Security

An agent that only applies published techniques is a checklist with a runtime. The offensive agents build the method for the target in front of them: they read the system, form a hypothesis about where its assumptions break, and construct the technique that tests it.

That means new detection logic for a specific stack, patterns synthesised for one codebase and used nowhere else, and tooling written for a single engagement and discarded after it. The output is a finding with a reproduction, not a severity label attached to a scanner result.

Organisations are shipping agents faster than anyone can review them, and the failure modes are not the ones application security was built for. The vulnerability is rarely in the code. It is in what the agent is permitted to do, what it is willing to believe, and which tool it will reach for when instructed by text it did not author.

The review covers prompt injection reaching a privileged action, over-broad tool and credential scope, context poisoning through retrieved data, unsafe autonomy in build and deploy pipelines, and the model supply chain behind all of it. This is the discipline with the sharpest demand and the least supply, and it is reviewed by a system that operates agents at scale itself.

Detection engineering, incident response and threat intelligence, run as standing capability rather than a project. Detections are authored from observed adversary behaviour, tuned against the environment they run in, and revisited as the surface changes.

Coverage does not lapse between reviews. That continuity is the product: an environment watched without interruption is a different risk profile from one assessed quarterly.

• Continuous discovery against a defined scope
• Pre-deployment review of agent systems
• Standing defensive capability