defoai.

Security

The attackers have agents now. Find out what they would find.

Break-ins run by AI agents are no longer a research topic. In 2026 they reached government networks, retailers, banks and small online shops, at a cost of about $50 a time. DefoAI has built agentic AI for ten years. We turn that experience around: we probe your business the way an attacker’s agent would, with the latest models and our own tooling, and tell you plainly what to fix first.

Book a security check What changed in 2026

We assess and advise. Findings are yours. Nothing on your systems changes without your say.

What changed

Three numbers from this year’s news.

Every figure below names its source and its date. Several rest on a single report, and the briefing says so where that is the case.

4 days

Speed

In July 2026, AI agents ran 12 attack waves against Taiwan’s government: 21 systems mapped, 85 accounts compromised, 2,564 personnel records taken, in about four days. The window between your exposure and someone finding it is closing.

Taiwan Ministry of Digital Affairs, Dream Security, via Tenable, 14 Aug 2026
$50

Cost

In October 2026 one person used an open-source agent framework against more than 1,200 websites and reached over 100 companies, Deere, SharkNinja and Cummins among them, for roughly $50 in tokens per successful break-in. Each took just under 23 hours.

The Hacker News, 20 Oct 2026, citing Reuters and NorForge
4 days to exploit

Patch window

A flaw in BeyondTrust was exploited within four days of its disclosure, and five more groups followed within seven. Zero-days exploited per month rose from 8 in 2025 to 11 in 2026, with 22 in August alone. Attackers read patches with AI, too.

Google Threat Intelligence Group, 30 Sep 2026.

What we check

Everything an attacker’s agent can reach. Including your people.

An agent does not care whether the way in is a router, a login page, a shared mailbox or a person in finance. Neither do we. Pick one scope or all four.

Physical devices

What sits at your edge and on your desks. Firewalls, VPN gateways and remote-support tools, routers, printers, badge readers, meeting-room kit, the laptops people take home. We look for what is reachable, what is out of date, and what still has its default password.

  • vpn gateways
  • firewalls
  • remote support
  • printers · iot
  • laptops · phones
  • office network
why now In October 2026, ransomware affiliates ran AI agents against about 62 organisations, getting in through FortiClient EMS, SimpleHelp, cPanel and VPN gateways from Ivanti, Citrix and SonicWall. SOCRadar via The Hacker News, 23 Oct 2026

Online services

What you run on the internet. Websites, shops, customer portals, APIs, login pages, cloud accounts and the storage behind them. We probe them from outside the way an attacker’s agent does: find a way to run code, find a way to stay.

  • websites · shops
  • portals · apis
  • login · sso
  • cloud accounts
  • dns · certificates
  • exposed secrets
why now The agents that reached 100+ companies in October planted web shell uploaders in shops, by chaining an old session store, unsafe PHP object handling and a dated framework. None of it was new. All of it was findable. The Hacker News, 20 Oct 2026, citing Reuters and NorForge

SaaS applications

What your business actually runs on. Your office suite with its mail, calendar and files, your CRM, finance and HR tools, file sharing, and the assistants you have switched on inside them. We review who can reach what, which apps were granted access and never revoked, and whether a planted document can make your assistant act.

  • mail · calendar · files
  • crm · finance · hr
  • oauth grants
  • assistants
  • sharing settings
  • mfa coverage
why now 44% of ransomware victims surveyed in 2026 said attackers exploited the victim’s own AI agents or systems. Your assistant is now part of your attack surface. Semperis via CBS News, 14 Oct 2026

Human processes

Who can be talked into what. Payment approvals, vendor bank-detail changes, password resets, access requests, the “urgent” message from the boss. We walk the process with you, then, with written consent and agreed limits, we rehearse the attack on it: a message, a call in a familiar voice, a request that almost looks right.

  • payment approvals
  • vendor changes
  • password resets
  • onboarding · leavers
  • exec impersonation
  • reporting path
why now Fideuram’s chairman got a WhatsApp message in his group CEO’s name, then a call in an AI-cloned voice of a lawyer he knew. 95 million euros left the bank. About 53 million has been recovered. Reuters, 25 Sep 2026, via Biometric Update

How a check runs

Four steps. The order matters.

Nothing is probed before it is agreed, and nothing is changed before you have read the findings.

  1. Scope, in writing

    Together we list what is in, what is out, who in your company knows, and when. You get a written authorisation to sign. No surprises for your IT provider or your staff.

    in · 2 edge devices, 4 saas apps, the payment process
    out · production database, anything destructive
    signed · tuesday, 2 weeks, 3 people informed

  2. Probe, the way they do

    We run the latest models and our own tooling against the agreed scope, the same class of agents the attackers use. Read only by default. Every action is logged, so you can see exactly what was tried.

    agents · recon, login surfaces, exposed secrets, dated software
    people · 1 agreed scenario, consent on file
    log of every action · yours to keep

  3. Report, ranked by reach

    Not a 200-page PDF. A ranked list of what an attacker’s agent reaches first, each finding with its evidence and its fix. One page for leadership, the detail for whoever will fix it.

    finding 1 · vpn gateway, 2 versions behind, reachable
    finding 2 · finance can approve a vendor change alone
    1-page summary · fix plan · walk-through call

  4. Fix with your team, re-test

    Your people or your IT provider make the changes; we advise and enable, and we can be onsite for it. Then we run the check again and show you what closed. Models change monthly, so a check from a year ago was done with last year’s attacker.

    fixes · 7 of 9 closed by your provider
    re-test · same scope, this month’s models
    2 remaining · ranked, with a date

Why DefoAI

We build the thing that is attacking you.

Experience

Ten years of agents in production

We have built agentic AI platforms and tools for ten years, our own products among them. We know what an agent can be made to do, because we make agents do things every day.

Tooling

The latest models, our own tooling

The attackers use frontier models and open-source agent frameworks. So do we, plus tooling we built ourselves. We update it as the models change, which is roughly monthly. Your check is done with this month’s attacker, not last year’s.

Plain language

A report a managing director can act on

Every finding says what it is, what it means for the business, and what to do about it, in that order. Your engineers get the evidence underneath. Nobody has to translate.

Talk to us

Not sure what you are exposed to? That is the point of asking.

Tell us what your business runs on and how big it is. We will tell you, plainly, what a check would cover, how long it takes and what it costs. Pricing follows the amount of work, and we come onsite if needed.

Write to [email protected].

What the check includes The 2026 threat briefing