CAIN-42 CAIN Studio
Sign inGet started
Menu
42CAIN-42 IHVRK › Buyer evidence research

What buyers will ask for, and where our evidence is

Research done 2026-11-03. When a sales email lands, a security reviewer answers with a questionnaire. The 2026 pattern across the sources below: an AI section on top of the usual security review, and a demand for artifacts, not yes/no answers. The sources are mostly practitioner and vendor blogs, not standards bodies.

What they ask for, most often

  1. Per-decision records of what an agent was allowed and refused, tamper-evident, exportable, verifiable without the vendor's system. We answer with the IHVRK kit per product.
  2. Denials recorded the same way as approvals. Every kit includes attack cases.
  3. Reproducible results / proof of value, not demos. verify.py --live re-runs every claim from the buyer's machine.
  4. Latency and false-positive figures. Measured round trips per claim; known misses on each limits page; no rates we haven't measured.
  5. Independent red-team / pen test within 12 months, often against the OWASP Top 10 for Agentic Applications. Not done by a third party yet; we say so.
  6. Certifications and their scope (SOC 2 Type II, ISO 27001, ISO 42001). None held; we say so.
  7. Tenant isolation, subprocessors, training on customer data, data flow. Partial evidence; per-customer written answers.
  8. Kill switch / stop time and human oversight. See Swarm Fleet Quarantine and the Approval product.
  9. Model/version change control and a named owner. Answered per customer.

The three evidence pages each product has

  1. Evidence pack: one-paragraph figures, a ready email to an auditor, a short customer message, the links.
  2. Answers to buyer questions: the questions above, with YES / PARTIAL / NO / ASK answers you can paste into a questionnaire.
  3. Figures & benchmarks: every number read from the signed transcript, as a table you can paste into a spreadsheet.

Start from the IHVRK list and open any product.

Sources