TRUSCOR
Had an AI incident? Get rated
Methodology

How the report is built.

The Financial Risk Report and the score that summarises it follow a published, versioned method. It combines five categories of input, tested with SOVA Engine.

01Five inputs, one number

Behaviour testing is the thickest stream.

Supply chain and data exposure, certifications, your operational figures and comparable incidents adjust it. Nothing replaces the test itself. The 712 here is a sample score.

Inputs

Five inputs, one report.

Behaviour testing is the core. Everything else adjusts it.

TAFAARFive inputs, three outputs
Each input in detail
1 · Behaviour testingOur inside-out adversarial testsThe core of the report and the score. Nothing replaces it.
2 · Supply chain and data exposureMCP servers, tools, plugins, data flowsAdjusts reach and blast radius.
3 · Existing certifications and reportsSOC 2 Type I/II, ISO 27001, ISO 42001, AIUC-1, prior pentest and VAPT reports, internal auditsCollected, verified for validity and scope, and folded into the assessment. An expired or out-of-scope document counts for nothing.
4 · Your operational figuresTransaction values, volumes, detection and recovery timesDrives the Estimated Financial Exposure.
5 · Comparable incidents and lossesThe corpusCalibrates exposure against what has happened elsewhere. Today this draws on public incidents. The corpus grows with every rating.
Rules

Rules the method follows.

Re-ratingWhat calls for a new rating
Certificates never offset findingsCertifications prove that governance processes exist; only testing proves how the system behaves. Every report carries a Certification Status section listing each document reviewed, whether it was valid and whether its scope covered the rated system.
Estimated Financial ExposureA calculated estimate with a stated basis, labelled by source and reproducible from the published method.
Validity and retestingA rating is valid for the system and conditions tested. A model or provider change, new tools, permission expansion, a new data class or a new incident calls for a re-rating. You fix; we retest against the condition each finding stated.
“A short test cannot prove an agent safe.”
SOVA OSS README, “What SOVA will not claim” · read 19 Oct 2026 · Source ↗
Inside the grade

Evidence in, a grade with its arithmetic.

TAFAAR takes five inputs: behaviour testing, supply chain and data exposure, verified certifications, the client’s operational figures, and comparable incidents from the corpus. Findings are mapped to OWASP, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, the EU AI Act, CERT-In, DPDP, RBI and SEBI, without claiming certification.

The SOVA stackHighlighted: the parts behind this page
Five phases SOVA Engine

Map, Compose, Detonate, Observe and Quantify: live adversarial execution against the real system, under written authorisation.

Available

O.W.L reads what really happened through channels the AI under test doesn’t control, writes down the expected result before each action, grades each piece of evidence and reports what it could not see.

Available

Tasks, trials and configuration are fixed in advance. Grades are reported as bands rather than false precision, the scaffold and configuration are part of the rated object, and each grade carries a measurement-error budget.

Available
Self-expiring ratings TAFAAR · SOVA Black Box

Every grade is bound to a behavioural fingerprint of the whole system: model, prompt, retrieval and tools. When the fingerprint changes significantly, the grade flips to “stale, retest due”, like a credit watch.

Available
Secret, regenerated tests SOVA Engine · O.W.L

Test tasks generated inside O.W.L environments, rotated test sets, canaries planted in answer keys, and a contamination statement in every report.

Available
Production-calibrated fault injection SOVA Engine · SOVA Black Box

Tool failures injected into tests at the rates SOVA Black Box sees in production.

Available
Test-vs-production gap TAFAAR · SOVA Engine · SOVA Black Box

A per-behaviour measure of how well a system’s tested behaviour predicts its live behaviour, from SOVA Engine results and Black Box recordings of the same system.

Available
Verifiable scoring TAFAAR · .sova

Judges run inside an attested secure enclave, with hashes of tests and transcripts committed in each .sova file, so the rated party or a regulator can recompute the grade without seeing the secret test items.

Available
Being built = the TRUSCOR corpus and its data products, which grow with every consented rating.

Get rated.

Five fields and a short call. We reply within one working day.