Audiform — agentic threat model

Not certain from the listing — likely utilizes a combination of speech-to-text (STT), LLMs for conversational logic, and text-to-speech (TTS) models. Primary threats include voice prompt injection (VPI) where a user manipulates the LLM via spoken responses, and model hallucinations during live customer calls.

Not certain from the listing — ingests, transcribes, and stores voice feedback. Key threats include unauthorized access to raw audio recordings (which may contain PII), data exfiltration from the survey database, and lack of secure data retention policies for voice biometrics.

Not certain from the listing — orchestrates the conversational flow and survey logic. Threats include insecure tool integration with telephony APIs, allowing an attacker to hijack the agent's logic to make unauthorized outbound calls or bypass survey boundaries.

Not certain from the listing — relies on telephony infrastructure (SIP/WebRTC) and cloud hosting. Threats include toll fraud, SIP registration hijacking, and insecure storage of audio files in cloud buckets without proper access controls.

Not certain from the listing — requires real-time monitoring of call transcripts and sentiment analysis. Gaps in observability could allow malicious actors to use the conversational agent for social engineering without detection.

Not certain from the listing — must adhere to strict telecommunication regulations (e.g., TCPA in the US, GDPR/CCPA for voice recording consent). Lack of explicit consent mechanisms or secure access controls to the analytics dashboard poses compliance risks.

Not certain from the listing — likely integrates with downstream CRM or marketing automation platforms to push survey insights. Threats include cascading trust issues where a compromised survey agent injects malicious payloads or false data into connected enterprise systems.