Cyber Security
Security for systems that act autonomously, for plant and physical processes that were never designed to be networked, and for a cryptographic estate with a migration deadline attached to it.
What we deliver
Every engagement is scoped to your environment - deploy a single capability or the full stack.
Adversarial testing of AI features against the failure modes that are specific to them.
A control framework for AI systems that maps to recognised management-system and risk standards.
Let autonomous agents act without granting them unbounded reach.
Find where corporate data is leaving through personal AI accounts, and close it without banning the category.
Protect production on equipment that cannot be patched on your schedule and must not be interrupted.
Bring the unmanaged, unpatchable device population under policy without breaking what it does.
Begin the migration while long-lived secrets are still worth protecting, and make the estate agile enough to migrate again.
Be able to evidence an incident to an insurer, a regulator and a court without improvising.
Technical deep dive
Applies wherever AI agents have been connected to production systems - which increasingly happens on low-code platforms outside the change process, by teams who are solving a real problem.
What this is
An agent control plane. Every agent has a registered identity with a named human owner, receives short-lived credentials scoped to a declared purpose, and reaches enterprise systems only through a tool broker that authorises each call against policy. Every action is logged to the same place human actions are, and every agent has a stop control that does not depend on the platform it runs on.
The problem being solved
A support team connects an agent to triage tickets. To make it work quickly it is handed a broadly scoped API credential. It now reads mailboxes, writes to the customer system, calls a payments endpoint and can open remote sessions. It does not appear in the identity inventory, because it is not a person. It did not pass change control, because it was built on a platform the technology function does not administer. Nine more exist across the organisation. None has an owner recorded, a permission boundary, a spend limit or an audit trail that survives the platform's own retention. The agent is also a novel attack surface: content it retrieves is instruction-shaped, so a crafted ticket can redirect its behaviour.
Why it is hard
Reference architecture - step through it
agent:
id: agt-support-triage-01
owner: j.okafor (support-ops) # a human, always
purpose: "Classify inbound tickets and draft a first response."
blast_radius: tier-2 # customer data, no financial systems
platform: low-code-automation # registered even though IT doesn't run it
review: quarterly | on_purpose_change
credentials:
type: workload_identity # no static API key, anywhere
ttl: 10m
scope_source: declared_purpose # not the union of what it might need
issued_per: task
authorised_tools:
- tool: tickets.read
objects: {queue: [support-tier1], age: "<30d"}
- tool: tickets.comment
constraints: {visibility: internal_draft} # cannot publish unreviewed
- tool: crm.read
objects: {fields_deny: [payment_instrument, national_id, health_notes]}
- tool: kb.search
denied_tools: [mail.send_external, payments.*, remote_session.*, crm.write]
budgets:
model_spend_per_day: 40_usd
tool_calls_per_task: 25
objects_touched_per_hour: 200
on_breach: suspend + notify_owner
content_handling:
retrieved_content: tainted # a ticket body is data, never instruction
taint_rule: >
Instructions found in tainted content cannot expand scope, call a
denied tool, or alter budgets. Attempts are logged as INJ-ATTEMPT.
output_guards: [pii_egress, secret_pattern, external_link_rewrite]
human_gate:
required_for: [customer_visible_response, refund_suggestion, account_change]
context_shown: [object_ref, diff, tool_trace]
observability:
action_log: unified_audit # same store as human activity
behavioural_baseline: declared_purpose
alert_on: [scope_deviation, injection_attempt, budget_breach, off_hours_burst]
stop_control:
mechanism: revoke_at_identity_service # not the vendor console
effect_time: "< 10s"
authority: [support-ops-lead, security-duty-officer]Measured change
| Measure | Before | After |
|---|---|---|
| Agents with a registered owner | 0 of 10 | 10 of 10, reviewed quarterly |
| Standing credentials held by agents | admin-scoped, non-expiring | none - 10-minute, task-scoped |
| Tool calls authorised individually | 0% | 100%, via broker |
| Injection attempts detected and contained | invisible | logged, scope-bounded, alerted |
| Time to stop a misbehaving agent | unknown - vendor console | under 10 seconds, self-owned |
The agents kept working, and the team kept the productivity that made them build one. What changed is that each has an owner, an authority that expires, and an investigation path that answers what it did and on whose behalf.
Schedule a free consultation and our team will connect within 12 hours to understand your environment and map out the right approach.
We respond within 12 hours