Baseline
$6,500
5 business days
One agent workflow, all 51 scenarios, one model, and a score compared across judges.
AgentBoundary assessment
Prompt-injection testing with AgentBoundary.
Assess model responses to 51 prompt-injection scenarios from the open AgentBoundary benchmark. Receive the test methods, scores and limits for the workflow under review.
Assessment available; no certifications issued
Assessment and readiness work are available for scoping. No AgentBoundary certifications have been issued or published, and badge eligibility criteria have not been published. The current assessment does not include a certification badge.
Results are confidential unless you authorize sharing them. Any future badge would require published eligibility criteria, a qualifying result and permission to publish; sharing a result or choosing a score does not establish eligibility.
Check the public registry and proposed record formatProgram resources
Prepare for testing or check a result.
Who it is for
AI SaaS vendors, security teams deploying internal copilots and agents, and LLM/MLOps platforms that need an independent report on a defined agent workflow.
When to assess
Use this when a security reviewer needs documented prompt-injection results, or when a model or prompt change calls earlier results into question.
Why assess
Give security reviewers the test record.
- Instructions embedded in a document, page or tool response may redirect a model from the assigned task.
- Security reviewers need test methods, results, and limitations they can examine alongside a vendor’s security claims.
- A model or prompt change can alter the response to the same attack. Results need a recorded version and test date.
Assessment tiers
Three tiers, from a single-flow baseline to a broader review with custom adversarial scenarios and board reporting.
Production
$18,000
10 business days
Up to three agent workflows, all four scenario types (RAG, filesystem, browser, code), comparison across judges, one rerun after fixes, and a procurement memo.
Board-Ready+
$38,000
15 business days
Up to six workflows, the full suite plus custom attack scenarios, an executive briefing, a remediation workshop, and optional quarterly retesting.
Annual recertification pricing is 55–60% of the initial tier under the proposed program terms; badge eligibility remains subject to published criteria. Targeted retesting after a major model change is scoped to the affected workflows. Confirm scope, timing, and applicable terms before kickoff.
Assessment outputs and program terms
The report, scorecard and supporting records.
Boundary Robustness Scorecard
Attack-instruction compliance rates overall and by attack family, Wilson confidence intervals for each rate, and a 0–100 AgentBoundary Robustness Score.
Technical Report
Failing prompts, recorded model responses, scoring records and recommended changes. Live tool execution requires separate system-level testing.
Procurement Appendix
Test methods, judge comparisons, assessed configurations, limitations and a signed letter describing the work performed.
Certification Publication Terms
The proposed badge terms provide a 12-month verification listing with tier, certification date, verification URL, and revocation terms. No badge is issued with the current assessment offer. Any future listing requires program qualification and the result holder's publication permission.
Retesting Plan
Plan annual review and targeted retesting after material model or architecture changes. Each result applies to the recorded scope, versions, and test date. Future recertification would also require the applicable program criteria.
Methodology
What the benchmark measures
AgentBoundary tests model responses to adversarial prompts. The report records the dataset, model and prompt configuration, judge versions and scoring method. Assessing deployed tools and access controls requires separate tests.
Read the benchmark and its limitations- Judges assess the model response against a compliance rubric. Repeating injected text alone does not count as following its instructions.
- Compare scores across judges and record disagreements. The report identifies the judge models, versions and checks used.
- Report Wilson intervals for measured compliance rates, alongside scoring and coverage limitations.
- Record the dataset version and attack families used, including markdown injection, RAG poisoning, context drift and HTML injection.
- The scenarios represent RAG, filesystem, browser and code-agent tasks. These are benchmark contexts, not proof that a live integration was tested.
Questions about scoring and publication
“We already run the open-source benchmark, or our internal red team tests this.”
An outside assessment provides a separately prepared report that your customer can review alongside internal tests. We disclose prior implementation or advisory work before accepting an independent engagement.
“LLM-as-judge scoring is subjective, or could be wrong.”
Judges score recorded model responses against a structured rubric. We compare judgments and report Wilson intervals for measured rates. Those intervals do not account for judge errors, provider changes or untested attacks; judge agreement is not proof of correctness.
“A bad score could be used against us.”
Results are confidential by default, with a private remediation window. You choose whether to authorize publication of your results. A remediation pass or customer-selected threshold does not confer certification; any future badge requires the published program criteria.
Using the results
Use the benchmark results alongside checks of the deployed system. The open suite measures model responses through chat-completion APIs; it does not test live tools, tenant isolation or production enforcement.
Assessment scope
Plan a test your security reviewers can use.
Describe the model, workflow and customer review you are preparing for. We confirm access, turnaround, remediation windows and publication terms before testing.