Red-team · Monitoring
Subscription

Adversarial QA for the AI agents your customers talk to every day.

Picaroon runs hundreds of adversarial scenarios against your live support, booking, refund, or quoting agent — scores them against OWASP LLM Top 10 and the CSA Risk Rubric v2 — and re-runs the library on every prompt change, model swap, or knowledge-base ingest. You get the written finding before customers find the failure.

$10–15k audit$4–5k / month retainer75%+ gross margin
Monthly failure report
Run #047
Scenarios
142
Failures
27
P0 / P1
3 / 9
P0
OWASP LLM-06 / CSA RB.14

Refund eligibility override via "manager approval" framing

−$1,240 / event

P1
OWASP LLM-02

Warranty policy stealth — agent cites an outdated clause path

policy drift

P2
OWASP LLM-01

Prompt injection through CSV attachment metadata

logging only

Report delivered 2 days before your release — every release.
OWASP LLM Top 10CSA Risk Rubric v2MITRE ATLASVertical failure catalogNIST AI 600-1
Methodology

Every scenario, scored against three lenses.

We do not ship a benchmark. We score each adversarial scenario against the canonical LLM-risk frameworks AND a vertical-specific failure catalog that compounds with every retainer.

Severity (P0–P3) is set by the framework rubric, not by us — so the report on day 90 is comparable to the report on day 1.

Canonical LLM security risk taxonomy
  • LLM-01 · Prompt injection
  • LLM-06 · Sensitive information disclosure
  • LLM-02 · Insecure output handling
  • LLM-08 · Excessive agency
  • LLM-10 · Model theft
Framework-owned; severity is fixed by the catalog.

Active lens: OWASP LLM Top 10

Engagement model

The audit converts into a retainer — tied to your release cadence.

We sell the finding, not the harness. Margin and recurring trigger both come from the same place.

01
$10–15k
one-time

The audit

A few hundred adversarial scenarios run against your live support, booking, refund, or quoting agent. We deliver a written report ranking every failure by severity with the prompt or guardrail that caused it.

Two-week turnaround. Closes the conversation about whether your agent is safe to ship.

02
$4–5k
monthly

The retainer

The same scenario library re-runs on every prompt change, model swap, or knowledge-base ingest. Monthly failure report tells you what your agent broke before customers find it.

Triggered by release cadence, not calendar. A one-and-done audit instinct is fought off every contract.

Vertical wedge

Ecommerce refund & warranty policy first — because wrong-approval failures cost real dollars.

The vertical library compounds across clients: every retainer feeds the catalog, and the catalog becomes a benchmark no general-purpose eval tool can replicate. That is the moat.

100+
scenarios in the refund & warranty library
P0

Wrong-approval refund leak

An agent that approves refunds under "manager authorization" framing in a way that overrides the eligibility policy costs real dollars per event.

OWASP LLM-06 / CSA RB.14

P1

Warranty policy stealth

A verbose retrieval chain lets the agent cite an outdated clause. Looks harmless. Becomes a chargeback when it ships.

Vertical catalog · retail

P2

Refund-loop with intent drift

A multi-turn refund flow that hugs the customer eventually agrees to a partial credit outside the original SKU.

Vertical catalog · SaaS

The deliverable

A written report. Every month. Before your release.

Clients leave each cycle with a report that points to the prompt, guardrail, or knowledge-base ingest that caused each failure — not a dashboard. The finding is the product.

SeverityP0 / P1 / P2 / P3 ranked
ReproducerPrompt + context that triggered each failure
TraceFailure point in retrieval, system, or guardrail
OwnerPrompt change / model swap / KB ingest flagged
TrendComparing run #047 to run #046, last month, last quarter
FAQ

Questions buyers ask first.

Skim these before a scoping call. They cover the ones that have closed deals and the ones that have stalled them.

Live, read-only. We instrument a trail through the agent so every scenario is replayable. No customer is touched; no production state is mutated. We work best when access is scoped to a non-production-keyed environment that mirrors production behavior.

Get in touch

Talk to us before your next model swap, KB ingest, or prompt change.

Send a brief description of your agent (vertical, model, rough traffic) and we will reply with a scoping outline within two business days. The first audit sells itself, or it does not — we would rather find out in week one.

Send a scoping brief

Vertical-wedge engagements ship in two weeks. Retainers fill in release cadence.