Sell AI evaluation and red-teaming to startups shipping LLM features
The practice bot in this mission answers every FAQ perfectly, and still refunds any order from one chat message and hands over another customer's email. Startups ship bots like that every week, then an enterprise customer's security questionnaire asks "how do you test your AI?". Sell the answer: a fixed-price report with accuracy, groundedness and prompt-injection testing, and the whole suite left running in their CI.
- The paperwork: authorisation letter, statement of work, outreach emails, discovery questions, onboarding questionnaire, proposal, a weekly routine and a first 30 days
- Python 3.10 or newer. You should be comfortable reading Python, running scripts, and reading JSON. If not, do Build your own "chat with my files" app first: it's the kind of system you'll be testing
- A basic idea of how LLM apps are built: system prompts, retrieval (RAG), tool calling. Give your local AI tools covers tools and guard rails
- Optional: Node.js 22.22 or newer, if you want to run the promptfoo version of the suite
- The kit: download it all as a zip, or read the kit overview and grab just the demo
- About 3 to 4 hours for the mission, then around 10 hours a week of practice, research and outreach
Spot the gap, learn the one rule, and plan your start
Know exactly what you're selling, why startups buy it now, what you're up against, and the legal line you never cross.
A startup adds an AI assistant to its product. It reads customer data, answers questions from the help centre, maybe calls a tool or two. It demos beautifully. Then three things happen. Users find it makes things up. A bigger customer's security team sends a questionnaire asking how the AI is tested. And someone on the team realises nobody knows what happens when a user, or a document the assistant reads, tells it to ignore its instructions.
The offer, in one line"A fixed-price LLM evaluation and red-team report: I build a test set from your real use cases, measure accuracy and groundedness, test prompt injection and data leaks against the OWASP Top 10 for LLM Applications, and hand the whole suite over running in your CI."
Why now, stated accuratelyDon't overstate any of this to a client. Most of it is voluntary, and most startup chatbots aren't "high-risk" under EU law. It still adds up to buyers asking for evidence:
- The OWASP Top 10 for LLM Applications 2025 is the common language for LLM security risks, from LLM01 Prompt Injection to LLM10 Unbounded Consumption ↗. Security teams recognise it. You structure your testing around it.
- EU AI Act. Since 2 August 2026, providers of AI systems that interact directly with people must make sure people are told they're dealing with an AI, unless it's obvious (Article 50 ↗). The heavier obligations, including resilience against "adversarial examples" in Article 15, apply to high-risk systems only, and the 2026 amending regulation pushed those dates to 2 December 2027 for most of them (Goodwin's summary ↗). A support chatbot usually isn't high-risk. Say so.
- UK. The government's voluntary Code of Practice for the Cyber Security of AI ↗ has a principle on testing and evaluation, and provision 9.2.1 says developers and operators should use independent security testers for security testing. That sentence is your pitch.
- ISO/IEC 42001:2023 is a certifiable AI management system standard (ISO ↗), and the US NIST AI Risk Management Framework ↗ is voluntary guidance with a generative AI profile. Startups chasing enterprise deals use both. Your report is evidence they can use, not a certificate.
What you're up againstSpecialist AI security firms and platforms, and traditional pen test companies adding AI testing. One AI red-teaming vendor says services firms publish minimums around $16,000 ↗ and that almost nobody publishes a price list. Seed-stage startups often can't spend that. A clear, fixed-price, smaller scope with the suite left behind in their CI is a real gap below them.
CarefulTHE RULE: only test systems you own, or systems you have signed, written permission to test. No exceptions for "just one prompt" on a prospect's live chatbot to make your email more impressive. In the UK, causing a computer to perform a function to get access you know is unauthorised is an offence under section 1 of the Computer Misuse Act 1990 ↗, and adversarial prompts and scanners like garak are exactly that kind of activity. Using a product the way a normal customer would is fine. Attacking it isn't. The kit's authorisation letter gets signed before any test, and you practise on the demo bot, your own models and labs built to be attacked.Tip- What it takes. Skills: Python, how LLM apps fail, and enough security sense to explain a root cause to an engineer. Budget a month or two of practice on the demo and your own systems before your first paid job.
- Time: around 10 hours a week. Plan for your first paying client to take one to three months of steady outreach; founders are busy, so volume and follow-up matter. Cold email averages a 4.1% reply rate ↗ (Hunter, 11 million emails sent in 2024), which is why the weekly routine in step 6 is built around personalised messages.
- Care: your tests touch real systems and your report is evidence people rely on, so the authorisation letter and careful write-ups are part of the job.
- Who this suits: you enjoy reading other people's code and docs and like finding out how things break. Keep your day job while you land the first few clients. Nothing in this mission costs money upfront.