One agent
A chat, document retrieval, or an agent that calls tools and business systems. A second agent is a second assessment.
Test the agentyou already run.
OBSERV assesses one named agent: a chat, a retrieval application, or an agent that can call tools. We write the boundaries with you before the first case.
We start from the application you name. The list is its agents, its tools, and its data sources, inside the signed scope.
You confirm who uses it and what each role may see. A case runs only after that permission matrix exists.
The scope.
The named application, the tools it can call, and the places it reads from.
The matrix.
One row for each action, naming who may trigger it and which record it may touch.
The record.
Each case keeps its evidence, and a person on our team reviews it before the report. You get one retest of the findings you fix, inside 90 days.
The tool callis the result.
OBSERV
The model’s reply is in the evidence. The result is whether the tool, the API, or the server that holds the data allowed the call. Each finding carries an id from the 2025 OWASP Top 10 for LLM applications.
Before the test
The scope names the people, the actions, and where the check runs.
People.
The users, the roles, and the data each role may see.
Actions.
What the agent may do, and which actions need a person to approve them. A write, a send, a payment, or a change of access is tried only on the test record you name.
The log.
Where the refusal is enforced. The log needs the user’s text, what was retrieved, and the tool call.
This fee does not include a poisoned training set, theft of the model, a test of the vector store on its own, or a flood of calls meant to run up the bill. Those are a separate scope.
A reviewed report
Evidence, an OWASP id from the 2025 LLM list, and where it stopped, then a debrief with your engineers. We do not deliver exploit code.
One retest
The findings you fix, inside 90 days of the report. It checks those fixes.
Name the application, who uses it, and what it is allowed to do. Testing starts within 10 business days of a signed scope, and the report follows within 5 business days of testing. The fixed price is on OBSERV.