Self-serve evaluation sandbox

Attack a real AI agent inside an isolated test organisation. Watch what your security stack catches, and what it lets through. No sales call.

× Book a demo × Talk to sales × Request access ✓ 60 seconds to your own tenant
Step 01  ·  Identify

One field, then you are in.

We use your work email to name the tenant and send the evidence bundle afterwards. That is the whole reason we ask.

Discovery first. We will land you on the scan and you can attack afterwards if you want to.
Free mail domains get a shared read-only tenant. A work domain gets its own.
We store your address to name the tenant and to send the evidence pack. No drip sequence, no retargeting, and it is not passed to anyone else.
Synthetic organisations built by our test lab. No real customer data exists in any of them.
Cloudflare Turnstile. No puzzle, no image grid, and nothing tracked across sites.
Turnstile test key in use — replace TURNSTILE_SITEKEY before publishing

No card. No call. No calendar link. The tenant lives for 60 minutes and is destroyed with everything in it. Attacks run only against the synthetic organisation you pick above, never against anything you own.

4Attack categories
60Minute tenant
0Sales calls
Step 02  ·  Provision

Building your isolated tenant.

A real agent estate, a real detection platform in front of it, and a real attack engine pointed at both.

lens://provision/tenant
Discovery inventory
Northway Financial
Fixture
Assets  10 Sanctioned  6 Unsanctioned  4
What discovery is, and is not

Discovery records configuration observations, each with a stated source. It does not sniff your network and it does not test anything. Every one of the eleven properties per asset is required, and a property the source does not state is stored as unknown, never as a blank, a dash, or a flattering default. record_provenance on every row here is fixture: these assets came from a specification document, not from an observation of a running estate, and the product says so rather than implying otherwise.

The prioritisation conjunction — three legs, evaluated in the database and nowhere else
Leg 1untrusted_ingestion = trueThe asset consumes content it did not author.
Leg 2identity_privilege_write = trueIts identity can write. Read access is recorded but is never an input here.
Leg 3egress_path <> noneThere is a path out.
2
Meets
All three legs hold on stated values. This is the returned set, and the reason to look here first.
5
Cannot be evaluated
Unknown on at least one leg. Not a pass. Nobody has recorded enough to say either way.
3
Fails on stated value
A leg is stated false. Decisive, and correctly unremarkable.

None of the three states is coloured. Green means prevention on our surfaces and red means proven attack success, and a conjunction state is neither. Meets is a reason to look first, not a finding. Fails on stated value is one leg stated false, not a clean bill of health.

The set is unordered, and that is deliberate

ordering_state = declined  ·  rank_position = null on every row, at every set size. Every member of the returned set satisfies the same three legs, the conjunction is the only permitted discriminator, and it is uniform within the set by construction. So no member is first, highest or top ranked. A caller looking for a rank finds a null and this reason, not an arbitrary element.

Estate map

The same ten assets, drawn as a path rather than a list: who talks to what, under which identity, through which tools, and where the data can go. Click any node for its recorded properties.

Attack path
People and ingress
Agents
Tool and MCP surface
Systems and egress
Proven attack success, or an unsanctioned asset Unknown, or not yet evidenced Every inventory and detection state — neutral by rule Reserved for prevention. Nothing on this surface earns it

Asset inventory

Unsanctioned first. Click an asset to read its recorded properties and see which legs decided its state.

Rogue Finance Copilot

Unsanctioned · unregistered

Where this asset came from

NORTHWAY-FINANCIAL-fixture-spec.md v1.0, section 5.1

Recon target
The platform  AIDR LAYER ONLY
Detect only
Category  IProfile  Lenient
Methodology section 4.2 — AI reconnaissance

Recon characterises the detection surface, not your estate. It sends a graded ladder of five stimuli through the platform's inspection API and records where the active policy first reacts. It makes no model call and no database access, so it is cheap, deterministic and side-effect free. The result is frozen to disk and pinned, so the attack that follows is reproducible against a known surface. ATLAS: AML.T0056, AML.T0051.000, AML.T0043.

Detection-surface ladder

Five rungs, overtness rising with intensity. Deliberately less potent than the live payloads: the goal is to locate the detector threshold, not to maximise attack success.

No model call. No database access.
Idle · five rungs, intensity 0 to 4 · no model call, no database access

Resolved surface

What the resolver consumes. Pure function of these four fields.

lowest_flagging_intensity
detectors_observed
flagged_rungs
surface
strict_threshold
2  named parameter, not a buried constant

Null dimensions

Recon states what it could not measure, and why. These are declared, not silently omitted.

Target
Ledger Support Bot  @ NORTHWAY FINANCIAL
Synthetic
Protected by  the platformMode  Detect only

Choose an attack category

Same engine, same payloads we run in a paid engagement. Nothing is watered down for the sandbox.

Policy

Three stages, run in sequence.

Waiting0%
Prevention is off, by design

The platform is configured to inspect and flag, not to block. Nothing on this screen measures its blocking ability, and the sandbox does not claim otherwise. Where a chain completes, the agent carried it through. Where it does not, the agent declined. A prevent-mode round is the one that measures blocking, and it has not been run.

Attack chain

Each stage is inspected on the way in and on the way out. Both results are shown.

Policy comparison

The same recorded chain, read against both postures. Detection and outcome are independent columns: with prevention off, the second is governed by the agent.

No evidence yet
Run an attack chain under 02 Attack console to populate this view.
Step 05  ·  Take it with you

Evidence pack

Everything this tenant produced, signed and timestamped. Filed by who reads it.

Run this against your own estate

Same engine. Your agents instead of ours.

You have now seen the product do the thing it claims to do, against an estate you did not have to expose. What you saw is one cycle. The subscription is the same thing, running against your estate, for as long as the estate keeps changing.

Agent estate assessment
from £10K one-off
Lens subscription
from £40K / year

Enterprise scope is quoted against a real estate. There is no on-screen calculator.

That is the whole funnel.

Link, email, sandbox, evidence, price. The buyer proves the product to themselves and never speaks to anyone until they want to.

Step 06  ·  Subscribe

Continuous, or it is a snapshot.

A single assessment tells you what was true on the day it ran. Both sides of that sentence move: your estate acquires agents, and the detection layer in front of them changes under you. The subscription exists because we can show you both moving.

What continuous means here

Six things that happen without you asking. Each one is a thing this sandbox already does once.

New patterns, as published
Every attack pattern we add to the library runs against your estate in the next cycle. You do not re-scope to get it.
Detection-surface drift
Recon re-runs and the artifact is re-frozen each cycle, so a change in what your platform catches shows up as a diff rather than a surprise.
Estate re-scan
Discovery runs again. New agents, new MCP servers and newly-unknown fields appear in the inventory instead of accumulating quietly.
Retest on findings
Anything you remediate is re-run, so the evidence says fixed rather than reported.
Category status changes
When a category moves from a surface we can describe to a result we can evidence, you are told, and it is included.
Evidence pack, refreshed
The pack is updated in place, not reissued from scratch, so the history stays readable.

Engagements

Scoped in days, run in weeks. Every engagement ends with a verdict your board can read and your engineers can act on.

For enterprises · one-off

Agent estate assessment

The easy way in. One full Discover, Attack, Remediate cycle across your estate, shadow agents included.

  • Estate map, unregistered agents flagged
  • Adversarial testing across our full set of agent attack patterns
  • Fee credited toward your first subscription year
from £10Kone-off
Most popular For enterprises · continuous

Lens subscription

Continuous adversarial coverage, renewed each year. New attack patterns run against your estate as we publish them.

  • Everything in the assessment, run continuously
  • Board-ready report, prioritised fixes, 30-day retest
  • Continuous discovery and retest cadence
  • Regulatory alignment: EU AI Act, NIS2, DORA
  • Quarterly board reporting
from £40K/ year
For large or complex estates

Enterprise

Bespoke scope for multi-team estates, sized to your environment, with a named engagement lead.

  • Everything in the subscription
  • Multiple business units and environments
  • Custom SLAs and a dedicated engagement lead
Custom
Early-stage startup? We keep a reduced startup rate so you can secure your agents before you scale, not after your first incident.

These are the rates published on artifactlens.co. Annual is the only subscription term currently priced; a monthly option is not published yet. Anything outside these shapes is quoted against a real estate rather than calculated from a form.

Step 07  ·  The only human step

Now we talk, if you want to.

You have run the product and seen the evidence. This is the first point where a person is genuinely useful, because a price needs someone to look at your real estate rather than guess at it.

Default is written. A call happens only if you pick one.
Cloudflare Turnstile. No puzzle, no image grid, and nothing tracked across sites.
Turnstile test key in use — replace TURNSTILE_SITEKEY before publishing

What we will not do. No drip sequence, no retargeting, no third party gets your address. If you never reply we send one follow-up and then stop.

Step 1 of 10  ·  Entry