Frequently Asked Questions

Secuvon is an AI agent security testing platform. It runs adversarial tests against your AI agents, chatbots and copilots to find vulnerabilities before attackers do: prompt injection, data leakage, permission escalation, multi-agent threats, multi-turn attacks and more, from a corpus of 4,075 test cases across 66 security modules. In this release you can use Scanner, Guardian, Red Teaming, Compliance, Discovery, Scheduling & Drift, Scan Comparison, Teams & RBAC and Alerts.

Any organisation deploying AI agents in production: SaaS companies with AI-powered features, enterprises using internal copilots, AI startups building agent-based products, security teams that want evidence before a release, and regulated industries that need to show how their AI systems hold up under attack.

Any AI agent reachable through an API endpoint. Hosted targets cover 5 providers (OpenAI, Anthropic, Google Gemini, xAI and DeepSeek), and the full platform also tests custom endpoints that speak HTTP.

You save your provider key (encrypted at rest with authenticated encryption using Fernet: AES-128-CBC + HMAC-SHA256) and the agent that uses it, then start an assessment. Choose a versioned profile, from Smoke 25 through the full 4,075-test corpus, within your contract capacity. Each test sends a specific attack, such as prompt injection, data exfiltration, a jailbreak or permission escalation, and grades the answer with the published rule for that test. The report shows the security score and grade, the findings by severity, the response evidence and remediation guidance. A test that errored is reported apart and never counted as a pass or a fail.

Unlike single-prompt tests, multi-message attacks build live conversation state from the target's actual replies before sending the final attack. Secuvon currently includes 82 corpus cases with a real conversation chain. Generic prompt-only endpoints report these cases as unsupported instead of pretending they ran.

Evals (evaluations) test whether your AI agent gives correct, helpful, on-topic answers. They measure quality and accuracy. Secuvon tests whether your agent can be made to fail by an attacker: its adversarial tests simulate attacks such as prompt injection, jailbreaking, data exfiltration and privilege escalation to find security vulnerabilities before bad actors do.

Evals and security testing answer different questions. An agent can score well on quality evals and still be vulnerable to a prompt injection that leaks customer data. Evals answer 'Does my agent work correctly?' Secuvon answers 'Can my agent be exploited?'

The corpus maps its cases to the OWASP LLM Top 10 and the OWASP Top 10 for Agentic Applications (ASI01 to ASI10), and the framework catalogue also references MITRE ATLAS techniques. Every test targets a known, documented vulnerability class. Your reports show which OWASP categories and MITRE techniques the failed tests relate to.

Secuvon displays executed security-test evidence alongside selected references from 11 frameworks, including the EU AI Act, OWASP Agentic Top 10, OWASP LLM Top 10, MITRE ATLAS, GDPR, SOC 2, ISO 42001, NIST AI RMF, HIPAA, PCI DSS, and the CSA AI Controls Matrix. Coverage depends on the tests executed and whether a control applies. A scan does not assess every obligation or certify compliance.

No. Secuvon runs security tests and reports their evidence and coverage. It does not issue certifications, determine legal compliance, or replace an independent assessment of which obligations apply to your system.

The European Commission's current timeline places Annex III high-risk rules at 2 December 2027 and product-embedded Annex I rules at 2 August 2028. Check the official timeline and the law for your system. Secuvon can provide results and provenance from executed security tests for a qualified reviewer. Its article mappings are under review; scan results are not an article-by-article readiness finding, legal advice, or a compliance determination.

The OWASP Top 10 for Agentic Applications (2026) covers Agent Goal Hijack (ASI01), Tool Misuse and Exploitation (ASI02), Identity and Privilege Abuse (ASI03), Agentic Supply Chain Vulnerabilities (ASI04), Unexpected Code Execution (ASI05), Memory and Context Poisoning (ASI06), Insecure Inter-Agent Communication (ASI07), Cascading Failures (ASI08), Human-Agent Trust Exploitation (ASI09), and Rogue Agents (ASI10). Secuvon's corpus maps cases to all 10 identifiers.

MITRE ATLAS (Adversarial Threat Landscape for AI Systems) is a knowledge base of adversarial techniques against ML and AI systems, similar to MITRE ATT&CK for cybersecurity. Secuvon's framework catalogue references ATLAS techniques beside the tests that probe them.

The current hosted deployment uses Railway in United States (Railway region sfo). PostgreSQL stores application records and Redis supports background jobs. Saved provider credentials and selected evidence fields receive application-level encryption; this does not cover every stored scan field. Contact us for the processing location, retention and backup arrangements that apply to your workspace.

Guardian is Secuvon's runtime protection. While scans test your agent before deployment, Guardian inspects the messages it sends and receives in production for personal data, prompt injection patterns and your own rules, and blocks, redacts, alerts on or logs what breaks them.

Personal data in responses, such as email addresses, phone numbers and payment card or IBAN numbers; prompt injection patterns such as instruction overrides, role-play framing, prompt extraction and encoding tricks; requests over your rate limit; and the topics and patterns you block yourself.

Yes. You can add blocked topics, custom pattern rules and a request rate limit, and choose whether each rule blocks, redacts, alerts or logs.

Discovery probes the HTTP endpoints you list, identifies which ones are AI agents and the provider behind each one, and keeps them in one inventory you can re-check on demand. It does not sweep IP ranges.

Teams often deploy AI agents without the security team knowing. You cannot secure an endpoint you do not know exists, so an inventory of the AI endpoints your teams run is the first step to testing them.

Yes. A schedule runs an assessment of an agent on the cadence you set, from hourly to monthly or a cron expression, and the trend view tracks the security score across runs.

Slack, Microsoft Teams, email and webhooks you control. Webhook payloads are HMAC-signed so you can verify they came from Secuvon.

Yes. Any tool that accepts an HTTPS webhook can receive Secuvon's signed event payloads.

Yes. The current self-serve ladder includes a €0 Free tier with three quick scans a month and finite agent and concurrency limits. No card is needed to start; Free does not include unlimited use.

The provisional self-serve prices are Pro at €149/month and Team at €499/month; Enterprise is Custom and requires a quote. Every tier has finite scan, concurrency and agent limits. The current MVP uses your own provider key (BYOK). Managed inference and Private Runner are outside this release. Card checkout opens only when Stripe is configured.

You can ask to change tiers. Once card billing is configured, Pro and Team subscriptions can be managed through the Stripe billing portal. Until then, contact us about a change. Custom arrangements require an agreed order form.

Pro and Team are currently listed at monthly prices. Annual and Custom terms are quoted separately and take effect only through an agreed order form; there is no published annual discount.

Pro and Team card checkout uses Stripe when the payment account and prices are configured. Until checkout is open, contact us about a paid plan. Custom payment and invoice terms are agreed in an order form.

Every scored scan has a report with the security score and grade, the findings by severity, each test's result with the response evidence, and remediation guidance. Errored and skipped tests are reported apart and never counted as passes or fails; a scan with no gradeable answer is Not scored. Reports export as PDF, HTML, JSON, SARIF and CSV. Framework coverage appears beside the findings.

SARIF (Static Analysis Results Interchange Format) is a standard format for security tool output. A report downloads as a SARIF 2.1.0 file that GitHub code scanning and other tools can read. A Not scored scan writes no SARIF file, because an empty one would read as a clean scan.

Yes. Drift compares graded scans of the same agent over time, and scan comparison shows which findings changed between two runs. Schedules re-run an assessment on the cadence you set.

Yes. Reports can be exported in PDF, HTML, JSON, SARIF and CSV formats. This build uses Secuvon branding; custom logos and white-label login or report branding are not currently available.

Yes. Invite people to your workspace in Settings, then Team and roles, and give each one a built-in or custom role.

A workspace owner or admin invites a teammate by email; the invitation can be revoked until it is accepted.

Yes. Tell us about the agent and what you need to show through the contact page, and we will help you choose a profile and read the results.

It is in progress. The secuvon command assesses a saved agent from a terminal or a pipeline and writes the result as a table, JSON, Markdown, HTML or SARIF, but it is not published yet, so there is nothing to install. Until it is, the API runs the same assessment, and the docs page has the steps. Once published, unattended jobs use a scoped, expiring API key. Provider errors and refused requests use a separate exit code instead of being reported as security findings.

Not yet: pipelines run the CLI, which is not published yet. Once it is, run it with an API key stored as a secret, upload the SARIF file to code scanning, and fail the job on the findings or score you choose. The docs page has a GitHub Actions example for then.

Once the CLI is published, any CI system that runs Python 3.10 or newer can run it, including GitHub Actions, GitLab CI and Jenkins.

Saved provider keys are encrypted before storage with Fernet and decrypted in server memory when needed for an assessment. The credential API does not return the key.

Secuvon stores assessment inputs, target responses and results to build reports and history. Contact us about access, deletion or retention requests; handling depends on applicable privacy rights and the customer agreement. Self-service custom retention settings are not available in this release.

Secuvon uses bcrypt password hashing, JWT authentication, rate limits on selected public routes, Content Security Policy headers, Stripe webhook signature verification, and encryption for stored provider keys. Security-relevant actions are recorded in an audit log for review. Those records are not currently write-once or independently signed.

Secuvon is a product of NexPhase Technology Limited, a company registered in Ireland under number 767639, with its registered office at S31 The Pottery, Bakers Point, Pottery Road, Dun Laoghaire, Co. Dublin.

The Challenge is a prompt-injection playground. Its levels run against a simulated agent in your browser, not a live model, and it is a learning game, not a Secuvon assessment.