Self-serve evaluation sandbox

Attack a real AI agent inside an isolated test organisation. Watch what your security stack catches, and what it lets through. No sales call.

See a recorded run
× Book a demo × Talk to sales × Request access ✓ 60 seconds to your own tenant
Step 01  ·  Identify

One field, then you are in.

We use your work email to name the tenant and send the evidence bundle afterwards. That is the whole reason we ask.

Discovery first. We will land you on the scan and you can attack afterwards if you want to.
Free mail domains get a shared read-only tenant. A work domain gets its own.
Synthetic organisations built by our test lab. No real customer data exists in any of them.

No card. No call. No calendar link. The tenant lives for 60 minutes and is destroyed with everything in it. Attacks run only against the synthetic organisation you pick above, never against anything you own.

4Attack categories
60Minute tenant
0Sales calls
Step 02  ·  Provision

Building your isolated tenant.

A real agent estate, a real detection platform in front of it, and a real attack engine pointed at both.

lens://provision/tenant
Discovery inventory
Northway Financial
Fixture
Assets  10 Sanctioned  6 Unsanctioned  4
What discovery is, and is not

Discovery records configuration observations, each with a stated source. It does not sniff your network and it does not test anything. Every one of the eleven properties per asset is required, and a property the source does not state is stored as unknown, never as a blank, a dash, or a flattering default. record_provenance on every row here is fixture: these assets came from a specification document, not from an observation of a running estate, and the product says so rather than implying otherwise.

The prioritisation conjunction — three legs, evaluated in the database and nowhere else
Leg 1untrusted_ingestion = trueThe asset consumes content it did not author.
Leg 2identity_privilege_write = trueIts identity can write. Read access is recorded but is never an input here.
Leg 3egress_path <> noneThere is a path out.
2
Meets
All three legs hold on stated values. This is the returned set, and the reason to look here first.
5
Cannot be evaluated
Unknown on at least one leg. Not a pass. Nobody has recorded enough to say either way.
3
Fails on stated value
A leg is stated false. Decisive, and correctly unremarkable.

None of the three states is coloured. Green means prevention on our surfaces and red means proven attack success, and a conjunction state is neither. Meets is a reason to look first, not a finding. Fails on stated value is one leg stated false, not a clean bill of health.

The set is unordered, and that is deliberate

ordering_state = declined  ·  rank_position = null on every row, at every set size. Every member of the returned set satisfies the same three legs, the conjunction is the only permitted discriminator, and it is uniform within the set by construction. So no member is first, highest or top ranked. A caller looking for a rank finds a null and this reason, not an arbitrary element.

Asset inventory

Unsanctioned first. Click an asset to read its recorded properties and see which legs decided its state.

Rogue Finance Copilot

Unsanctioned · unregistered

Where this asset came from

NORTHWAY-FINANCIAL-fixture-spec.md v1.0, section 5.1

Recon target
The platform  AIDR LAYER ONLY
Detect only
Category  IProfile  L1 Lenient
Methodology section 4.2 — AI reconnaissance

Recon characterises the detection surface, not your estate. It sends a graded ladder of five stimuli through the platform's inspection API and records where the active policy first reacts. It makes no model call and no database access, so it is cheap, deterministic and side-effect free. The result is frozen to disk and pinned, so the attack that follows is reproducible against a known surface. ATLAS: AML.T0056, AML.T0051.000, AML.T0043.

Detection-surface ladder

Five rungs, overtness rising with intensity. Deliberately less potent than the live payloads: the goal is to locate the detector threshold, not to maximise attack success.

No model call. No database access.

Resolved surface

What the resolver consumes. Pure function of these four fields.

lowest_flagging_intensity
detectors_observed
flagged_rungs
surface
strict_threshold
2  named parameter, not a buried constant

Null dimensions

Recon states what it could not measure, and why. These are declared, not silently omitted.

Target
Ledger Support Bot  @ NORTHWAY FINANCIAL
Synthetic
Protected by  the platformMode  Detect only

Choose an attack category

Same engine, same payloads we run in a paid engagement. Nothing is watered down for the sandbox.

Three stages, run in sequence.

Attack chain

Each stage is inspected on the way in and on the way out. Both results are shown.

No evidence yet
Run an attack chain under 02 Attack console to populate this view.
Step 05  ·  Take it with you

Your evidence bundle

Everything this tenant produced, signed and timestamped. Yours whether or not you buy anything.

Run this against your own estate

Same engine. Your agents instead of ours.

You have now seen the product do the thing it claims to do, against an estate you did not have to expose. The only thing a call would add is a price, so here it is.

Estate assessment
from $14K one-off
Lens subscription
from $52K / year

Four questions. You get an indicative number on screen, not a callback.

That is the whole funnel.

Link, email, sandbox, evidence, price. The buyer proves the product to themselves and never speaks to anyone until they want to.

Step 06  ·  Scope

Four questions, then a number.

This is what a sales call would have asked you. It takes about thirty seconds and you get an indicative band immediately, on this page, before anyone contacts you.

Include the ones you suspect but cannot name.
Production, staging, per business unit.
EU AI Act, DORA, NIS2, HIPAA, PCI.
Continuous re-runs new attack patterns as we publish them.
Indicative range for an estate like yours
$14K to $22K
One full Discover, Attack, Remediate cycle. Fee credited against your first subscription year if you continue.

Indicative, not a quote. It is built from the same four inputs we would use on a call, so it should land close. A formal quote needs a look at your actual estate, which is the next step and the first point at which a human is involved at all.

Step 07  ·  The only human step

Now we talk, if you want to.

You have run the product, seen the evidence, and got a number. This is the first point where a person is genuinely useful, because a formal quote needs someone to look at your real estate.

Default is written. A call happens only if you pick one.

What we will not do. No drip sequence, no retargeting, no third party gets your address. If you never reply we send one follow-up and then stop.

Prototype Scripted data · not a live run