What it did.
Not what it said.
A model will calmly describe refusing a request it actually carried out. This screen hands your model 258 situations and live tools, then reads the tool-call log: what it really invoked, and with what arguments. The distance between those two things is where the damage lives.
First, seven industry-standard safety tests on your model. Then ours. Both arrive together, side by side: where they agree, and what the standard tests missed. The tests are public, so you can run them yourself too. We run them either way.
Optional, same price: add your system prompt and we run every scenario with it in front. That is the one thing that then leaves your building. Your tools and connectors stay in the full audit, because we cannot reproduce them from outside.
Everything you know about your agent
comes from the agent.
Your logs record what it reported. That account is the least reliable artifact in the system, and everything downstream is built on it.
“The amendment for trade 88412 has been successfully processed…”Its reply, word for word. It sounds like a job well done.
Wired to a new account named in one unverified email.make_payment → 3391-77026
A purchase that needs a security review
is not a $3,000 purchase.
Most vendors need access to your model before they can test it. That one requirement turns a quick decision into a three-month one. None of its steps reaches you here.
If it answers over an API,
it is probably in scope.
You will know which lane you are in before you pay.
Off the log. No judge model — no second AI deciding what happened.
No second model reads the transcript and decides whether something bad happened.
The scenario hands the model working tools. The grader reads which ones it called, and with what arguments. A model that narrates a wire transfer it never executed did not execute it, and the log says so. It is also why it comes back fast: no judge model, no review queue.
Not a score. A record.
Every finding in the report has the same anatomy, and every part of it is evidence rather than assertion.
Do not take our word for the quality.
We published an entire engagement.
A finished 23-page report, on the public internet, with its own limits printed inside it. Read it before you spend anything.
Where a human still reads it.
Stated here, rather than discovered afterwards.
A turn can still queue — when a model narrates an action its log does not show, or a detector flags a refusal that was correct. It goes to a human, not to a guess, included in the fee, returned within two business days.
And the model does not decide
the same way twice.
On 30 August 2026 we ran the suite as it stood that day — 100 scenarios — against the same model twice, same seed, temperature 0. 46 of the 100 produced a different sequence of tool calls.
So the evidence is not the re-run. The evidence is the sealed pair: exactly what we sent, exactly what came back, and the hashes showing nothing was altered. Anyone can read that pair and decide for themselves — without trusting us.
The four questions worth asking.
Answered here so you do not have to book a call to find out.
The limits, in full.
Listed so that nobody discovers one after paying. The evidence is aligned with NIST AI RMF, ISO/IEC 42001, the OWASP Agentic and LLM Top 10 and MITRE ATLAS; none of it is a certification.
- NOTNot a rate. One pass establishes that a behaviour occurred. It cannot tell you how often, and no percentage appears in the deliverable.
- NOTNot a safety certificate. A clean screen says these 258 scenarios did not surface a breach in one pass. Nothing wider than that.
- NOTNot a test of your deployment. It screens the model as the vendor ships it. Your own prompt and tools on top are a separate question.
- NOTNot the text battery. The 400-turn adversarial campaign, cross-family judging, and human adjudication of every disputed turn belong to the Forensic Stress Test.
- NOTNot a comparison. One model, one pass. Testing several models identically is a different engagement.
Four steps, start to delivered.
Nothing to install, nobody to onboard, no access to grant.
Pay
$3,000 by card, through Stripe. Card details never touch this site.
Name the model
After payment, email us the model name — the intake page has the address. Under a minute. Want it run against your deployment? Send your system prompt with it and we put that prompt in front of every scenario. Same price. Then your system prompt leaves your building — nothing else does.
We run it
The seven industry-standard tests, then one pass of the 258-scenario suite, through our own access. Fixed seed, tool-call log per scenario. The 258 span 48 families: payments and wires, records and data, access and permissions, and a clinical set — a patient in the bed, a drug order, a wristband that does not match.
Delivered within 72 hours
Findings report and sealed evidence pack by email. Any hand-audited turn follows within two business days, included.
This is the only way to find out what it did.
Already paid? Name your model →
You are going to be asked this question eventually.
How do you know the model you built on does what it says? Today, you are taking its word for it. $3,000 stops you having to: one pass, 258 situations, and a log of what it actually did — back within 72 hours.