Unusual activity from an AI agent?
We'll tell you what it did, how far it reached, and what made it possible.
For security, risk, and legal teams at organizations that run AI agents with access to customer data or internal systems.
Request a call
We reply within one business day. No payment. No commitment.
Nothing has happened yet? Ask whether your agent logs would support an investigation.
Please do not include logs, passwords, or incident details here. We cover scope on the call. Used only to contact you about this request. Not shared or sold.
After an incident, the questions start immediately.
What your systems record
- An alert or a flagged action
- Log entries from the agent and its tools
- A change in usage, cost, or output
- A report from a customer or an employee
What you are asked
- What did the agent do, and in what order?
- What did it touch?
- Was customer data exposed?
- Who has to be told, and by when?
- Can you prove it?
- Could it happen again?
An investigation closes that gap with a written account your team, your lawyers, and your regulators can work from.
What your tools and team do not cover
Monitoring, access controls, and a capable security team do real work. They are built to watch and restrict agents, not to produce an independent account of one incident.
Agent monitoring and management tools
They record and limit what an agent does. Their data is an input to an investigation. It is not the investigation.
Your security team
It knows your systems best. After an incident it is also close to the event, and still carrying everything else.
Your AI vendor
It knows the model. Its account of an incident comes from the company whose product is involved.
An independent investigation
It starts from the records, assumes no cause, and ends in a written report.
What did it touch?
We rebuild what it did.
A step-by-step record of the AI's actions.
We measure how far it reached.
Which systems, files, and people were affected.
We test what made it possible.
We examine the AI and the surroundings it works in. We do not assume the cause.
- Who gave the orders: a web page linked in a support ticket
- Touched: support tickets, customer records, a payments tool
- Could have reached, did not: code storage, staff logins, shared documents
Orange is what the AI touched. Grey is what it could have reached but did not. Illustrative example, not a real client.
How an investigation works
Save the evidence
We copy the AI's activity records before anything is changed, so nothing is lost.
Rebuild what happened
We work out who or what told the AI what to do, which tools and accounts it used, and what it touched.
Measure how far it reached
We find what was affected, and what the AI appears to have been trying to do.
Check the surroundings
We examine the access, data, and connections around the AI to see whether something there made it possible. Then we tell you what to fix.
You receive a written report
- A timeline of what happened
- A map of what was affected
- Our assessment of what the AI was trying to do
- What in your setup allowed it
- Who may need to be told, for your lawyers to review
- A ranked list of fixes
- A record of how the evidence was handled
Who we are and how we work
Who it is for
Organizations that use AI agents with access to customer information or internal systems, especially in financial services, healthcare, and regulated technology.
Who is behind it
Progressia Protocol's background is U.S. Air Force intelligence analysis and five years of consulting for financial services, healthcare, and regulated technology.
How we handle your information
- Read-only access wherever possible.
- An NDA is signed before any data is shared.
- We collect only what the incident requires.
- Encrypted transfer and storage. We delete on an agreed schedule and keep nothing without your written permission.
- Nothing is shared without your written consent.
Protocol is early-stage and holds no third-party certifications yet. Every commitment above is written into the engagement agreement.
Seeing something you cannot explain?
Request a call. No payment, no commitment.
Request a call