# Agent Production Audit

Agents are in production and nobody can say whether they are safe.

Two weeks: an independent read of cost, reliability, and governance across your agent stack, with every finding tied to a dollar figure.

2 weeks · from $12K

Scales with the number of services, models, and tenants in scope. Set on the call.

## Who this is for

- Agents are live, the team has grown, and nobody has read the whole system in one pass.
- You need an outside opinion before a board conversation, a funding round, or a security review.
- You suspect the problems are real but you cannot rank them.

## Who this is not for

- You want automated scanning on its own. Scanners are excellent at detecting; this engagement is the judgment layer — what the findings mean for your architecture and your bill, ranked by dollar impact.
- You want a compliance certificate. That is a different engagement, and it is on the compliance pages.

## What you get

- A written audit across multi-tenancy and isolation, spend control, reliability targets, retrieval, and the tool-call layer.
- Findings ranked by dollar impact, with the arithmetic shown for each.
- A remediation plan split into what your team can do this month and what needs a dedicated engagement.
- An Agent Bill of Materials: what agents exist, what they can reach, and under whose authority.
- A walkthrough with your engineering team, plus a version of the summary that survives being forwarded to a non-engineer.

## How it runs

### Week 1: Read the system

Architecture, traces, policies, and the deployment path. Interviews with the people who operate it, because the documented system and the running system are rarely the same one.

### Week 2: Rank and price

Every finding gets a dollar figure and a fix. The report is delivered and walked through, not emailed and abandoned.

## Reported experience

- 1.8M+: Tool invocations audited under deterministic policy validation
- Traceable: Control-to-test evidence, with gaps and limitations recorded
- 250-450: Concurrent agent instances operated in production

## Evidence and limits

Drako deterministic controls (author-reported, reviewed 2026-09-22): The README distinguishes 80 Python rules and 17 additional TypeScript/JavaScript rules. Timings depend on the benchmark and are not a latency guarantee for an entire agent request. Repository code is not evidence of insurer acceptance.

[Source](https://github.com/drakolabs/drako/blob/23c9b64318043a09543c32c4e46070caf3ee530a/README.md)

Anonymized client outcomes (author-reported, reviewed 2026-09-22): Reported by Nick Cerutti; client identities and raw operational records are not public. $200K/year is aggregate savings across engagements. $40K/day was projected exposure; 72 hours describes that incident, not a response or resolution guarantee. Zero-known-incident statements describe observations, not proof of absence.

[Source](https://nickcerutti.com/work)

[Agent controls: sample evidence dossier](https://nickcerutti.com/evidence/agent-controls-sample.md) — Synthetic scenario: inventory, permissions, test results and unresolved gaps.

## Questions

### What makes this different from running the free scanners?

The scanners detect. They do not decide. The output of a scan is a list of findings with no idea which one costs you $9K a month and which one is noise. Ranking that list against your architecture and your bill is the deliverable.

### Will you sign off on our security posture?

The audit gives you an evidence-backed opinion; a formal attestation comes from an accredited auditor, and independence is what gives it value — the two stay separate by design.

### Can the audit fee be credited?

Yes. If the audit leads directly into a cost sprint, a reliability engagement, or a governance package, the fee is credited against it.

### How much of our team's time does this take?

Roughly four hours in week one for access and interviews, and two hours in week two for the walkthrough.

## Contact

[Discuss this engagement](mailto:n@nickcerutti.com) · [Pricing and terms](https://nickcerutti.com/pricing)

Canonical page: https://nickcerutti.com/services/agent-production-audit