Capability

Security of the agentic stack

Trust boundaries, egress, secrets and adversarial pressure across the whole agentic and GenAI landscape.

Non-human identity and least agency
Trust boundaries
Egress control
Adversarial testing of the whole path

The problem

Agent security is being discussed almost entirely at the model layer — jailbreaks, refusals, alignment — while the failures that actually land are ordinary. An identity scoped wider than its task. A tool that trusts its caller. Content that becomes instruction. Secrets reachable from a process that had no business holding them. These are decade-old failure modes, now driven by something that enumerates faster than any red team, never gets bored, and has no malicious intent to detect.

Where it breaks

Failure pointWhat actually happens
Over-scoped non-human identityAn agent inherits whatever its identity can touch. If the credential reaches ten systems, so does the agent, whether or not its task involves nine of them.
Tools that trust their callerA tool built for one internal service is now reachable by an agent that can be steered by text it retrieved. The tool's threat model was written before that was possible.
Content as instructionInjection is not a prompt-writing problem. It is what happens when the control path and the data path are the same path.
Egress nobody is watchingPrompts and retrieved content leave the boundary as an ordinary API call. Data-loss tooling built for email and file shares does not see it.
Secrets in reachA process that can read a config, an environment or a cache can spend anything in it. Short lifetimes and hard rotation are the only controls that survive harvesting.
Testing the model, not the pathRed-teaming the model tells you what it will say. The exposure is what the system will do — which is a property of tools, identity and egress, not of the model.

Standards and regimes named on this page were last checked against their primary sources on . Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.

The work

What this actually consists of

  • Non-human identity inventory and least-agency scoping — one identity, one task, bounded lifetime
  • Trust-boundary mapping across the agent, its tools, its retrieval path and its egress
  • Adversarial testing of the whole path rather than the model in isolation
  • Detection tuned for lateral movement and privilege escalation, which is where an agent incident actually shows
  • Rehearsed revocation: killing an identity mid-run, tested before the day it is needed

The test

Would anything you run today flag a service account that suddenly started moving between clusters? If the honest answer is no, that is the gap — and it is the gap that turned a sandbox escape into a breach.

Next step

Where does this sit in your estate?

The useful version of this conversation is specific — one workflow, one deadline, one thing you are not sure you could evidence. That is usually twenty minutes.