Bring us the agent boundary.
Tell us which agents you operate, which tools and data they can reach, and where MCP sits in the path. We can discuss the control platform, IntelliScan, assurance, or a combination.
Tell us what the agent can reach.
Do not include sensitive architectural detail, credentials, or client data in this form. It is sufficient to describe the system in general terms; the technical exchange happens under NDAA mutual non-disclosure agreement signed before sensitive technical information is exchanged..
Channels
We ask that no client data, architecture documentation, or credentials be sent by unencrypted email at any stage.
An encryption key for sensitive correspondence is provided on request, with the fingerprint confirmed out of band before anything is transmitted. Ask before sending material you would not send in the clear.
If you have identified a security issue in Averon's own infrastructure, or in a system you believe we assess, write to contact@averon.systems. We acknowledge within one business day and will agree a disclosure timeline with you. We do not operate a bounty programme and we do not require you to accept non-disclosure terms in order to report.
Questions that make the first conversation useful.
Not prerequisites. If you can answer these, the scoping session will be shorter — and if you cannot, that is itself a useful result.
- How many agents exist, and does each have a distinct identity?
- Which MCP servers, tools, and data sources can each agent reach?
- Which agent actions read state, and which actions change it?
- Where is authorization enforced today?
- Do multiple agents share one application or service credential?
- What should happen when IntelliScan flags a suspicious instruction?
- Who can change agent policy or register a new MCP capability?
- Do you need a product deployment, an assessment, or both?
Before the scoping session.
Short answers to the practical questions that usually come before a first conversation.
What should we send with the request?
Only a general description of the agents, their tools, the data and actions in scope, and the outcome you need. Architecture, credentials, client data, and other sensitive material wait until an NDA and secure channel are in place.
Does the first session create a commercial commitment?
No. The session establishes the agent boundary, relevant Averon capability, delivery constraints, and whether the platform or assurance service fits the deployment.
Can the engagement remain inside our environment?
Yes. Testing can be delivered on premises, in a client-controlled cloud environment, or within an isolated tenancy. The evidence-handling plan is agreed before testing begins.