TRUSCOR
Had an AI incident? Get rated
Product · Two products, one ladder

Rate it. Record it.

TRUSCOR tests an AI system from the inside and issues a Financial Risk Report on what a failure could cost, summarised in a private 300–900 score. SOVA Black Box then records every action the system takes.

01Phase 1 of 5 · Map

One orchestration at a time.

One connected system of agents, tools and integrations serving one workflow. We map everything it can reach and check where its data goes.

02Phase 2 of 5 · Compose

We attack it on purpose.

Attacks are composed across seven families: access, manipulation, data, consequential actions, execution surfaces, operations and frontier.

03Phase 3 of 5 · Detonate

Live tests, from the inside.

Each attack runs inside the real system, under written authorisation, with the conditions of every trial recorded.

04Phase 4 of 5 · Observe

What it claimed, and what happened.

We measure the gap between what the system claims to have done and what actually took effect, and keep every step as a signed trace.

05Phase 5 of 5 · Quantify

Certificates are verified, never offset.

Certificates are verified but never offset a behaviour finding.

05Phase 5 of 5 · Quantify

What a failure could cost, in one report.

The Financial Risk Report sets out what the system can do at its worst, the estimated financial exposure and what would reduce it. A private 300–900 score summarises it on the cover. The 784 shown is a sample score.

06SOVA Black Box

Every action, signed and checked.

Runs inside your own cloud and records tool calls, external interactions, approvals, state changes, errors and outputs.

06What it does not do

It records; it does not block, approve or change what the AI does.

07Traceability · Forensics

Trace it, rebuild it.

Reconstruct any decision. Rebuild an incident from the record and find the most likely cause.

07Continuity

Keep it current.

Feed a monthly Continuous Rating. A rating never requires SOVA Black Box and never scores higher for it.

How it fits together

Four layers, one record.

Open at the bottom, independent at the top. Only TRUSCOR issues the score.

Four layersRead from bottom to top
Each layer in detail
4 · What you buyTRUSCOR Rating · Continuous Rating · Incident forensicsThe Financial Risk Report and its 300–900 score, refreshed monthly from the record, and incident reconstruction.
3 · TRUSCOR’s private systemsSOVA Engine · TAFAAR · SOVA Black Box · O.W.LSOVA Engine tests and judges. TAFAAR grades. SOVA Black Box records in your cloud. O.W.L is the instrument both use to operate and observe real computers. None of them is open source.
2 · Free · Apache-2.0SOVA OSSThe open toolkit: record, discover, test, explain, prove, watch and share. Its results are self-assessments. Explore SOVA OSS
1 · Open evidence format.sova.sova capsules and .sova-trace records, used by everything above.
Read from bottom to top.How the pieces fit →
What you receive

One report, and what comes with it.

Each one is written for the person who has to act on it.

One rating, five documentsAnd who each one is for
What each document contains
Financial Risk ReportBoards, investors, buyers, brokers, insurersThe main deliverable. What the system can do at its worst, the estimated financial exposure, what reduces it and by how much, confidence and limits.
The score on its cover, 300–900You, and whoever you share it withThe report summarised in one number, on the same scale as CIBIL, so a credit committee or underwriter reads it before opening the report.
Evidence PackAnyone who must rely on the resultTraces, test IDs, timestamps and artifacts in the open .sova format.
Retest ReportYou and your counterpartiesWhich findings no longer reproduce after your own fixes.
CISO Technical ReportCISOs, engineering and securityEvery finding, how to reproduce it, severity, and what a fix must achieve.
The standard · what every finding must answer
01What failed?
02What triggered it?
03Can it be reproduced?
04How often was it reproduced under the stated conditions?
05What privileges, tools, data or systems were involved?
06What control should have prevented it?
07What business consequence could reasonably follow?
08What evidence supports the conclusion?
09What is unknown or outside scope?
10What must be true for TRUSCOR to mark it closed on retest?
New in the rating and the record

Built on the full SOVA stack.

Every rating runs on O.W.L, SOVA Engine and TAFAAR, and every finding is written as .sova evidence. These capabilities are in the product now or arriving next.

The SOVA stackHighlighted: the parts behind this page
Self-expiring ratings TAFAAR · SOVA Black Box

Every grade is bound to a behavioural fingerprint of the whole system: model, prompt, retrieval and tools. When the fingerprint changes significantly, the grade flips to “stale, retest due”, like a credit watch.

Available

Tasks, trials and configuration are fixed in advance. Grades are reported as bands rather than false precision, the scaffold and configuration are part of the rated object, and each grade carries a measurement-error budget.

Available
Oversight drills O.W.L · SOVA Engine · SOVA Black Box

We pull the kill switch inside an O.W.L test environment and measure time to halt, whether sub-agents and in-flight tool calls stop, and what state is left behind. We seed known errors into human review queues and measure how often reviewers catch them.

Available
Effect-verified recording SOVA Black Box · O.W.L

Read-only O.W.L sensors check each recorded action against the real state of files, processes, network, browser, screen and databases, and mark it verified, failed or unknown.

Available
Neutral evidence custody and escrow SOVA Black Box · .sova

Records are hash-chained from creation, gaps are detected to prove completeness, timestamps are independently anchored, and escrow terms are fixed in advance and identical for every client.

Available
Discovery-and-cure ledger SOVA Black Box · O.W.L replay

Timestamps when our testing found a problem, and records an independent retest showing the fix held. We sell the test and the retest, never the fix.

Available
Secret, regenerated tests SOVA Engine · O.W.L

Test tasks generated inside O.W.L environments, rotated test sets, canaries planted in answer keys, and a contamination statement in every report.

Available

Decoy credentials, documents, tools and planted memories; any touch is recorded as attributed evidence. Hash-chained memory diffs trace an incident to the memory write that caused it. Detect and record only, never block.

Available
Test-vs-production gap TAFAAR · SOVA Engine · SOVA Black Box

A per-behaviour measure of how well a system’s tested behaviour predicts its live behaviour, from SOVA Engine results and Black Box recordings of the same system.

Available
Verifiable scoring TAFAAR · .sova

Judges run inside an attested secure enclave, with hashes of tests and transcripts committed in each .sova file, so the rated party or a regulator can recompute the grade without seeing the secret test items.

Available
Being built = the TRUSCOR corpus and its data products, which grow with every consented rating.

Published prices, per orchestration.

Five fields and a short call. We reply within one working day.