Four fields, no calendar invite. The agent URL, your vertical, how often you ship, and the one failure mode you most fear. We come back with a written finding list within two business days — the first audit sells itself.
Inline validation lives on this form; the server re-checks the same schema before persisting. The submission shows up in the operator inbox as a one-line summary, scoped by vertical.
No sales call before you have something to react to. No automated funnel. Just a short document naming the scenario families we'll run first and where we expect the early P0 / P1s to land.
Within two business days: the scenario families we will run, the rubric tags we will score against, and the rough severity pre-rank. No marketing fluff, no scheduled call before you have something to react to.
Refund-heavy travel and B2B marketplace prospects often need a mutual NDA before sharing the agent URL. We sign yours or ours — whichever moves fastest.
Your agent URL, transcripts, and finding list stay between us. We never reuse scrubbing scenarios or the failure modes you name against another client without written sign-off.
Because a four-field written brief produces a more useful first reply than a 30-minute call. The brief is yours to send on your own clock, and ours to respond to in writing.
No. Every Picaroon run is sandboxed against a redacted copy of the agent surface or a staging instance you provision. We never point at a live customer-facing endpoint without written sign-off.
Then the rubric still ranks it. Severity comes from framework tags (OWASP / CSA), not from our opinion. Your team keeps the final say on what ships.