Buyer path for a security or operational review
A buyer-facing reading path: start from the situation, inspect the catalogue and samples, understand the verifier boundary, then send a non-secret fit check.
What should a buyer inspect before starting a WitnessOps review, and what does the request form actually start?
This page gives a buyer-readable path through the public WitnessOps surfaces before submitting a real request.
It is for a reviewer who wants to know:
- what the public catalogue offers
- what a sample demonstrates
- what the verifier can and cannot check
- what the request form starts
- what must not be submitted in the first message
- what remains outside the engagement boundary
1. Start with the situation and the catalogue
WitnessOps delivers bounded security and operational reviews with evidence references, named limits and unresolved items. Treat View services as the live offer list; this page deliberately does not duplicate its inventory or commercial status.
The primary paid entry point is Agent Action Security Review: one consequential agent or automation action, €2,500 fixed · excluding VAT, beginning with a non-secret fit check and delivered within 10 working days after evidence rules are agreed. Agent Workflow Reconstruction is the delivery method. External Attack Surface Review remains separate, secondary catalogue work at €1,900 · excluding VAT with its existing scope, caps, start conditions, and retest. Customer Security Review Sprint also remains available in the catalogue.
Do not read the catalogue as a broad AI governance program, production deployment claim, legal compliance claim, certification, or whole-environment assurance claim.
2. Inspect a sample before sending secrets
Open the External Attack Surface Review synthetic sample, the AI-agent sample package, or other sample cases.
Samples are public illustrations, not live customer evidence. Read the artifact note on each sample: not every web sample includes a receipt, and a preserved verifier result may describe a larger source package rather than the reduced public copy.
The External Attack Surface Review synthetic sample intentionally contains no receipt. It demonstrates the report and evidence-reference boundary; it is not an input for /verify. Its immutable package files retain the former Public Exposure Review title as historical artifact identity.
For the pinned AI-agent public sample only, use the table below:
| Artifact | What to check |
|---|---|
ACTION_BOUNDARY.json | What the workflow was allowed to do and what stayed out of scope. |
AUTHORITY_MAP.json | Who approved, acted, observed, reviewed, or challenged the action. |
EVIDENCE_MANIFEST.json | Which evidence classes are present and which gaps are declared. |
RECEIPT.json | How approval, action, evidence, result, and limits are bound into one record. |
VERIFY_RESULT.json | What the sample verifier result reports and what it does not establish. |
CHALLENGE_PATH.md | How another party can inspect, dispute, or request stronger evidence. |
MANIFEST.sha256 | Whether sample files match the published hash manifest. |
3. Understand the verifier boundary
Use Verify a receipt when you have receipt JSON to check — upload or paste, then read the result.
The public console is receipt-only v1. It can check supported receipt JSON. It does not prove the full runtime story, source-system honesty, artifact-byte revalidation, or complete bundle custody.
An internal limited-pass maps to public indeterminate. For the legacy-named public_exposure_review receipt profile, the public result stays indeterminate while request, authority, workflow, manifest and artifact bytes, evidence support, signature, and production key authorization were not independently checked.
For the full procedure split (public vs offline bundle-complete), read How to Verify a Receipt.
4. Commercial scope
Use Pricing and Commercial Scope and the catalogue for current public prices and ranges. Agent Action Security Review is €2,500 fixed · excluding VAT for one consequential agent or automation action; its delivery clock begins only after evidence rules are agreed. Agent Workflow Reconstruction is the delivery method. Evidence handling is agreed after the non-secret fit check and before source material is accepted.
5. Submit only the first non-secret fit check
Use Start a review only after you can describe one bounded situation in plain language.
The request form is a non-secret fit check. Start with a general description. Do not send files, credentials, logs, screenshots, private keys, API keys, MFA codes, recovery codes, session tokens or customer evidence during the fit check.
Fallback contact: engage@mail.witnessops.com.
6. Mailbox verification is not review start
After the request form, the mailbox verification step confirms mailbox access only.
The confirmation page means:
- the mailbox was confirmed for the request
- no review work has started
- no customer evidence has been accepted
- scope, fee, and evidence handling still need to be agreed
7. What happens after the fit check
If the situation fits, WitnessOps confirms the review, scope, authority, price, timing and evidence handling by email before secret material is accepted.
The engagement should make five things easy to see:
- what the situation was
- what was authorised and included
- what was checked or reviewed
- which material supports the result
- what remains limited, unknown or unresolved
8. Stop conditions
Stop and do not submit secrets if:
- the work cannot be bounded to one useful scope
- no approving authority can be named
- required evidence cannot be handled safely
- the goal is a broad compliance certification
- the goal is a legal audit opinion
- the request requires production secrets in the first message
9. Minimal buyer reading order
- Verify a receipt — use Try an example and inspect why the receipt-only result is incomplete
- View services
- Agent Action Security Review, External Attack Surface Review, or Customer Security Review Sprint
- Sample cases
- Start a review
- Verification docs
The key rule: do not rely on a claim unless the evidence reference, receipt, verifier result or named limit that supports it is visible.