The fastest way to know whether HookBus and CRE-AgentProtect Enterprise fit your organisation is to run them against one real workload for one working week. Scoped on Monday, installed by Tuesday, measured by Friday, decision the same day.
Every pilot is shaped around your data-handling posture, your deployment constraints, and what your DPO will sign off inside a working week. Three typical shapes, and we will agree the specifics together on day one.
HookBus and the subscribers install inside your environment. Real data flows only through a DLP-redacted envelope. No content, PII, secrets, or regulated data leaves your estate at any point.
HookBus runs on Agentic Thinking infrastructure. Zero PII, zero customer data. We run a set of pre-agreed synthetic scenarios your team signs off before Monday. No DPIA needed to start.
HookBus core and subscribers run in your VPC. Observability dashboards are served from a read-only shared surface. You retain data residency; we help you interpret the evidence pack in real time.
Whichever shape you pick, the exit criteria and the content scenarios are agreed together on Monday. No surprises Friday. No moving goal posts. If the pilot is a no, the exit is defined before the install.
Every pilot runs on the same one-week cadence. Every step, every artefact, every outcome is committed before we start.
90-minute kickoff. One workload, one publisher, subscribers and success criteria locked. Scoping document signed same day. Environment ready to install.
HookBus and the chosen subscribers go live in your environment. Publisher wired to the pilot workload. Dashboards accessible to your team. Smoke test on a non-sensitive event.
The pilot runs against real work. Daily 15-minute stand-up. Policy iterations in-flight. We tune and you watch. Evidence accumulates in the Auditor chain.
90-minute wrap. Evidence pack delivered. Success criteria scored line by line. Decision same day: proceed to purchase, extend one more week, or exit cleanly.
Every pilot starts with a short scoping document, completed together on Monday. Specifics are deliberately left open so your team shapes them; the fields below are what needs a decision on day one.
| Field | What we write in |
|---|---|
| Workload | One named publisher running against one named workload. For example: "Claude Code used by platform engineering team against internal infrastructure repos" or "an autonomous agent calling the treasury-settlement API in the dev environment". |
| Environment | Pre-prod, UAT, or production. On-prem, VPC, or air-gap. We match deployment to what your DPIA allows. Never production without an approved DPIA. |
| Subscribers enabled | Default bundle is Auditor plus DLP Filter plus CRE-AgentProtect L1. You add Session Memory, KB Injector, or CRE-AgentProtect Enterprise L2 if they apply. |
| Success criteria | Three to five measurable outcomes your team sets. "Every agent tool call produces an Auditor row" is a criterion. "We like it" is not. We score against these on Friday. |
| Data handled | What regulated data (PII, PHI, PAN, session tokens, credentials) the pilot workload may touch, and which DLP patterns to enforce. Signed by your DPO. |
| Security questionnaire | SIG Lite, CAIQ, or your bespoke vendor questionnaire. We return a completed response within 48 hours of kickoff. Reviewed by your security team in parallel with install. |
| Stakeholders | One engineering lead, one security or DPO contact, an executive sponsor. We name ours too: the founder runs every pilot personally. |
| Commercials | The pilot is free of charge against a signed non-binding evaluation agreement. Scoping-only MSA. Neither side is committed past Friday. |
| Exit ramp | If you decide no on Friday, we uninstall the following Monday, hand back the Auditor archive, wipe the HookBus volume. No claim on future business. The evidence pack is yours to keep. |
Examples. Your criteria will be your own. These show the shape.
The Auditor subscriber produces a row, hash-chained, for every PreToolUse and PostToolUse event on the pilot workload.
CRE-AgentProtect Enterprise deny-wins on a curated list of dangerous tool calls drawn from your own incident history.
DLP Filter redacts PII, PAN, and secrets on both tool_input and tool_result before any subscriber persists the event.
L1 and L2 decisions run locally. Your network-egress telemetry shows zero traffic to Agentic Thinking infrastructure during the pilot.
End-to-end latency from publisher emit to bus verdict for L1 policy decisions stays under 10 milliseconds at p95 under your pilot traffic.
The Auditor export is in a format your internal audit or external assessor can actually review. Not a dump. An evidence pack.
We say no to pilots that are not a fit. Saves both sides time. Here is how we qualify.
The five-day pilot carries no licence fee. You cover your own deployment infrastructure. We cover our time, the software, and the direct support. Non-binding on both sides.
If the pilot passes and you choose to proceed, HookBus Enterprise and the licensed subscriber bundle are sold on an annual basis. Typical engagement from £300,000 per year depending on scope.
If the Friday decision is inconclusive and both sides want more time, we run a paid second week against a narrower scope with revised success criteria. No further extension.
The whole point of a pilot is that the answer can be no. Here is what no looks like when it happens.
If Friday’s decision is no, we uninstall the next working day. HookBus and every subscriber we deployed are removed. Any persistent volumes we created are handed to you or destroyed to your preference.
The Auditor archive, the policy packs written for your workload, and the scoring sheet against the success criteria are all yours to keep. You can use them inside your own compliance programme.
No renewal, no right-of-first-refusal, no contractual follow-on. The scoping agreement terminates cleanly.
Thirty minutes with your engineering lead and security sponsor. What broke, what worked, what we should change. We use it to make the next pilot better.
Thirty minutes with the founder to agree whether a pilot makes sense, and what the scope looks like if it does.