Get an assessment shaped by your system and the decision you need to make. Our findings are independent of the vendor or model you choose.
For Assurance
Know your AI.
Trust your next step.
Independent assurance for organisations buying, deploying or operating AI. Understand how your system behaves, where it can fail and what needs to change.
For AI owners, security and risk teams, procurement and governance leaders.
Why organisations
work with Witcher.
Understand behaviour against the data, users, tools and responsibilities your AI will actually have, including realistic use, misuse and incomplete information.
Give technical teams findings they can investigate, and give security, risk and governance colleagues a clear account of what was assessed and what remains open.
Identify the changes that need another look. Retesting can keep the assessment aligned with new models, data sources, integrations and permissions.
Example extractAssessment scope
Start with the decision.
SystemInternal knowledge assistant
Intended useFind and summarise team documents
BoundariesUser access · source quality · oversight
The question to answer
What needs to hold before access is expanded?
AI assurance,
in practice.
Explore the behaviours, boundaries and decisions we can help you assess.
Example extractBehaviour review
Tasks, conditions and expected responses.
Test conditionExpected response
Information missingAsk for clarification
Sources conflictSurface the uncertainty
Request outside scopeDecline or escalate
Testing connects observed behaviour to the workflow it affects.
Test the behaviour
you depend on.
See how your AI handles real tasks, missing information and conflicting sources. Understand the failure modes that matter in your organisation’s workflows.
Learn moreExample extractSecurity boundary review
Untrusted content. Defined limits.
Source under test
A retrieved document contains an instruction outside the assistant’s role.
Instruction boundary
QuestionCan source content change permitted actions?
Record the input, configuration and behaviour behind each finding.
Challenge its
security boundaries.
Examine prompt injection, hostile source content and attempts to bypass controls. Find out whether the configured system can be pushed beyond its intended role.
Learn moreExample extractData access review
Match retrieval to the user’s role.
SourceTeam ATeam B
Shared guidanceIn scopeIn scope
Team A recordsIn scopeRestricted
Team B recordsRestrictedIn scope
Example access expectations to test against the configured system.
Check what your
AI can access.
Review how retrieval and permissions work together. Assess whether the system can reach or reveal information outside a user’s access, across teams and sources.
Learn moreExample extractAgent action review
Set the boundary before the action.
Read a record
Role checkWithin the user’s access
Change a record
ApprovalConfirm the permitted action
Send externally
Human reviewEscalate before sending
Example control expectations for connected tools and actions.
Put agent actions
under scrutiny.
Assess what an agent can read, send or change, and where a person needs to intervene. Test tool permissions, action limits and escalation before granting wider responsibility.
Learn moreExample extractDeployment decision brief
A clear account of the evidence.
01 / ScopeThe system and conditions assessed
02 / FindingsObserved behaviour and supporting evidence
03 / Next stepsPriorities, remaining risks and conditions
ScopeEvidenceAction
Give decision-makers
clearer evidence.
Bring technical findings, governance and oversight into a scoped assessment. Give the people approving deployment a clearer view of readiness, remaining risks and recommended conditions.
Learn moreExample extractChange and retest review
Keep the evidence tied to the system.
- Change recorded
Model, prompt, source or permission
- Scope reviewed
Identify the affected behaviours and controls
- Retesting agreed
Refresh the findings for the updated system
A review cycle based on meaningful changes to your AI.
Keep assurance
in step with change.
Revisit the evidence when models, prompts, data or permissions change. Agree meaningful retesting so your assurance reflects the system your organisation runs today.
Learn moreWhat you receive
Evidence your
team can act on.
Technical detail for the people making fixes. Clear conclusions for the people making decisions.
- 01
Know where you stand.
A scoped assurance summary setting out the system assessed, the key findings and the remaining risks.
- 02
Know what to address.
Prioritised findings with supporting evidence and practical recommendations for your team or supplier.
- 03
Know what comes next.
A readiness view, recommended deployment conditions and the changes that should trigger retesting.
Scope and deliverables are agreed before testing. Findings apply to the system, configuration and scenarios assessed.
Start where
your system is.
We can assess a deployment, support your team as it is built, or keep testing once it is live.
01
Before deployment
AI Deployment Assurance
Understand readiness before connecting AI to more data, users and decisions.
02During implementation
AI Deployment Support
Bring independent review into architecture, control design and testing decisions.
03For live systems
Continuous AI Assurance
Keep your evidence current as models, integrations and permissions change.
Before
we begin.
Can you assess an AI product we are buying?
Yes. We can assess a third-party product in the context of your intended use, with testing access and boundaries agreed with you and, where needed, the supplier. The scope makes clear what can be tested and where the assessment relies on supplied evidence.
Can you assess a system already in use?
Yes. An assessment can establish a baseline for a live system, investigate a concern or examine a significant change. Continuous assurance can then provide agreed retesting as models, prompts, data and permissions evolve.
What do you need from us to get started?
Start with what the system does, who uses it, the data and tools it can access, and the decision you need to make. We agree scope, test access, representative scenarios and deliverables before the assessment begins.
How does this fit with our security and risk teams?
We work with the people who own the system and the people reviewing it. Findings include technical evidence for engineers and a clear summary for security, risk and governance colleagues. Your organisation retains responsibility for the deployment decision.
Make your next AI decision
with a clearer view.
Tell us about your system and the decision you need to make.