PharosOne
Sign In
PharosOne
Sign In

Research

Standards, incidents, and what actually works — in the open.

Public: everything about the agent population and the standards. Private: everything about your specific agent. The pay line sits exactly where generic data stops answering the question.

Efficacy

Attack-variation policies and LLM-judged scoring: an empirical study on a behavioral scanner

A controlled study of whether the attack-variation policy changes how often an agent is breached, and whether an LLM judge is more accurate than the cheap static oracle it overrides — with a byte-identical noise floor and an independent reference labeler.

PharosOne Research · Jun 30, 2026

→
Methodology

The PharosOne Probe Engine: architecture of a behavioral scanner for AI agents

A behavioral vulnerability scanner built on Inspect AI — what it attacks, how it varies and scores attacks honestly, and how findings map to the AIUC-1 control standard.

PharosOne Research · Jun 24, 2026

→
Standards

AIUC-1: the SOC 2 for AI agents

The world's first standard for AI agents, and how PharosOne turns its controls into evidence.

PharosOne Research · Jun 26, 2026

→
Standards

ISO/IEC 42001: a management system for AI

The world's first AI management system standard, and the evidence that grounds it.

PharosOne Research · Jun 25, 2026

→
Standards

The EU AI Act: from legal obligation to evidence

The first comprehensive AI regulation, translated into testable evidence.

PharosOne Research · Jun 24, 2026

→
Standards

NIST AI RMF: governing risk, measuring trust

A voluntary framework for trustworthy AI, and where measurement fits.

PharosOne Research · Jun 23, 2026

→

Pharos Runtime

Know what your agents are doing — while they’re doing it.

Testing proves an agent was safe yesterday. Pharos Runtime watches its behavior in production: the pharos-1 model reads every session’s actions — tool calls, data access, conversational turns — and learns what normal looks like for your agent.

Behavioral baselinepharos-1 profiles each agent's normal behavior — no rules to hand-write.
Anomalies before incidentsDrift, tool abuse, and injection patterns surface as they emerge, not after impact.
Evidence that accumulatesEvery flagged session becomes reviewable, audit-ready material.
One familyFindings feed the same standards mapping as Framework tests and expert audits.
instrument.py
# pip install pharosone-dialogs
import os
 
from openai import OpenAI
from pharosone_dialogs import PharosOne
from pharosone_dialogs.instrument import wrap_openai
 
client = wrap_openai(
    OpenAI(),
    pharos=PharosOne(
        "https://app.pharosone.ai",
        os.environ["PHAROSONE_API_KEY"],
    ),
    agent_id="support-bot",
)
 
# Use `client` exactly as before — every call
# now streams the dialog here, fire-and-forget,
# without touching your bot's logic.

Know Your Agent

When agents handle real money and sensitive data, trust can’t be assumed.

Enterprises are handing real work — and real budgets — to autonomous agents. An agent that issues refunds, moves funds, or touches customer data is only as safe as its weakest prompt. Three products cover the whole question:

Pharos Runtime

Watches your agents' behavior in production and surfaces anomalies before they become incidents — powered by the pharos-1 model.

Pharos Framework

The open-source engine that attacks your agent with a live corpus — prompt injection, tool abuse, data leakage — locally, on your machine.

Pharos Audit

Our offensive team audits high-stakes agents by hand and runs traditional penetration tests for the rest of your stack.

Findings map to AIUC-1, ISO 42001 and the EU AI Act — audit-ready evidence, without your data ever leaving your machine.

PharosOne

Independent security & compliance infrastructure for AI agents. Know Your Agent — prove it’s safe before you trust it.

Sign InExplore the research→
Pharos RuntimeBehavioral analysis of live agents with our modelPharos FrameworkAutomated attack testing · open sourcePharos AuditExpert-led audit & pentest
info@pharosone.ai

Pharos Framework

Prove your agent.

Automated attack testing by the open-source Pharos Framework: a versioned corpus of 118 probes — prompt injection, indirect injection through documents and tool results, tool misuse, exfiltration — mutated and repeated against your agent, with success decided by a deterministic oracle and an LLM judge, not string matching. Runs locally, free; your keys and transcripts never leave your machine.

npx skills add pharosone/pharosone
View the source on GitHub

Pharos Audit

When the stakes need a human adversary.

The third product line is human. A complete portfolio of hands-on security testing — for AI systems and for classical IT infrastructure — delivered by a senior offensive team, with findings mapped to AIUC-1 where your auditors need them.

Vulnerability Assessment
Find every weakness — exploitation optional.
Penetration Testing
Reach the objective: customer data, funds, domain admin.
VAPT
Every path to the objective — not just the first one.
Red Team
A real APT, simulated — to measure and train your blue team.
Monitoring
The assessment, repeated monthly over newly exposed services.

Most engagements fit inside a month — some in a week; red teams run two months and up. Reporting your way: PDF, DOCX, spreadsheets, or findings filed straight into your ticket system.

Pharos Audit · What we test

Any surface an attacker would touch.

Web applications

Black, grey or white box

External perimeter & APIs

Assessment · pentest · monitoring

Internal network

From a standard employee's seat

Cloud infrastructure

Architecture review to admin planes

LLMs & AI agents

Assessment and red teaming

Source code

One-off or monthly review

Mobile applications

iOS & Android

Wi-Fi & wireless

Including PCI DSS scoping

WAF · AV · EDR bypass

Testing the controls themselves

IoT & firmware

Device, firmware or source level

Social engineering

Phishing that measures readiness

Technical CISO

Hands-on security leadership

Led by

A Deputy CISO and offensive-security lead — with a team of senior security engineers behind them.

22 CVEs disclosedBlack Hat speaker · 13 talksOSCP · OSEPMSc, Information SecurityDEF CON 28 & 29 IoT CTF winnerStandoff '21/'22 top-3Author of IoTSecFuzz · PCF

FAQ

What teams ask before they trust an agent.

What does PharosOne actually test?

A live corpus of real-world attacks — prompt injection, tool abuse, system-prompt extraction, data leakage — that you run against your exact agent. Each probe is varied with mutation and LLM-paraphrase (EN/RU and your agent's language), so coverage never hangs on one brittle string.

Can I try it instantly?

Yes. The default offline mock tier runs with no API key, no network, and no Docker, so you can see the engine work in seconds. A real test against your agent is opt-in (--tier model / --tier bridge).

Free or paid — where's the line?

Free and self-run: the open-core engine, onboarding skills, an example corpus, and a raw result.json. Paid and server-side: the full proprietary corpus, the mapping to AIUC-1, and a signed, audit-ready certificate.

Do my prompts or transcripts ever leave my machine?

No. API keys and system prompts stay in memory for the run — never to disk, logs, or the network. At certification, only stats-only evidence (attack-success rates, counters) is uploaded, Ed25519-signed. WireEvidence has no transcript field by construction, so the proof conversation physically cannot be sent.

Why is the certificate independent?

Because the server maps your findings to the standard and signs the report without ever seeing your data. We don't build agents — and it's the architecture, not just our position, that makes the result neutral.

Which standards do you map to?

AIUC-1, ISO 42001, the EU AI Act, NIST AI RMF and the OWASP Agentic Top 10 — every report is audit-ready for the committees your stakeholders already trust.

From the population to your agent

Knowing the odds isn’t knowing your agent.

PharosOne
Sign InExplore the research→