self-hosted: For data sovereignty requirements, deploy the AI scan service, including the judge, in your own Amazon Web Services (AWS) environment with a CloudFormation template. TrendAI Vision One™ receives only the scan results, and even that upload can be disabled. For more information, refer to Configure self-hosted AI scan settings.

Data handling and privacy

  • The scan itself runs on your machine. Attack prompts are sent directly from the TrendAI™ Artifact Scanner CLI to your target application.
  • The judge receives and scores complete conversations including prompts and responses. With the TrendAI™-hosted judge, conversations are processed in your TrendAI Vision One™ region. With a custom judge, you control where evaluation happens.
  • You control whether chat transcripts are included with the results. Each destination, such as TrendAI Vision One™ upload and local reports, can include or exclude them with the chat_history setting, in the wizard under Advanced Settings → Output destinations or in the configuration file. By default, transcripts follow the judge’s configuration: included with the TrendAI™-hosted judge, excluded with a custom judge.
  • By default, PII redaction replaces detected personal data, such as phone numbers, email addresses, and credit card numbers, with labeled placeholders before scan results are stored or uploaded.
  • Credentials are read from environment variables and are never written to configuration files or saved wizard drafts.

Get started

Comments (0)