Agent Security · for South African financial services firms

Protect your client data from AI misuse, inside and out.

Staff use AI tools nobody approved, agents get more access than they need, suppliers holding your client files get breached, and attackers use AI for better phishing, fake client voices and prompt injection. The regulators hold you responsible, not the supplier.

Start with Phase 0

The first 10 hours of Phase 0 are free while the promotion runs: a first call, a confidential log and written findings you keep, with no obligation to continue.

What we do about it

We find every AI tool touching client data, attack it the way an adversary would, put the controls in, train your people, and leave an evidence pack mapped to POPIA, Joint Standard 2 of 2024 (cybersecurity and cyber resilience) and Joint Standard 1 of 2023 (IT governance).

The decisions in front of you

  1. Ban AI or allow it safely. A ban mostly drives it out of sight; the better choice is which tools are approved, for which work, on whose data.
  2. Which suppliers you trust with client files, and what you do on the day one of them is breached.
  3. Who signs off the evidence: your key individual, principal officer or board.

What firms ask us first

Will the testing disrupt the business?
No. We agree in writing what may be tested and when, a key individual signs the permission, and nothing is sent to your clients.
We're advice-only. Do the Joint Standards apply to us?
Often not as law, but they are a sound benchmark, and POPIA applies to every firm that holds client data.
We already have antivirus and a firewall.
Those guard the network. They don't show what an AI tool is allowed to read, change or send, which is what this package tests.
How much access do you need?
Temporary Microsoft 365 or Google Workspace admin access that you grant and can take back at any time.
What will it cost?
From R265 000 excl. VAT, for firms up to 25 people; larger firms get a fixed price in their Phase 0 findings. Your fixed fee is in your Phase 0 findings, before anything is built.

Who it is for

Advice practices and family offices
Staff pasting client files into ChatGPT, and payment or bank-detail changes that need a call-back rule.
Discretionary and administrative FSPs, insurers and fund administrators
Joint Standard evidence your board, principal officer or regulator can read.
Firms on Microsoft 365 or Google Workspace
A ChatGPT and Copilot exposure review: which files AI can reach that it shouldn't.
Fintechs running their own agents
An independent red-team of your production agents, run with your engineers.
Brokers and insurers
Voice-clone and fake-instruction fraud on claims payouts and bank-detail changes.

How it runs

  1. Phase 0 · Information gatheringA first call, your confidential log, an engineer at your office and written findings you keep.
  2. Phase 1 · DevelopInventory, data-flow mapping and red-team tests, ending in a ranked risk register.
  3. Phase 2 · ImplementLeast-privilege rework, approvals on risky actions, logging, an AI use policy and a call-back rule for payment instructions.
  4. Phase 3 · Hand overStaff training with simulations, a retest of every finding, and the evidence pack with a board summary.

How you know it worked

Every high-risk finding retested and closed, and the evidence pack signed off by your key individual, principal officer or board.

  • Fixed price in three phases: develop, implement and hand over. Paid in full when you accept the proposal, then released in equal set amounts across the timeline, like a construction project.
  • Code, prompts, accounts and documentation are in your company's name from the start of Phase 1.
  • The monthly run fee is optional and cancellable on 30 days' notice (Investment Models: 12-month minimum). Handover is built so you never need it.

Background reading: Webber Wentzel on Joint Standard 2 of 2024 · TechCentral: regulators on the MIP breach (25 Sep 2026)

Start with Phase 0

Three questions, then pick a time for a 30-minute first call. We tell you honestly whether Agent Security is the right fit, or whether you need anything at all.

  1. First call30 minutes, online.
  2. Your log10 minutes, private.
  3. Office visit3 to 4 hours with your team.
  4. FindingsYours to keep. One fixed price if it is worth building.
Start with Phase 0