Views:

AI Scanner is a security testing feature of the TrendAI™ Artifact Scanner (formerly TMAS) command-line interface (CLI). It runs controlled prompt attacks against your AI applications to find vulnerabilities, including risks mapped to the Open Worldwide Application Security Project (OWASP) Top 10 for Large Language Model Applications and the MITRE Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS), before an attacker does.

How AI Scanner is packaged

You do not install AI Scanner on its own. The AI scan engine ships inside the TrendAI™ Artifact Scanner CLI. To scan AI applications you download and run TrendAI™ Artifact Scanner on the system of your choice, such as a laptop, CI runner, or server. Scanning AI applications is one of several jobs TrendAI™ Artifact Scanner can do. It does not require the other TrendAI™ Artifact Scanner scanning features.
For an introduction to AI Scanner, how an AI scan works, and the scan types it offers, refer to AI Scanner.

Before you start

  • A TrendAI Vision One™ account and application programming interface (API) key. AI Scanner requires a TrendAI Vision One™ API key with a role that includes the AI Scanner permissions. When you create the API key, select a role with all AI Scanner permissions, or ask your administrator to create one for you.
  • The TrendAI™ Artifact Scanner CLI. Download and install TrendAI™ Artifact Scanner CLI for your platform. In the "Manually install TrendAI™ Artifact Scanner" section, select the download package for your system.
  • A target to scan. An AI application you can reach over HTTP, such as an OpenAI-compatible model endpoint, an Amazon Bedrock, Azure OpenAI, or Google Vertex AI deployment, or any custom AI application with an HTTP API.

Run your first scan

  1. Store your TrendAI Vision One™ API key in the TMAS_API_KEY environment variable.
  2. Start the interactive wizard with ./tmas aiscan llm -i.
  3. Follow the wizard to configure the target, the attacks, and the output destinations, and start the scan.
For the full walkthrough, including region selection, running from a configuration file, and keeping your first scan fast and cheap, refer to Configure TrendAI™-hosted AI scan settings.

What you get

Scan results upload to AI Scanner in TrendAI Vision One™, where you can filter by target, scan, and attack objective, review the full chat transcript of every attack, and export reports, such as CSV, JSON, CycloneDX, HTML, or an executive report. You can also write reports to local files during the scan, including JSON, HTML, Markdown, and summary formats.
Comments (0)