Attack your AI before anyone else does. Show your examiner the proof.
Countersign runs adversarial campaigns against the chatbots and agents banks and credit unions put in front of customers, checks every answer against the institution's own fee schedules and disclosures, and turns the results into a dated, reproducible evidence pack for compliance, third-party-risk and exam teams.
Illustrative transcript against a fictional credit-union assistant. Not a real institution or a real result.
The bot talks to customers. The institution carries the liability. Nobody can show the testing.
Most banks and credit unions below $10B in assets license their chatbots from vendors. The vendor ships the changes. The institution's compliance and third-party-risk teams answer for what the bot says about fees, disputes and credit.
What actually goes wrong
Researchers turned a European bank's assistant into a phishing channel by sending it one bank transfer with instructions in the payment reference (blue41). A tribunal held Air Canada liable for its chatbot's misstatement (CTV). A financial chatbot that misstates an overdraft fee or a Reg E dispute timeline creates regulatory exposure, whoever wrote the code.
What we could not find, stated plainly
As of November 2026 we found no publicly confirmed case of a U.S. bank losing money or customer data through prompt injection against its own AI. The need today is anticipatory: liability, vendor oversight and exam readiness. Community-bank adoption also lags; one survey found 8% of community banks moving to enterprise-wide AI (American Banker).
One testing engine, three people who need the proof.
Countersign does not try to out-attack the big security platforms. It sells the evidence workflow regulated second and third lines need, and it ingests findings from other red-team tools as inputs.
The AI vendor
Runs Countersign against its product in CI or a sandbox. Gets attack-success rates with confidence intervals, finance-specific conduct checks and a dated attestation it can share with every FI customer.
The bank or credit union
Compliance testing and third-party risk get an examiner-format evidence pack, a viewer on their vendors' attestations, and checks of their own configuration: fee schedules, Reg E timelines, disclosures.
Fintechs and in-house builders
The same engine with CI hooks, a self-hosted runner so transcripts never leave their environment, and a dry-run proxy that tests what an agent tried to do without executing it.
Name the control, the attack, the result and the retest.
Register the target
Point the black-box harness at a vendor sandbox or test account, with the system owner's written authorization on file.
Load your policies
Upload the fee schedule, Reg E timelines and disclosures. They become policy-as-code: the ground truth the bot is checked against.
Run the campaign
Security suites (injection, leakage, NPI exfiltration, tool misuse) and conduct suites run N trials each, so results are rates, not anecdotes.
Fix and retest
Each finding carries reproduction steps and full replay context, so a retest can tell "fixed" apart from "noise".
Countersign the evidence
Scope, method, coverage limits, findings, remediation and trend across releases, mapped to NIST AI RMF, FFIEC, NYDFS Part 500 and OWASP.
A chatbot that resisted an attack once has not passed.
LLM attacks succeed probabilistically. Countersign reports each finding as an attack success rate over N trials with a 95% confidence interval. Try it: set how many times an attack was tried and how often it worked.
95% confidence interval (Wilson): 1.1% – 13.5%
Priced the way each buyer already buys.
Planned list prices from the business plan. No one is paying these today; they are projections to be tested with design partners.
Vendor Attestation
- Continuous testing in vendor CI or sandbox
- Shareable, dated attestation
- FI customers view it free
FI Compliance Assessment
- Annual assessment + quarterly retest
- Policy-as-code checks of your configuration
- Viewer on vendor attestations
- Examiner-format evidence pack
Fintech, Regional, Enterprise
- CI integration and API
- Self-hosted / VPC runner
- Agent testing via dry-run proxy (separate SKU)
A focused business first. A large one only if three things work.
Ending ARR under the plan's bear, base and bull assumptions. The base case reaches about $59M ARR in 2034. The bull case needs a standards position, expansion into insurers and other regulated industries, and an AI-inventory product to all work. The plan's own estimate of a seed investor's chance at a 30x return is about 2–3%.
Projection from model.json. Assumptions: segment logos, ACVs, churn and expansion per the plan, scaled by scenario multipliers.
Questions a model-risk committee would ask.
Does Countersign make our chatbot compliant?
Our chatbot is run by a vendor. Can we even test it?
Why not just use the red-team tool in our security platform, or open-source Promptfoo?
How do you handle transcripts that contain leaked customer data?
Which frameworks do findings map to?
Is this a real company with customers?
Run a sample campaign in the console.
Register a fictional credit-union assistant, pick attack suites, watch transcripts stream, and open the evidence report an examiner would see. Everything runs in your browser on sample data.