WitnessOps reviews

Two focused security reviews.

Understand what one agent action can do and what your internet-facing system exposes. Compare the scope, evidence and price before requesting a review.

Review one agent action

One consequential agent or automation action. Permissions, approvals and execution evidence.

Agent Action Security Review

Price: €2,500 excl. VAT

Before your agent takes an important action, understand the controls around it.

Engineering teams and AI implementation partners preparing to launch or hand over an agent that can issue refunds, change records or grant access.

What you receive

  • An action map showing the trigger, executing identity, permissions and approval steps for the agreed action.
  • A review of the execution path, permissions and approval boundary.
  • Prioritised control gaps linked to the evidence chain, with practical recommendations.
  • Explicit unknowns: missing evidence and questions the review cannot resolve.
  • A written report and readout to help your team decide what to change.

Timing: Delivery timing agreed in the signed statement of work

Scope and exclusions

One consequential agent or automation action. Read, inspect, reconstruct and report only. No platform installation, production modification, destructive testing, exploitation, credential changes, persistence, continuous monitoring, or certification that an agent is safe.

  • One consequential agent or automation action
  • One consequential agent or automation action only; multi-workflow programmes need a separate quote.
  • Default operating mode: read, inspect, reconstruct and report.
  • No platform installation, production modification, destructive testing, exploitation, credential changes, persistence, continuous monitoring or certification that an agent is safe.
  • Historical synthetic samples are not a full-review sample and do not change the agreed commercial terms.
How the review works
  1. Non-secret fit check. Name the consequential action, systems involved and decision deadline. Do not send credentials, secrets or production data.
  2. Agreed scope and authority. Confirm the action, evidence rules, recipients, price and handling in an accepted agreement. The fee is €2,500 excl. VAT.
  3. Manual reconstruction. Read, inspect, reconstruct and report against the agreed evidence. No execution of the reviewed action.
  4. Report and readout. Delivery timing agreed in the signed statement of work. Your team owns remediation decisions.
Request an agent review

Review external exposure

One authorised internet-facing system. Not a penetration test.

External Attack Surface Review

Price: €1,900 excl. VAT

Understand what your public-facing system exposes—and what to fix first.

SaaS and technology teams preparing for a launch, infrastructure change or customer security review.

What you receive

  • A map of exposed hosts, services and endpoints within the agreed system boundary.
  • Manually checked findings with evidence and clear priorities for what to fix first.
  • An executive report and technical appendix with remediation guidance and explicit unknowns.
  • Scope and stop-condition record, evidence manifest and artifact hashes; signed receipt and offline verifier where supported.
  • One focused retest of reported findings within 30 calendar days of initial report handover.

Timing: Delivery timing agreed in the signed statement of work

Scope and exclusions

This is not a penetration test. No exploitation, authenticated testing, brute force, credential collection, social engineering, denial of service, destructive activity, persistence, malware, exfiltration, certification, or security guarantee.

  • One authorised public-facing system, identified by a domain, application, API, public IP, or public cloud endpoint.
  • Inside that accepted system boundary: up to 1 registrable root domain, up to 10 first-party hostnames, 3 customer-attributed public IP addresses, and 20 public service endpoints.
  • If we discover related assets outside the agreed boundary, we can record them, but we won’t test them without explicit authorisation.
  • Public cloud-hosted services can be included when they are reachable from the internet and belong to the agreed system. Cloud accounts, IAM, private networks, and provider infrastructure are not reviewed.
  • It uses passive discovery where applicable, followed by explicitly approved, low-impact checks against the signed target schedule.
  • Approved low-impact classes are DNS, TLS, HTTP(S), service-identification, and allowlisted exposure checks.
  • unauthenticated, outside-in perspective only
  • No exploitation, authenticated application testing, password testing, brute force, credential collection, social engineering, denial of service, destructive activity, persistence, malware, customer-data collection, or data exfiltration.
  • No source-code, mobile, smart-contract, cloud-account, IAM, private-network, provider-infrastructure, or open-ended subdomain or IP-range review.
  • This is not a penetration test. It is not compliance certification, a security attestation, or a guarantee that the system is secure, complete, compliant, or free of vulnerabilities.
  • Targets outside the confirmed first-party scope remain untouched. Third-party or shared infrastructure requires separate written authority.
How the review works
  1. Request. Name the authorised internet-facing system and why the external attack surface matters now. Provide your authority to request the review, but do not send secrets or production evidence.
  2. Scope acceptance. WitnessOps accepts or rejects the boundary asynchronously, confirms capacity, and records payment. No sales call is required.
  3. Review. Use passive discovery where applicable, then perform only the explicitly approved, low-impact DNS, TLS, HTTP(S), service-identification, and allowlisted exposure checks against the signed target schedule. Manually validate, deduplicate, prioritise, and link findings to evidence.
  4. Delivery and retest. Deliver the reports and inspection package. Delivery timing agreed in the signed statement of work. Then retest the agreed reported findings once within 30 calendar days of report handover.
Request an external reviewSee scope and deliverablesSynthetic sample

An enquiry does not authorise collection or start a review. Payment and mailbox verification are not permission to inspect a system.

These reviews do not grant compliance certification. A report, receipt or verifier does not prove that a system is secure, complete or free of vulnerabilities.

Scope before work. Evidence beside findings.

Agree the boundary

Scope, exclusions, price, authority and evidence handling are agreed before work starts.

Start without secrets

The initial enquiry uses a short, non-secret description. Do not send credentials or production evidence.

Understand the limits

The report distinguishes supported findings, unavailable evidence and questions the review could not answer.

Which of these two reviews fits?

Describe the decision you need to make. We will confirm whether the Agent Action review, the external review, or neither is the right fit. No work starts from the enquiry.

Ask about fit
Reviews | WitnessOps