On 15 October 2026 OSFI endorsed the Financial Stability Board's Sound Practices for Responsible Adoption of Artificial Intelligence and listed six of its own guidelines that apply to AI, among them B-10 on third parties, B-13 on technology and cyber risk and E-23 on model risk. Guideline E-23 takes effect for all federally regulated financial institutions (FRFIs) on 1 May 2027. The Autorité des marchés financiers' Guideline for the Use of Artificial Intelligence takes effect the same day for the Quebec insurers, financial services cooperatives, trust companies and deposit institutions it authorizes, under decision 2026-PDG-0016 of 30 March 2026.
Both texts reach past the institution to its suppliers. OSFI and FCAC's industry questionnaires found about 30% of financial institutions using AI in 2019 and about 50% in 2023, with 70% expecting to be using it by 2026, and "Most financial institutions rely on third-party providers for AI models and systems" (OSFI-FCAC Risk Report, 24 September 2024). This brief is for security and model risk leads at mid-size banks, trust and loan companies and insurers, at Quebec insurers and caisses, and above all at the AI and fintech vendors whose chatbots, copilots and scoring models those institutions buy.
Quick answer. Neither guideline requires a penetration test, and neither uses the words. E-23 Principle 3.5 expects "performance of risk assessments for related risks prior to deployment such as cybersecurity risk, infrastructure vulnerabilities, and other potential operational risks (see OSFI Guidelines B-13 and E-21)", and the AMF expects AI validation to include "assessing AIS cybersecurity". For an LLM application, the evidence that answers both is a pre-deployment penetration test of the application, its APIs, retrieval and tools, plus a review of third-party components and a retest on each version change; B-13 section 3.1.2 is where OSFI names penetration testing. Stingrai, a CREST-accredited penetration testing firm in Toronto, runs that testing human-led against the OWASP Top 10 for LLM Applications, the OWASP Agentic Top 10 and MITRE ATLAS, as a one-time test before go-live or a continuous program that retests each change.
Quotations come from OSFI's and the AMF's own published texts. The AMF publishes its guideline in French and English; quotations here use the English text, checked against the French version in the AMF Bulletin. This is not legal advice.
What E-23 says about cybersecurity and vendor models
E-23 is principles-based and organized around three outcomes: model risk understood across the enterprise, managed on a risk basis, and governed across the whole model lifecycle. Its definition of a model covers "statistical techniques, including AI/ML methods", so an LLM feature is a model, and it gets full lifecycle governance when the institution rates its risk as non-negligible. The words "penetration", "adversarial" and "red team" do not appear in it. Five provisions touch security testing:
Principle 3.5, deployment. Models "should be deployed in an environment with quality and change control processes", which OSFI calls "particularly important for AI/ML models that may depend on multiple components, diverse and dynamic data sources, and third-party elements." The list of what deployment involves includes "tests demonstrating that the model operates as expected in the production environment" and "performance of risk assessments for related risks prior to deployment such as cybersecurity risk, infrastructure vulnerabilities, and other potential operational risks (see OSFI Guidelines B-13 and E-21)."
Principles 1.2 and 2.1, vendor models in scope. The model risk framework "covers models or data sourced from external sources like foreign offices or third-party vendors (pursuant to our Guideline B-10 Third-Party Risk Management Guideline)", and institutions identify models "including vendor and third-party models."
Principle 2.2, risk rating. Quantitative factors include "potential operational, security or financial impacts"; "Externally developed models should be assessed for model risk ratings on a standalone basis"; and ratings are revisited on "a material change in the model's use, data, or infrastructure."
Principle 3.4, model review. Review is an independent assessment of "conceptual soundness and performance", done by "internal reviewers or objective third parties", and it may include "reviewing third-party models and platforms or sub-components (including data and libraries) used for model development." Review is prompted by "model modifications (including changes to algorithms, parameters, or supporting operational components)."
Principle 3.6, monitoring. Institutions track "external dependencies (for example, version updates)" and define "criteria for material model modifications, including changes in operational factors."
A penetration test is not a model review. Principle 3.4 asks whether a model is conceptually sound and performs as intended; that is model risk work for the institution's reviewers. A security test answers the cybersecurity line in Principle 3.5 and the third-party sub-component line in Principle 3.4, and it gives the reviewer a dated record to cite.
What the AMF AI guideline says
The AMF published its draft for consultation on 3 July 2025. Decision 2026-PDG-0016, signed by president and chief executive Yves Ouellet on 30 March 2026, established the final Guideline for the Use of Artificial Intelligence and appeared in the AMF Bulletin of 2 April 2026. Its expectations "supplement those set out in the Model Risk Management Guideline", the AMF's June 2025 model risk text, and apply "to any use of AISs by the institution". Neither the English nor the French version contains the word "test" or "intrusion". The security language sits in section 7.1:
Procurement: "the institution should consider AISs that are designed to express explainability and cybersecurity targets", and footnote 15 sends institutions to the AMF's Guideline on Information and Communications Technology Risk Management for cybersecurity (its testing expectations are covered in our credit union and caisse guide).
Validation: "the validation process should include various assessments, such as" "assessing output explainability", "assessing AIS cybersecurity", "analyzing the timeliness of the methods, tools and procedures associated with the AIS" and "reviewing any AIS components sourced from a third party (platforms, models, data, etc.)"
Validation triggers: these should control risks including "risks associated with cybersecurity", "risks associated with dynamic adjustment" and "risk of hallucination".
Deployment: "assessing the relevant risks prior to deployment, such as cybersecurity risk and infrastructure vulnerabilities".
Three other passages matter to a security tester. Section 8.3 expects institutions to tell clients when they are talking to an AI system, "including written communication through a chatbot". Annex 1 describes a trustworthy system as one where "Access to it is secure". Annex 2 lists "Upstream and/or downstream isolation of the AIS to support confidentiality and cybersecurity" among the information to keep on each system. The AMF's model risk guideline adds, in its deployment section, that institutions "should also test the functionality and robustness of the production environment and the associated infrastructure."
Figure 1: What five texts say about security testing for an AI system, read 23 October 2026. Sources: OSFI guidance library and the AMF Bulletin.
Who the two guidelines cover, and who they do not
Point | OSFI E-23 | AMF AI guideline |
|---|---|---|
Applies to | "all federally regulated financial institutions, including foreign bank branches and foreign insurance company branches" | "authorized insurers, financial services cooperatives, authorized trust companies and other authorized deposit institutions" |
Excluded | Pension plans, per OSFI's backgrounder | Institutions outside those four categories |
Proportionality | "on a risk-basis, proportional to the institution's" size, strategy, risk profile, complexity and interconnectedness | Proportionality principle, with lifecycle expectations "adjusted to reflect the risk rating associated with each AIS" |
Generative AI | Low-risk uses such as summarization are rated by the institution: "institutions are empowered to make risk-intelligent decisions" (release letter) | Applies "to any use of AISs", including client chatbots |
Effective | 1 May 2027, after an 18-month transition | 1 May 2027 |
Neither text applies to a vendor directly. The vendor meets both through its customer's model review, due diligence and contract. Neither reaches a provincially regulated credit union outside Quebec, which answers to its provincial regulator. A group with federally and provincially regulated entities may answer to both texts, so confirm with counsel which applies to each entity.
E-23 vs B-13 vs B-10 for an AI system
Three OSFI guidelines meet at one AI system, and each governs a different object. B-13 governs the application's cyber testing, E-23 the model's lifecycle and B-10 the relationship with the vendor that supplies it.
Guideline | What it governs for an AI system | Testing language | In force |
|---|---|---|---|
B-13, Technology and Cyber Risk | The application, its infrastructure and the institution's testing program | Names "penetration testing and red teaming" (3.1.2); "application business logic attacks" (3.2.3); scanning "prior to release into the production environment" (3.2.9) | 1 January 2024 |
E-23, Model Risk Management | Inventory, risk rating, review, deployment and monitoring of the model | No test named; pre-deployment risk assessment of "cybersecurity risk, infrastructure vulnerabilities" (3.5) | 1 May 2027 |
B-10, Third-Party Risk Management | The contract and oversight of the vendor | No test named; "the right to conduct or commission an independent audit" (Principle 8); third parties comply with FRFI standards or recognized industry standards (4.2) | 1 May 2024 |
Section 3.1.2 of B-13 says FRFIs "should set defined triggers, and minimum frequencies, for intelligence-led threat assessments" and "should also regularly perform tests and exercises, to identify vulnerabilities or control gaps in its cyber security programs (e.g., penetration testing and red teaming) using an intelligence-led approach". B-13 sets no frequency for penetration testing. So one test report on a vendor chatbot can serve three files: the institution's B-13 testing program, the E-23 deployment record and the B-10 due diligence file. How often to test, and whether OSFI expects a penetration test at all, is covered in our OSFI B-13 penetration testing guide.
The FSB text OSFI endorsed is the only one of these texts that describes AI security testing directly. Its final report says the practices "do not constitute a binding international standard", but Sound Practice 11 says institutions manage AI-related cyber and ICT risks "including, where appropriate, by incorporating AI cyber and ICT risk scenarios into tests and exercises", and section 3.8 says red teaming "can test not just the performance of GenAI but also the vulnerability of AI models or systems against adversarial attacks such as prompt injection and model inversion and the effectiveness of associated controls." For agents "with higher autonomy or posing higher risk, financial institutions apply adversarial testing, such as ethical red teaming."
The clause-to-evidence matrix
Each row maps a provision to a test an institution or vendor can buy and the deliverable that goes in the file. OWASP references are to the Top 10 for LLM Applications 2025.
Figure 2: Clause-to-evidence matrix for an LLM application under E-23 and the AMF AI guideline. Sources: OSFI E-23 and the AMF guideline; the test mapping is Stingrai's.
Clause | What it asks | Test that produces the evidence | Deliverable for the file |
|---|---|---|---|
E-23 3.5; AMF deployment | Risk assessment of "cybersecurity risk" and "infrastructure vulnerabilities" before deployment | LLM application and API penetration test of the release going live: authentication, sessions, role and tenant authorization, IDOR, improper output handling (LLM05), plus model endpoints, gateways, vector stores and IAM | Dated report naming the model version, system prompt version, tools and data sources tested |
AMF validation; E-23 2.2 | "assessing AIS cybersecurity"; "security" impacts in the risk rating | Direct and indirect prompt injection and data exfiltration through retrieval, documents and tools; system prompt leakage (LLM01, LLM02, LLM07, LLM08) | Findings with reproducible prompts, severity and remediation |
E-23 1.2, 2.1, 2.2; B-10 4.2 | Vendor models in scope and rated "on a standalone basis" | Authorization testing of the application wrapped around the vendor model as deployed: what the model and its tools can reach for each user role (LLM06, OWASP Agentic) | Role and tool permission matrix with tested results |
E-23 3.4; AMF validation | "third-party models and platforms or sub-components"; "AIS components sourced from a third party" | Model supply-chain and serving review: model and adapter sources, plugins, dependencies, secrets, serving configuration (LLM03) | Component inventory with findings, mapped to MITRE ATLAS |
AMF Annex 2 | "isolation of the AIS to support confidentiality and cybersecurity" | Egress and isolation testing: can the system reach internal services or send data out through tools, connectors or fetched URLs | Results per trust boundary |
FSB Practice 11; B-13 3.1.2 | "AI cyber and ICT risk scenarios" in tests and exercises, where appropriate | AI scenarios in red team exercises; adversarial testing of higher-autonomy agents | Red team report with the AI scenarios run |
E-23 3.4 and 3.6; AMF triggers | "version updates"; "model modifications"; validation triggers | Retest after a model version change, new tool, new data source or system prompt change | Retest letter tied to the version deployed |
The retest row carries the most weight for vendors, because OSFI's release letter says "We have not incorporated a grace period for third-party model risk management in the final guideline", while allowing "an exceptions policy under which models can be used for limited and specific applications prior to the completion of validation." Our AI retest-trigger matrix sets out which changes should force a new test.
What AI and fintech vendors will be asked for
E-23 leaves the burden of vendor evidence on the institution, which passes it to the vendor. OSFI's release letter is direct: "It is up to each institution to ensure adequate documentation is provided by vendors to satisfy model risk management needs," "Institutions should have controls to assess whether the vendor solution is producing an appropriate response," and "A third-party model review should include inputs into the model, including feeder models." B-10 already gives institutions the levers: due diligence on the "Strength of the third party's information security programs" (Annex 1), "independent reports provided by third parties" (2.3.3.3) and audit rights (Principle 8). The FSB adds that institutions "obtain appropriate, risk-based assurance and information from third-party AI providers" and that contracts address "material changes affecting AI behaviour."
Our recommendation is to have these six items ready before the questionnaire arrives:
A penetration test report on the version the institution will deploy, covering the application, APIs, model layer, retrieval and tools, with a summary or attestation letter that can be shared under NDA.
Retest results showing each High and Critical finding closed.
A component list: the foundation model and version, hosting platform, adapters, embedding model, vector store and plugins, which maps to E-23's "model dependencies" and the AMF's "components sourced from a third party".
An architecture and data-flow view showing how the system is isolated upstream and downstream.
A change-notification commitment naming the changes (model version, tools, data sources, system prompt) that trigger notice and a retest.
Incident notification terms that let the institution meet its reporting duties under OSFI's Technology and Cyber Security Incident Reporting Advisory, which B-10 asks contracts to support.
Fintechs selling to Canadian banks will recognize most of this from B-10 reviews; our Canadian fintech ranking covers the payments and RPAA side of the same buyer.
How to scope an LLM application test
Scope the four layers where an AI feature can be attacked: the application and its APIs, the model and its system prompt, the tools and MCP connections the model can call, and the data it retrieves and remembers. Add the infrastructure around it: inference endpoints, model gateways, vector databases and hosted platforms such as AWS Bedrock, Azure OpenAI and Google Vertex AI.
Three scoping decisions carry the most risk:
Test the configuration going live. E-23 Principle 3.5 lists "tests demonstrating that the model operates as expected in the production environment", so test the same model version, system prompt, tools and data connectors that will ship, and record them in the report.
Cover every role and every tool permission. Authorization flaws around the model, such as one customer reaching another's conversation history or a low-privilege user invoking a payment tool, need a tester working through each role. Our guides to RAG vector store access control testing and red teaming AI agents that can move money go deeper.
Handle customer data in the rules of engagement. Agree whether production data is in scope and how prompts and outputs containing it are stored.
The AI and LLM penetration test scope of work template turns these decisions into a document you can send vendors.
A plan to 1 May 2027
Figure 3: Dates for the texts in this brief, January 2024 to May 2027. Sources: OSFI, the AMF Bulletin and the FSB.
The plan below is our recommendation, not a regulator's schedule.
When | Institution | AI vendor | Basis |
|---|---|---|---|
November 2026 | Inventory AI systems and vendor models; assign provisional risk ratings | List every model and third-party component in the product | E-23 2.1 and 2.2; AMF 6.1 and 6.2 |
December 2026 to January 2027 | Scope security testing for the highest-rated systems | Commission a test of the version you will ship | E-23 3.5; AMF 7.1 |
February to March 2027 | Test, remediate and retest | Test, remediate and retest | B-13 3.1.2 |
April 2027 | File results with model review and approval records; add change-notice and audit terms to contracts | Deliver the evidence pack | B-10 Principle 8; FSB Practice 12 |
1 May 2027 | E-23 and the AMF guideline take effect | Expect E-23 and AMF questions in renewals | E-23; AMF decision 2026-PDG-0016 |
After go-live | Retest on triggers and at the testing frequency the institution sets under its B-13 program | Retest on each version change | E-23 3.6; AMF triggers |
The AMF lets an institution "assign, on a conservative basis, a provisional risk rating to AISs that do not already have one", which is the practical way to start before every review is finished.
What it costs
Neither regulator publishes a cost or a rate. Stingrai's fixed prices cover one web application and associated APIs: the Autonomous Pentest by Snipe, with no penetration testers, at US$3,000 per assessment (about C$4,206) or US$650 a month (about C$911) on a 12-month plan, and the Hybrid Pentest at US$6,800 (about C$9,534) or US$1,275 a month (about C$1,788), at the Bank of Canada rate of 1.4021 on 22 October 2026 (pricing). AI and LLM testing of the model, prompts, retrieval and tools is human-led and quoted through Get a Quote. The number of tools and agents, retrieval sources, user roles and environments moves that quote most; our breakdown of AI and LLM pentest cost drivers explains each one.
What to ask a testing vendor
Will the test cover the application, model, tool and data layers, and name the model version, system prompt version and tools tested?
Will each finding map to the E-23 principle or AMF clause it evidences, and to the OWASP LLM Top 10 or MITRE ATLAS?
Who will test? Ask for the named testers and their certifications, and for firm accreditation such as CREST.
Is a retest included, and will the retest letter name the version it covers?
Can the report or a letter be shared with a bank or insurer customer under NDA?
Can the same firm retest after each model or tool change, as a one-time engagement or a continuous program?
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified penetration testers, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For an institution or an AI vendor working toward 1 May 2027, Stingrai's AI and LLM penetration testing produces the security evidence in the matrix above:
Application and model layers: direct and indirect prompt injection, jailbreaks, system prompt leakage, insecure output handling and cross-user data access through retrieval, tested together with the web application and API wrapped around the model.
Tools and agents: tool misuse, excessive agency and privilege escalation through tool chains and MCP servers, with red teaming for AI scenarios in wider exercises.
Infrastructure and supply chain: authentication and authorization on model APIs, tenant isolation and IAM paths in Bedrock, Azure OpenAI and Vertex AI, and a supply-chain review of models, adapters, datasets and third-party plugins mapped to MITRE ATLAS.
Evidence: each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team. Findings are posted to the PTaaS platform as they are confirmed, retesting is included, and every human-led and hybrid report ships with an attestation letter.
Engagements run as a one-time test before go-live or as a continuous program that retests each model, prompt or tool change. Snipe, Stingrai's autonomous agent, covers web applications and their APIs only, so the model, prompt, retrieval and tool testing described here is human-led. Model review under E-23 Principle 3.4 is the work of the institution's model reviewers or another objective third party; Stingrai's testing feeds the cybersecurity and third-party component lines of that file. Stingrai Inc. is listed for penetration testing on the CREST Marketplace, is headquartered in Toronto with a London office, and serves US and Canadian clients.
Frequently Asked Questions
Does OSFI E-23 require penetration testing?
No. E-23 does not mention penetration testing, red teaming or adversarial testing. Principle 3.5 expects risk assessments of "cybersecurity risk, infrastructure vulnerabilities, and other potential operational risks" before a model is deployed and points to Guideline B-13, whose section 3.1.2 names penetration testing and red teaming. A penetration test of the LLM application gives that risk assessment direct evidence.
Does the AMF AI guideline require penetration testing?
No. Neither the English nor the French text uses the word "test". The guideline says validation should include "assessing AIS cybersecurity" and a review of third-party components, and that deployment should assess "cybersecurity risk and infrastructure vulnerabilities". A security test of the AI system is a practical way to evidence both.
When do OSFI E-23 and the AMF AI guideline take effect?
Both take effect on 1 May 2027. OSFI published the final E-23 on 11 September 2025 with an 18-month transition. The AMF established its guideline by decision 2026-PDG-0016 on 30 March 2026 and published it in its Bulletin on 2 April 2026.
Who does the AMF Guideline for the Use of Artificial Intelligence apply to?
Authorized insurers, financial services cooperatives, authorized trust companies and other authorized deposit institutions in Quebec. It applies to any use of AI systems by those institutions, supplements the AMF's Model Risk Management Guideline, and is applied in proportion to each institution and to each system's risk rating.
Are vendor AI models covered by E-23?
Yes. E-23 asks institutions to identify models "including vendor and third-party models", to rate externally developed models "on a standalone basis", and to review third-party models, platforms and sub-components. OSFI's release letter adds that institutions should "ensure that third-party models receive validation and monitoring commensurate to the model risk."
Is a chatbot built on a vendor foundation model a model under E-23?
Yes, by definition: E-23 defines a model to include "AI/ML methods". How much governance it gets depends on the risk rating, and OSFI told stakeholders that for low-risk generative AI uses such as summarization, "institutions are empowered to make risk-intelligent decisions" when rating models. The AMF guideline applies to any AI system and expects clients to be told when they are talking to a chatbot.
What is the difference between E-23, B-13 and B-10 for an AI system?
B-13 governs the application's technology and cyber risk and names penetration testing in section 3.1.2. E-23 governs the model's lifecycle, from inventory and risk rating to review, deployment and monitoring. B-10 governs the relationship with the vendor, including audit and information rights.
What security testing evidence should an AI vendor prepare for a Canadian bank or insurer?
A penetration test report on the version the institution will deploy, covering the application, APIs, model, retrieval and tools; retest results; a list of third-party components and versions; an architecture view showing isolation; and a commitment to notify and retest after model, tool or data changes.
Does OSFI expect red teaming of AI systems?
Not as a fixed rule. B-13 section 3.1.2 names red teaming among the tests FRFIs should run, and on 15 October 2026 OSFI endorsed the FSB's non-binding Sound Practices, which describe red teaming AI systems against prompt injection and model inversion and adversarial testing of higher-risk agents.
Related reading
References
OSFI. Guideline E-23: Model Risk Management (2027). 11 September 2025, effective 1 May 2027. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027. Source of every E-23 quotation.
OSFI. Guideline E-23: Model Risk Management (2027), Letter, with the summary of stakeholder comments, and Backgrounder. 11 September 2025. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027-letter and https://www.osfi-bsif.gc.ca/en/news/backgrounder-guideline-e-23-model-risk-management. Effective date, vendor model responses, pension plan exclusion.
Autorité des marchés financiers. Guideline for the Use of Artificial Intelligence. March 2026, effective 1 May 2027. AMF copy archived 15 May 2026: https://web.archive.org/web/20260515052218/https://lautorite.qc.ca/fileadmin/lautorite/reglementation/lignes-directrices-assurance/Guideline-Use-of-Artificial-Intelligence.pdf
Autorité des marchés financiers. Décision n° 2026-PDG-0016, Bulletin de l'Autorité, vol. 23, no. 13, section 5.2.2, 2 April 2026. AMF copy archived 10 April 2026: https://web.archive.org/web/20260410021800/https://lautorite.qc.ca/fileadmin/lautorite/bulletin/2026/vol23no13/vol23no13_5-2.pdf
Autorité des marchés financiers. Model Risk Management Guideline. June 2025. AMF copy archived 14 April 2026: https://web.archive.org/web/20260414012807/https://lautorite.qc.ca/fileadmin/lautorite/reglementation/lignes-directrices-assurance/ld-gestion-risque-modele-2025_an.pdf
OSFI. Guideline B-13: Technology and Cyber Risk Management. 31 July 2022, effective 1 January 2024. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-risk-management
OSFI. Guideline B-10: Third-Party Risk Management. Effective 1 May 2024. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline
OSFI. OSFI statement on the Financial Stability Board's publication of Sound Practices for Responsible Adoption of Artificial Intelligence. 15 October 2026. https://www.osfi-bsif.gc.ca/en/news/osfi-statement-financial-stability-boards-publication-sound-practices-responsible-adoption
Financial Stability Board. Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report. 15 October 2026. https://www.fsb.org/uploads/P151026-1.pdf. Sound Practices 9, 11 and 12 and sections 3.6, 3.8 and 3.9.
OSFI and FCAC. OSFI-FCAC Risk Report: AI Uses and Risks at Federally Regulated Financial Institutions. 24 September 2024. https://www.osfi-bsif.gc.ca/en/about-osfi/reports-publications/osfi-fcac-risk-report-ai-uses-risks-federally-regulated-financial-institutions. Voluntary questionnaire of December 2023.
OWASP Gen AI Security Project. OWASP Top 10 for LLM Applications 2025 and OWASP Top 10 for Agentic Applications for 2026. https://genai.owasp.org/llm-top-10/ and https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
MITRE. ATLAS. https://atlas.mitre.org/
Bank of Canada. Daily exchange rates, USD/CAD 1.4021 on 22 October 2026. https://www.bankofcanada.ca/rates/exchange/daily-exchange-rates/
Stingrai. Pricing. https://www.stingrai.io/pricing
Talk to Stingrai
Stingrai will test your LLM application, its APIs, retrieval and tools before 1 May 2027, with named penetration testers, retesting and an attestation letter your model reviewers or your bank customer can file, as a one-time test before go-live or a continuous program. Get a Quote or book a free discovery call.
