SurfGuard: selling tools

Evidence for SurfGuard: 1. Evidence pack · 2. Answers to buyer questions · 3. Figures & benchmarks · 4. Selling tools · IHVRK kit · Learn it

The evidence is your best sales tool: a buyer can check it without trusting you. Press Copy on any box, fill in the [brackets] and send it, one person at a time.

What to send, and when

When	Send this
First message	A short personal note with the kit page
They reply, "show me"	The live demo on a call, using the script below
"Send it to our engineer"	The kit and the evidence pack
Security review or questionnaire	The answers page. Never upgrade a NO to a YES.
Finance or procurement wants records	The figures page and figures.tsv
Ready to go ahead	The hand-off below. The founder does the contract, price and setup.

Who to approach

Operations lead: Agents on the web.
Security lead: Injection via web pages.

Questions to ask them

Which sites?
Which actions?
Who approves?

30-second pitch

SurfGuard reviews a browser agent's plan before it runs and makes payments, deletions and account changes wait for a signed human approval.

We recorded 5 live checks, including 3 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.

Don't trust us. Check it: https://cainstudio.online/ihvrk-surfguard.html

First email

Subject: approvals for your browser agent's risky clicks

Hi [first name],

Browser agents can be steered by what a page says. SurfGuard reviews the plan first and makes
payments and deletions wait for a signed approval.

https://cainstudio.online/top25-surfguard-lab.html

The evidence: We recorded 5 live checks, including 3 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.
Check it yourself: https://cainstudio.online/ihvrk-surfguard.html

[your name], working with FIRME AI CORPORATION
[your postal address]
If you'd rather not hear from me again, just say so and I won't write again.

LinkedIn connection note (under 300 characters)

Hi [name], we gate browser agents' risky steps (pay, delete, account changes) behind signed human approval. Happy to demo.

One follow-up, three days later (then stop)

Hi [first name], 30-day pilot is $500.

Live demo call script

1. Show the normal case
   Do: Open https://cainstudio.online/top25-surfguard-lab.html and run: Sample session: Clean Read-Only Catalog Search
   Say: A browser agent's plan is checked before it clicks.

2. Now the attack
   Do: Run: Sample session: Unauthorized ACH Wire Transfer (Injected Webpage DOM)
   Say: A browser agent's plan is checked before it clicks.

3. Now the attack
   Do: Run: Sample session: Destructive Cloud Account Purge (Irreversible Action)
   Say: A browser agent's plan is checked before it clicks.

4. Let them check you
   Do: Send the kit link and ask them to run python3 verify.py --live on their own computer.
   Say: They don't have to take your word for any of this. That's the point.

5. Say the limit yourself
   Do: Tell them what the kit does not show.
   Say: Say it before they ask. It costs nothing and it earns trust.

When they push back

Other languages?

Word lists: a buy button in an unlisted language can pass. Say so.

Live page changes?

It reviews the plan, not the live page.

Why should I believe your numbers?

You shouldn't have to. Run the kit on your own computer: https://cainstudio.online/ihvrk-surfguard.html. It re-sends every request and compares the answers, using no code of ours.

What doesn't it do?

Written down here: https://cainstudio.online/top25-surfguard-limits.html

Are you SOC 2 or ISO certified?

No, we hold no certification. What we offer instead is evidence you can check yourself.

Has anyone independent tested it?

No third-party audit has been completed. The attack cases in the kit are our own. I'd rather tell you that now.

Who else uses it?

We are an early company. I can show you the product working and the evidence, not a customer list.

It found nothing. So we're safe?

No. It means none of its checks fired. It doesn't prove something is safe.

How much is it?

Sell SurfGuard as the $500 30-day pilot.

One-page summary (paste into a document or email)

SurfGuard
by FIRME AI CORPORATION, a California corporation

What it does
SurfGuard reviews a browser agent's plan before it runs and makes payments, deletions and account changes wait for a signed human approval.

The evidence
We recorded 5 live checks, including 3 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.
Recorded 2026-11-03. 5 live checks. Median round trip 66 ms including network; this is not a load test or an SLA.

Check it yourself
https://cainstudio.online/ihvrk-surfguard.html
Zip SHA-256: 353e901ba15cc387390585d2e3af71eca72ccbff91bd93e88b1dfb8a87a91d10
Signing key fingerprint: 1cacdfc1fc2024b6bb4f8fb02c7c80f4a57f44c5adb11c507190781b5d613de3
Run: python3 verify.py --live  (Python 3, no account, no code of ours)

What it does not do
Written down here: https://cainstudio.online/top25-surfguard-limits.html

What this is not
Not a third-party audit, a certification or a guarantee. No SOC 2 or ISO certification is held.

Contact
[your name], working with FIRME AI CORPORATION, [your email]

After the call: the proposal email

Hi [first name],

Thanks for your time. As discussed, here is what I suggest for SurfGuard.

What you told me: [their problem, in their words]

What we'd do: Sell SurfGuard as the $500 30-day pilot.

Evidence you can check before deciding: https://cainstudio.online/ihvrk-surfguard.html
Answers for your security review: https://cainstudio.online/evidence-surfguard-answers.html
Figures for your files: https://cainstudio.online/evidence-surfguard-figures.html
Limits: Written down here: https://cainstudio.online/top25-surfguard-limits.html

Next step: [date], [who]. The founder, Vincent Noriega, handles contract and setup.

[your name], working with FIRME AI CORPORATION
[your postal address]
If you'd rather not hear from me again, just say so and I won't write again.

Hand-off to the founder

To: vincent@firmeai.com
Subject: Lead: SurfGuard - [company]

Company: [company]
Person: [name], [job title], [email]
What they said: [paste their reply]
Evidence already sent: https://cainstudio.online/ihvrk-surfguard.html
Price mentioned: [what you quoted, or none]
Next date: [date]

The rules

Send each message yourself, one person at a time. No bulk lists and no automated sending.
Commercial email needs your real name, a real postal address and a way to opt out, and you stop when someone asks (US CAN-SPAM; many countries are stricter, so check yours).
Never change a number, invent a customer, or say certified, audited or guaranteed.
Only test a system the client owns or operates, after they confirm it in writing.
Your share is agreed in writing with FIRME AI CORPORATION before your first message (email vincent@firmeai.com). Nothing here promises income. Most messages get no reply; that is normal.