Governance. Risk. Compliance. Cybersecurity.
MAST Consulting Group - Governance, Risk, Compliance and Cybersecurity Logo
Timeline

Timeline — AI Platform VAPT — LLM & ML Penetration Testing

A realistic week-by-week view of how AI Platform VAPT — LLM & ML Penetration Testing runs. Timelines compress for smaller scopes and extend for multi-entity or multi-site programmes; this baseline assumes a mid-size enterprise.

  • ISO/IEC 27001 Certified
  • ISO/IEC 27701 Certified
  • ISO 9001 Certified

Delivered by an ISO/IEC 27001, 27701 & 9001 certified organisation

Week-by-week plan

WeekPhaseKey activitiesOutput
Weeks 1–2Threat ModellingMap model inventory, data flows, agent tools and trust boundaries against OWASP LLM Top 10 and MITRE ATLAS tactics.Signed-off threat modelling pack and gate review
Weeks 3–4Adversarial TestingPrompt injection (direct and indirect), jailbreaks, system-prompt leakage, training-data extraction, model DoS, RAG corpus poisoning and tool/function-call abuse.Signed-off adversarial testing pack and gate review
Weeks 5–6Platform & PipelinePentest the surrounding stack — vector DBs, inference endpoints, fine-tuning pipelines, MLOps tooling, model registries and identity boundaries.Signed-off platform & pipeline pack and gate review
Weeks 7–8ReportingRisk-ranked report with PoCs, screen captures, repeatable payload library and CVSS-aligned scoring.Signed-off reporting pack and gate review
Weeks 9–12Re-testValidation of remediated findings and tuning of guardrails, evaluators and detection rules.Signed-off re-test pack and gate review
12-week delivery plan

Gantt-style timeline titled "12-week delivery plan" over 12 Weeks with 5 phases: Threat Modelling from Week 1 to 2; Adversarial Testing from Week 3 to 4; Platform & Pipeline from Week 5 to 6; Reporting from Week 7 to 8; Re-test from Week 9 to 12.

Threat Modelling
Signed-off threat modelling pack and gate review
Adversarial Testing
Signed-off adversarial testing pack and gate review
Platform & Pipeline
Signed-off platform & pipeline pack and gate review
Reporting
Signed-off reporting pack and gate review
Re-test
Signed-off re-test pack and gate review

What accelerates the timeline

  • Executive sponsor engaged from day one with weekly steering attendance.
  • Existing asset inventory, network diagrams and HR org chart available.
  • GRC tooling already deployed or selected (Vanta, Drata, Archer, ServiceNow).
  • Workforce available for awareness training within the engagement window.
Conditions that compress delivery

Checklist titled "Conditions that compress delivery" with 4 items, every item marked complete: Executive sponsor engaged from day one with weekly steering attendance.; Existing asset inventory, network diagrams and HR org chart available.; GRC tooling already deployed or selected (Vanta, Drata, Archer, ServiceNow).; Workforce available for awareness training within the engagement window..

  • Executive sponsor engaged from day one with weekly steering attendance.
  • Existing asset inventory, network diagrams and HR org chart available.
  • GRC tooling already deployed or selected (Vanta, Drata, Archer, ServiceNow).
  • Workforce available for awareness training within the engagement window.

What typically extends it

  • Multiple legal entities, brands or geographies in scope.
  • Significant cloud migration running in parallel.
  • Open audit findings or regulator enforcement requiring remediation first.
  • Mergers, divestitures or system replacements mid-engagement.
Next: Pricing & Engagement