---
title: "AI agent security assessment: €3,900, report in 5 working days"
canonical: https://pharosone.ai/knowledge/ai-agent-security-assessment
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-23
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"AI agent security assessment: €3,900, report in 5 working days\". PharosOne, 2026-10-23. https://pharosone.ai/knowledge/ai-agent-security-assessment"
---

# AI agent security assessment: €3,900, report in 5 working days

> Our AI agents attack one agent with its tools, data and memory; an engineer reviews and signs the report: attack success rate, transcripts, AIUC-1 mapping.

URL: https://pharosone.ai/knowledge/ai-agent-security-assessment · Category: Products · Published: 2026-10-22 · Updated: 2026-10-23 · Author: PharosOne Research · Reviewed by: PharosOne editorial

*PharosOne sells the AI agent security assessment and wrote this article.*

**In short.** The AI agent security assessment is a €3,900 fixed-price, autonomous penetration test of one AI agent, with its tools, data sources and memory: PharosOne's own AI agents run the whole test against the deployment you give us, and a PharosOne engineer reviews the findings and signs the report. Within 5 working days of confirmed access you receive the attack success rate, the top findings with the transcripts that reproduce them, and the mapping to AIUC-1 and the OWASP Agentic Top 10. The €3,900 is credited in full to a human pentest ordered within 90 days of the report.

## Key facts

- Updated: 23 October 2026
- For: teams about to ship an LLM agent, or already running one, that want a measured result before a full pentest
- Price: €3,900 fixed, net of VAT; credited in full to a human pentest ordered within 90 days of the report date
- Time: report on or before the fifth working day after access is confirmed
- Scope: one agent, with its tools, data sources and memory; several agents scoped on the call
- You receive: the attack success rate, the top findings with evidence transcripts, the AIUC-1 and OWASP Agentic Top 10 mapping
- Standards: AIUC-1; OWASP Top 10 for Agentic Applications (2026)
- Next step: order the assessment, or book a 30-minute scoping call at audit@pharosone.ai

## What is an AI-run pentest?

An AI-run pentest is a penetration test in which the attacker is itself an AI agent: it reads your agent's replies, chooses its next move and continues until it reaches its goal or exhausts its budget. At PharosOne the attacking agents are our own, built and operated by the team that runs the human pentests. They are a separate system from the open-source [Pharos Framework](/knowledge/pharos-framework), a scanner anyone can run without paying on a versioned corpus of probes. The agents work through the attack classes in the report table below, each class with its own budget of attempts. The number of attacking agents and of attempts is set per engagement and recorded in the report, and the number of attempts behind every rate is printed next to it. A candidate becomes a finding only after the engineer has read its transcript and the tool call or output that proves the effect; candidates without that proof are dropped.

Autonomous means the agents run the whole test; the engineer checks access before it starts and reviews the findings after it ends. An adaptive attack scenario is a goal the attacking agent pursues by changing its approach after each reply: make the agent reveal its instructions, call a tool with the attacker's arguments, send data to an address the user never named, or act outside its role. The Framework can also run adaptive scenarios with an attacker model you configure; the assessment differs in who runs it, against what and who answers for the result. A PharosOne engineer reviews the findings, drops what does not hold and signs the report. In the [human pentest](/knowledge/human-pentest) the same agents are tools in the hands of senior engineers, who orchestrate them, validate every result, re-test it by hand and chain what the agents find.

## What is in scope?

One agent: the deployment you point us at, with its tools, data sources and memory. Several agents or a multi-agent system are scoped on the call. You name the agent and how to reach it on the order form, provide access (an API endpoint, a chat interface or a staging deployment) and a short description of what the agent is for and what it must never do. The assessment runs against the deployment you give us, production or a staging copy, and the report records its configuration: model, system prompt version, tools and guardrails.

The rules of engagement are agreed on the order form before the run: the test accounts the attacking agents use, a request rate the agent can take, the actions that must not complete for real (payments, messages to outside addresses, deletions) and a contact on your side who can stop the run at any time. A staging copy with its outbound actions neutralised is the safer target when the agent holds tools that move money or data.

When the agent needs senior engineers who direct the attacking agents and re-check every result by hand, or the infrastructure around the agent is in scope, book the full AI agent pentest.

## What does the report contain?

| Section | Content |
|---|---|
| Attack success rate | the share of attack attempts, per attack class, that reached their goal against your agent, printed with the number of attempts behind each rate |
| Top findings | each confirmed breach with the transcript that reproduces it, the tool call or output that proves it, a severity and a fix |
| AIUC-1 mapping | each finding tied to the AIUC-1 control it touches, for example B002 "Detect adversarial input", B006 "Prevent unauthorized AI agent actions" or D003 "Restrict unsafe tool calls" ([AIUC-1 standard](https://standard.aiuc-1.com/)) |
| OWASP Agentic mapping | each finding tied to its entry in the OWASP Top 10 for Agentic Applications, for example ASI01 Agent Goal Hijack or ASI02 Tool Misuse and Exploitation ([OWASP, 9 December 2025](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/)) |
| What is working | the attack classes that did not succeed, so the reader sees what was tried as well as what failed |

The attack success rate (ASR) is the share of attack attempts that reached their goal. A rate on its own says little without the count of attempts behind it, which is why both are printed together. Article 9(8) of the EU AI Act reads: "Testing shall be carried out against prior defined metrics and probabilistic thresholds that are appropriate to the intended purpose of the high-risk AI system" ([Regulation (EU) 2024/1689, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)). It applies only to high-risk systems, and for standalone Annex III systems only from 2 December 2027 after the AI Omnibus ([European Commission timeline](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act)). A rate with its denominator can serve as the metric; the threshold has to be set by the system's provider before the test, and the report alone does not show that the article is met.

## What happens in the 5 working days?

Access is checked first: the engineer confirms that the agent answers and that its tools fire, and reads the description of the agent's role, since "outside the role" can only be judged against a specific one. The attacking agents then run their scenarios across the inputs the agent reads and the tools it holds. The engineer reviews the findings, discards what does not hold, rates what does and signs the report. The report is delivered on or before the fifth working day, counted from the day access is confirmed.

## What is the difference from the Pharos Framework and the full agent pentest?

Both paid tests use PharosOne's AI agents. The difference is how much a person operates, validates and re-checks.

| | Pharos Framework | AI agent security assessment | AI agent pentest |
|---|---|---|---|
| Price | free, Apache 2.0 | €3,900 fixed | from €15,000 |
| Mode | self-serve | autonomous | engineer-led |
| Who runs it | you | our AI agents run it; an engineer signs off | senior engineers direct our agents and re-check every result |
| Attacks | 118 versioned probes, mutated and paraphrased; single-turn, chained and adaptive scenarios with an attacker model you configure | PharosOne's own attacking agents, adapting to your agent's replies | our agents, orchestrated by senior engineers who chain what they find |
| Human check | none | an engineer reviews the findings and signs the report | every result validated and re-tested by hand |
| Scope | whatever you point it at | one agent, with its tools, data sources and memory; several agents scoped on the call | one agent or LLM application with its tools, MCP servers, memory and knowledge base; several agents priced on the scoping call |
| Output | attack success rate with a Wilson interval; AIUC-1 coverage | attack success rate; top findings; AIUC-1 and OWASP Agentic mapping | full report with CVSS findings, attack chain, retest letter |
| Time | as long as the run takes, on your machine or in CI | 5 working days | 10 senior days; report in week 3; retest within 90 days |
| Standards | AIUC-1 | AIUC-1; OWASP Agentic Top 10 | AIUC-1; ISO 42001; EU AI Act Art. 9 and 15; OWASP Agentic Top 10 |

Sources: [pharosone/pharosone on GitHub](https://github.com/pharosone/pharosone); [PharosOne pricing](https://pharosone.ai/pricing), October 2026.

## When should I pick which?

Run the Framework yourself when you want a first number before anyone else is involved, or when the agent is still changing daily and the result stays inside the engineering team. It costs nothing beyond model access for the run.

Order the assessment when the agent is close to shipping or already live, and when you need a result that a security lead or a customer can read before a full pentest is justified. It also fits when you do not know whether the agent has a problem and want a person to stand behind the answer: the €3,900 is credited to a human pentest ordered within 90 days of the report.

Book the full AI agent pentest, from €15,000, when the agent is the product, when it moves money or data, when you want senior engineers to direct the attack and re-check every result by hand, or when a reviewer needs the full report with CVSS findings, an attack chain and a retest letter. For a pentest priced at €15,000, the remaining payment after the €3,900 credit is €11,100; larger scopes cost more ([PharosOne pricing](https://pharosone.ai/pricing), October 2026).

AIUC-1 certification runs on third-party testing (control B001 "Third-party testing for security risk") and includes quarterly retests and annual re-certification ([aiuc-1.com](https://www.aiuc-1.com/)). The assessment report is evidence of one such test at one point in time. Accredited auditors issue the certificate; PharosOne supplies the evidence ([AIUC-1 in our standards crosswalk](/research/ai-standards-crosswalk#aiuc-1)).

## FAQ

### Is the assessment fully automated?

It is autonomous with a human sign-off. PharosOne's own AI agents run the whole test, and a PharosOne engineer reviews the findings and signs the report; candidates that do not hold are dropped. In the human pentest, senior engineers direct the same agents and re-check every result by hand.

### Is this the open-source Pharos Framework run for me?

No. The Framework is a free scanner you run yourself: a versioned corpus of probes, some of them adaptive scenarios driven by an attacker model you configure, with no person reviewing the result. The assessment uses PharosOne's own attacking agents, a separate system built by the team that runs the human pentests, against the deployment you name, and a PharosOne engineer reviews every finding and signs the report.

### How many attacking agents and attempts does a run use?

There is no fixed number. The number of attacking agents and of attempts per attack class is set per engagement, for the agent and the rules of engagement agreed on the order form, and recorded in the report next to every rate it produced.

### What counts as one agent?

One agent: the deployment you point us at, with its tools, data sources and memory. Several agents or a multi-agent system are scoped on the call.

### Can the report serve as AIUC-1 evidence?

It is evidence of a third-party test at a point in time, with each finding mapped to the AIUC-1 control it touches. Certification is issued by accredited auditors; PharosOne does not issue certificates.

### How does the 90-day credit work?

Order a human pentest, such as the AI agent pentest from €15,000, within 90 days of the date on the assessment report and the €3,900 is deducted in full from its price. For a pentest priced at €15,000 the remaining payment is €11,100; larger scopes cost more.

## Sources

1. [AIUC-1 standard, control list (B001, B002, B006, D003)](https://standard.aiuc-1.com/). Artificial Intelligence Underwriting Company, 2026.
2. [AIUC-1, certification process (quarterly retests, annual validity)](https://www.aiuc-1.com/). Artificial Intelligence Underwriting Company, 2026.
3. [OWASP Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/). OWASP GenAI Security Project, 2025-12-09.
4. [OWASP Top 10 for LLM Applications 2025, LLM01 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). OWASP GenAI Security Project, 2025.
5. [Regulation (EU) 2024/1689 (AI Act), Article 9, Risk management system](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). Official Journal of the European Union, EUR-Lex, 2024-07-12.
6. [AI Act implementation timeline, after the AI Omnibus](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act). European Commission, AI Act Service Desk, 2026.
7. [pharosone/pharosone, PharosOne Security Scanner (Apache 2.0)](https://github.com/pharosone/pharosone). GitHub, 2026.
8. [The PharosOne Probe Engine, architecture of a behavioral scanner for AI agents](https://pharosone.ai/research/the-probe-engine-how-we-measure-agent-security). PharosOne Research, 2026-06-24.
9. [PharosOne pricing](https://pharosone.ai/pricing). PharosOne, 2026-10-22.

Source: PharosOne, "AI agent security assessment: €3,900, report in 5 working days", https://pharosone.ai/knowledge/ai-agent-security-assessment, updated 2026-10-23.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt