Proof other people can check.

WitnessOps reviews AI agents and internet-facing systems, with written findings, supporting evidence and clear limits.

Before your agent takes an important action, understand the controls around it.

Agent Action Security Review

For engineering teams and AI implementation partners preparing to launch or hand over an agent.

Review the action’s trigger, executing identity, permissions, approvals and available execution evidence. Receive an action map, sourced findings, prioritised recommendations, documented unknowns and a readout.

€2,500 fixed · excluding VAT

One consequential action, such as issuing a refund, changing a record or granting access. Inspection and reconstruction only; we do not execute the action or change production.

Delivery timing per signed SOW

Request an agent review

Understand what your public-facing system exposes—and what to fix first.

External Attack Surface Review

For SaaS and technology teams preparing for a launch, infrastructure change or customer security review.

Review one authorised internet-facing system. Receive an exposure map, manually validated findings, practical remediation priorities and a 45-minute handover.

€1,900 fixed · excluding VAT

Low-impact, unauthenticated checks within the agreed scope. This is not a penetration test. One focused retest of reported findings is included within 30 calendar days of initial report handover.

Delivery timing per signed SOW

Request an external review

The free hostname check stays a separate tool, not a third review.

What you receive

Written findings with the evidence attached, for a scope agreed before work starts. A request that exceeds the bounded review is narrowed or declined. An enquiry does not authorise collection or start a review.

Evidence survives the dashboard.

Historical synthetic one-action example

Illustrative · shape onlyDesigned, not executed
Consequential action
refund.issue above a set amount, through a payments API — an illustrative action, not an executed one.One action per review. Chosen with you before evidence rules are agreed.
Executing identity
svc-agent-refunds@example.com — a reserved example of the identity an agent would run as, not the one that configured it.
Permission / authority boundary
The roles, scopes and approval steps that stand between an identity and an action, as configured.Read from configuration under agreed evidence rules. Not assumed; none inspected here.
Supporting evidence
Policy exports, the tool manifest, approval configuration and action logs for an agreed window — each attached to the claim it supports.Collected only after evidence handling is agreed. No evidence was collected for this illustration.
Finding
A written statement of what an identity is permitted to do relative to an action, and what happens when it does it — with the evidence beside each claim.Written after review. This specimen carries no finding.
Explicit unknowns
What the evidence did not establish — for instance whether an action was exercised in the agreed window, or whether a human step exists outside the systems inspected.Named in writing. These are example questions, not results.

Illustrative. Reserved documentation names. No customer, execution, verification, authorisation failure or result is shown. This is the shape of a record, not a record.

Clear boundaries

Useful evidence.
Explicit limits.

What the app can and cannot do.

The app can

  • Record one bounded check
  • Keep the snapshot
  • Compare saved checks
  • Read and export reports
  • Keep findings tied to their evidence

The app cannot

  • Monitor continuously
  • Certify a system
  • Replace a penetration test
  • Treat missing data as a finding
  • Make a universal verification claim

Ask an expert

One question.
Non-secret details only.

Tell us what needs to happen and by when. We will confirm whether the app, a named review, or neither is the right next step.

Discuss a review: engage@mail.witnessops.com

For product or access questions, visit support.

Do not send passwords, private keys, API keys, recovery codes, session tokens or customer evidence in an initial enquiry.

Next, confirm your email with a code. We’ll then review the fit and reply with the next step.

Security Verification & Evidence | WitnessOps