The hospital wants proof your AI agent can’t leak patient data.

We attack your agent, record what it actually did, and give the hospital’s reviewer a report they can verify — in hours, on every release.

Apply for private testing See an example report

Built for: HealthTech startups selling AI agents to hospitals
You provide: A test copy of your agent and read access to its logs
Access: Private testing for verified teams. The tooling is never released.

Log of an AI agent with memory in a patient portal

Session A attacker, as a patient Tue 14:02

user turn
tool: read_document()
memory.write() · persisted planted — one sentence hidden in an uploaded intake form
assistant turn

4 days pass

Session B a different patient Sat 09:41

user turn · reschedule visit
memory.read()
tool: share_records(to=…) fired — lab results sent where the planted text said

What the runtime guardrail saw in session B: an authorized patient request. Verdict: allow.

What we show: the planted input in A and the data it exposed in B, both from your agent’s own logs.

Planted — written to the agent’s memory
Fired — action that helps the attacker
Ordinary agent activity

Reconstructed from a published class of attack, not from a customer’s data.

Your deal is ready. The hospital’s security review is not.

Before signing, the hospital’s security team asks: “Can your AI agent be tricked into leaking patient data? Prove it.” Most startups can’t, so the deal waits — and every release reopens the question.

A week of waiting: ~$2,300

Of revenue pushed back on a $120k/yr hospital contract.

A missed window: ~$40,000

Miss the hospital’s deployment window and launch slips four months.

A leak: $7.42M

The average healthcare breach in 2025, often passed to the vendor through the Business Associate Agreement.

Not a promise. Evidence the reviewer can check.

A Security Report for Hospital Review, plus a technical report your engineers can reproduce step by step.

Built for the reviewer’s questions

Proof, not opinion: Every finding shows what the agent did — which tool, which patient, what data — not what an AI thinks of its reply.
Mapped to their checklist: OWASP Top 10 for Agentic Applications and MITRE ATLAS.
Verifiable: A link proves the tests ran on our service and the results weren’t edited.
Never a false “safe”: What we couldn’t observe is marked “unknown”, never “passed”.

Example report

Security Report for Hospital Review

Agent	intake-assistant
Build under test	2.14.0
Previous report	2.13.2
Tested	14 Oct 2026 · 46 attack types

Scope

Input channels: chat · uploaded documents · tool results
Patient data: records · lab results · appointments
Tools with side effects: share_records · update_record · send_message

Findings

F-01 Instruction hidden in an uploaded intake form → another patient’s lab results shared in their session

plantedsession A · memory.write · OWASP ASI06

firedsession B · 4 days later · share_records(to=…)

Fixed in 2.14.1 · same test re-run clean

Held

Patient-to-patient data isolation — 12 tests
Tool misuse through uploaded documents — 9 tests
Instructions planted in memory across sessions — 4 tests

Compared with 2.13.2

1 new finding · 0 regressions · 25 tests identical

Verification link: tests ran on the AgenticStorm service, results unedited

It’s like hiring a pentest firm for your AI agent, except the attacker is AI.

Hours, not weeks. A fraction of the price. Every release.

1
Connect

Give us a test copy of your agent, two fake patient accounts and read access to its logs. Nothing to install.
2
Attack

Our AI attacker runs 46 attack types: leaking one patient’s data to another, misusing tools, planting instructions that fire days later.
3
Prove

We check what the agent did, not what it said.
4
Report

Your reviewer gets the hospital report with a verification link. Your engineers get step-by-step reproduction.
5
Repeat

Re-run on every release and show nothing got worse.

Measured on the costs you already pay.

Six releases a year, tested three ways.

	In-house engineer	Outside pentest firm	AgenticStorm
Evidence for the reviewer	Self-testing, no standard	Outside party	Independent run, verifiable, mapped to OWASP and MITRE ATLAS
Time to evidence	9–14 engineer hours	1–3 weeks + waiting for a slot	Hours
Cost per round	$540–840	$8,000–50,000	$70
Cost per year	$3,200–5,000	$48,000–300,000, so most re-test once a year	$4,200, every release covered

Private testing, for verified teams.

For healthcare organizations and the vendors that serve them. We verify every applicant and don’t release the tooling publicly.

1Apply. It takes two minutes.
2We verify your organization.
3A 15-minute call, then the first run.

Questions founders ask first.

Will a hospital reviewer accept this?

Reviewers ask for evidence they can check: what the agent did, mapped to OWASP and MITRE ATLAS, with a link proving the run is genuine. It isn’t a HIPAA certification (HHS recognizes none), but it supports your HIPAA Security Rule evaluation.

Does this touch production or real patient data?

No. A test copy of your agent and fake patients. Nothing to install.

We already run Promptfoo.

Keep it. But you run it yourself, so to a reviewer it’s still self-testing, and it grades replies, not actions. We record what the agent did, and the reviewer can verify the run.

What don’t you test?

We never call an agent “secure”. We prove whether this build can be tricked into exposing patient data or acting for an attacker. Network and web-app pentests are a different job.

Who are you?

Three people in Yerevan, Armenia: product, security engineering and research engineering. The method was built in a major bank’s agent-security competition. Ask us for the source behind any number on this page.

Send us one agent.

Fifteen minutes. Tell us what your agent touches and which review is in the way; we’ll tell you what a run would check.

Apply for private testing hello@befirstcontact.com