Most AI risk assessments start with a questionnaire. Ours starts with a connection. You integrate Certius Labs via API or lightweight SDK, and we map your agent's real attack surface — not what someone remembered to write down.
Our adversarial engine runs 500+ attack scenarios against your agent. Every scenario is mapped to a recognized framework — MITRE ATLAS, OWASP LLM Top 10, NIST AI RMF — so your audit documentation is accepted by regulators and carriers alike. We don't invent new criteria. We execute the ones the industry already trusts.
| Category | Weight | Example scenarios |
|---|---|---|
Prompt Injection & Jailbreaks | 20% | Direct injection, indirect injection via retrieved content, role-play bypass, encoded payloads, context window poisoning |
Data Exfiltration | 20% | System prompt extraction, training data leakage, unauthorized PII access, inference through side-channel prompts |
Tool & Permission Misuse | 20% | Unauthorized API calls, privilege escalation, out-of-scope actions, destructive tool chains |
Multi-agent Cascade Failures | 15% | Agent-to-agent manipulation, coordinated failures, orchestration exploits |
Reliability & Hallucination | 15% | Factual drift, consistency under adversarial input, confident-but-wrong outputs |
Compliance Violations | 10% | Regulated data handling, output content policy, audit trail integrity |
Your agent's risk compressed into a single number from 300 to 850. Modeled on the approach BitSight used for cyber risk — and that rating agencies have used for credit for a century. Not because it's perfect, but because it's the format executives, boards, and underwriters already know how to act on.
| Tier | Range | Description |
|---|---|---|
| Exceptional | 800 – 850 | Robust against known and novel attacks. Insurable at best rates. |
| Strong | 740 – 799 | Production-ready with minor hardening opportunities. |
| Adequate | 670 – 739 | Insurable with standard premium. Clear remediation roadmap. |
| Weak | 580 – 669 | High premium. Coverage limited until remediation. |
| Critical | 300 – 579 | Not recommended for production without significant changes. |
Your score is not a snapshot. Our engine re-tests continuously — triggered by model updates, prompt changes, new tools, or scheduled intervals. Changes trigger alerts to your team and (if coverage is active) pricing review with the carrier.
Compare against your industry peers (finance, healthcare, SaaS, legal), against your own trajectory over time, and against specific agent archetypes (customer service, coding, data analysis, financial).
Every test we run is mapped to the specific regulatory requirement it satisfies. Your audit becomes a pre-packaged compliance artifact for the frameworks you operate under.
Traditional insurance asks: "Do you have a policy for data handling? Yes/No." We don't ask. We test. Your premium reflects what our adversarial engine found — not what your compliance team wrote in a questionnaire.
Your premium is derived from three inputs: your risk score, your coverage limit, and your exposure profile. A score improvement of 50 points typically reduces premium by 15–30%. We show you the math — no black box.