A red-team of your own policy, scoped with you.
The Checkpoint Report covers one checkpoint in supported scope. An assessment goes further: a person red-teams your own policy in simulation, with a threat model chosen for your stack, your adapter and simulator integrated, each finding narrated, and one retest after you remediate.
Your policy, your stack, more than one checkpoint
What the assessment adds
- A human red-teamer operating on your own policy, not a public proxy checkpoint: threat model chosen for your stack, the run executed and reviewed with you
- Stack-specific integration of the adapter and simulator, and the keep-out predicate tuned to your declared safety envelope where the run supports it (stated as tuned, never as validated calibration)
- Narrated attack chains + a filable evidence pack (SARIF, OSCAL, ML-BOM) under a written acceptance protocol
A narrated attack chain is a finding with a reproducible proof-of-concept and its per-trial trace. The open-source tool emits SARIF, OSCAL and a CycloneDX ML-BOM too.
Included in every paid engagement
- The report and its SARIF: the measured attack-success rate with 95% confidence intervals, the benign and clean-task-success controls, and the release decision under your acceptance protocol
- The signed attestation: a local Ed25519 signature over the whole pack — origin and integrity you verify offline, with no insurer or assessor acceptance attached
- The technical-file annex: the test report in the ISO/IEC 17025 clause-7.8 shape (not accredited, no statement of conformity) and the compliance crosswalk. Evidence, not certification.
- One retest after you remediate, so the evidence reflects the fixed policy, not the one you started with
- The refund clause: a checkpoint outside the supported scope is refunded in full; a null or negative finding under the agreed protocol is a delivery, not a refund
The test report leaves the authorising blanks for your signatory. The compliance crosswalk maps the evidence to EU AI Act Art. 15, the EU Machinery Regulation, ISO 10218:2025, NIST AI RMF and IEC 62443.
What it costs
The list price is $25,000. Lower rates apply first, in this order; a rate with a set number of places shows how many are open.
- Founding design-partner rate: $5,000. 3 of 3 places open · in exchange for a published case note; the terms
- Early rate: $9,500. 3 of 3 places open · the 3 places after the founding cohort; confidential, no publication asked
- Standard rate: $15,000. once the 6 counted places are gone, until the list price applies
- List price: $25,000. the price every rate above is read against
Places are counted by hand and were confirmed on 20 September 2026. A scoped starting range, not a fixed quote. Confidential under the engagement agreement.
- Not ready to scope a call? The Checkpoint Report is a fixed $1,950 for one eligible checkpoint, and its fee is credited in full against a later assessment.
- For a policy that keeps shipping, the Assurance subscription re-runs the red-team each quarter, for $30,000 a year.
How an engagement runs
A typical engagement is scoped at roughly two to three weeks once scope, access and the agreed prerequisites are complete. The applicable attacks for your adapter and simulator are written into the acceptance protocol, and an unsupported adapter is integration work quoted separately.
By default it runs in your environment or against an endpoint you host, and any transfer of a checkpoint is agreed in writing first (the data paths). Every engagement runs under a written rules-of-engagement / authorization-to-test letter: Provael is an offensive-security tool for systems you own or are permitted to assess. Methodology is published and mapped to MITRE ATLAS, OWASP, and NIST SP 800-115.
To try it first, run the quickstart: the tool is Apache-2.0 and runs on a CPU.
Provael is built and maintained by one person. That is a real dependency for anything you rely on. The tool is Apache-2.0 and can be forked, and every result can be reproduced from a committed recipe, so evidence you already hold stays valid if the project stops. One person cannot offer a service level, so none is published.
Need a security review first? The pre-answered questionnaire, sub-processor list, DPA and rules-of-engagement templates are at /trust, including the 11 answers that are "No".