Necio Features

Masking of Sensitive Data

Detect exposed credentials, financial identifiers, and supported patterns of personally identifiable information (PII). Mask these values in reports, exports, telemetry, and browser evidence. Keep the context needed to investigate and the original grades.

Agentic Prompt Orchestrator

Describe your system and test objective. Generate security prompts with OWASP risk mappings, severity, grading criteria, and suggested fixes.

Multi-Agent Grading

MoA mode has several AI judges evaluate responses. Review their scores, agreement, confidence, and reasons alongside the final grade.

Jev Judge Beta

We are beta testing grading with Jev, a low-cost System-1 model. Jev reviews the same prompt and response on its own, without seeing the primary grade or the MoA reasoning, and reports where it agrees or differs.

Jev is an independent reviewer, never a grader: it does not change grades, scores, or analytics. When its verdict diverges from the primary grade, that disagreement is flagged so a human analyst can take a closer look.

Hallucination Verification

Check factual claims against available evidence. Deep Verification uses repeated judgments and majority agreement. Review unsupported claims, possible fabricated citations, and inconclusive results.

Claims that internal evidence cannot settle are checked against live web search, so a cited paper, CVE, or statistic that exists nowhere is flagged as fabricated rather than merely unproven.

Agent Containment Testing

Test whether an AI agent stays within the tools, data, and permissions you granted. Built-in agentic tests check for unauthorized tool use, attempts to disable monitoring or confirmation steps, and agents that keep acting after their access is revoked.

Current AI Attack Coverage

Use built-in or custom tests mapped to OWASP LLM and Agentic Top 10, MITRE ATLAS, and NIST AI guidance. Test prompt injection, data leakage, unsafe tool use, memory poisoning, supply-chain risks, and other model behavior.

Optionally ground new tests in live web search, turning an attack technique from this week’s research into a test prompt with its sources cited.

Verified Encodings & File Tests

Test encoded prompts with Base64, UTF-8 decimal bytes, or emoji steganography. Necio checks that each encoded payload decodes to the original prompt. Attach supported files to test attacks delivered through documents and images.

Scheduled Scans & Behavioral Drift

Set a scan schedule and compare responses across runs. Investigate confirmed changes in grades, risk, confidence, and behavior.

Maestro Adversarial Conversation

Run an adversarial conversation that adapts each test prompt to the target response. Choose a scenario, set an objective, and limit the number of turns.

Test Distillery model distillation resistance, prompt injection, secret exposure, tool misuse, goal hijacking, memory poisoning, and identity, delegation, or privilege abuse. Other scenarios cover social engineering, cyber assistance, high-risk advice, hallucination, reasoning, bias, and safety.

API, Web Chat & Agent Targets

Test LLM APIs, OpenAI-compatible endpoints, Vercel AI Gateway models, Microsoft Copilot, and web chat interfaces. Test bots and agents through Telegram, Discord, Slack, and Microsoft Teams, including OpenClaw and Hermes agents.

When a web chat blocks automated browsers, switch to Assisted Scan and send the prompts from your own browser, by hand or with the Necio Assist Chrome extension. Replies are graded, scored, and reported the same way.

SIEM Forwarding & Delivery Health

Send scan events to your SIEM over HTTPS or syslog. Test the connection and select the fields to forward. Check delivery status and receive failure and recovery alerts.

Reports & Evidence Exports

Download scan findings as HTML, PDF, CSV, or JSON. Export Maestro conversations and supported behavioral deviation reports. Reports include grades, confidence, reasons, and suggested fixes. Email delivery is optional.

Evidence for monitoring and review

Keep findings, behavioral baselines, incident history, and review records with OWASP, MITRE, and NIST references. Use these records to support monitoring and documentation. They do not establish compliance on their own.

Remediation and analytics

Review findings by severity, risk, and confidence. Use the suggested fixes to plan remediation. Track results over time in dashboards and reports.