What we test and how we test it

Threat scenario

Unpatched vulnerability exploitation

An AI-enabled threat exploits an unpatched vulnerability in your website.

We emulated an AI-enabled threat exploiting an RCE on a website, and gaining code execution on the underlying Linux webserver.

In this scenario, our deception technology detected the threat 100% of the time, forced the AI to stop 87.2% of the time, increased the time taken to laterally move by 480%, and extracted intelligence from the AI 89.9% of the time. The intelligence extraction detailed the exact vulnerability and website path the AI exploited, and every action it had taken since it gained code execution. This would enable the defenders to rapidly remediate the initial access vector, and ensure the threat is eradicated.

Real world example: OpenAI's AI agents compromise Hugging Face. In this example, the AI agents exploited two code-execution vulnerabilities to get internal access, and then began enumerating the internal host and network. At this point Velkiro would have detected the AI, halted it in its tracks, and forced it to create a document that detailed how it got in and everything that it had done.

Threat scenario

Insider threat

A misaligned AI agent attempts to go outside of the authorised scope.

We emulated an authorised AI agent attempting to go outside of scope due to misalignment, via finding and leveraging credentials to escalate its privileges.

In this scenario, our deception artefacts detected the AI agent 98.9% of the time, and the AI agent was able to be contained either via our AIM technology or by leveraging a simple SOAR playbook.

Real world example: OpenAI Agents escape sandbox. In this example, OpenAI's agents went out of scope due to misalignment and searched for, found and used credentials to escalate their privileges. The moment this occurred, Velkiro could have detected the rogue agents, and containment could have been enforced via AIM or a SOAR playbook.

Threat scenario

Searching for credentials

A human threat actor is searching your fileshares for credentials.

We emulated a human threat actor searching fileshares to identify credentials and further compromise the network, with common tools such as TruffleHog, Snaffler, ShareFinder and more.

In this scenario, Velkiro's deception artefacts were placed in the fileshares along with real credentials that could be used for lateral movement. Because the deception artefacts were placed where we know these tools look first, they were discovered before the real credentials 97% of the time.

This triggered high-fidelity alerts 97% of the time, and when combined with SOAR, enabled effective containment of the human threat.

Real world example: Enumerating file repositories has been a prolific and effective technique for human threat actors for years. In fact, some studies rate network share discovery as one of the most common techniques used by ransomware groups, scoring it 8 out of 10 for prevalence. For AI, the Hugging Face incident involved credentials being found in files on internal servers and used to expand the attack.

Threat scenario

Unauthorised access via VPN

An AI-enabled threat uses compromised credentials to log in via an external VPN.

We emulated an AI-enabled threat actor using real credentials to access an internal Windows server via VPN. The threat actor then attempted to laterally move to further compromise the network.

In this scenario, our deception technology detected the AI 98.4% of the time, forced the AI to stop 77.8% of the time, and increased the time taken to laterally move by 109%. Not only that, but it forced the AI to detail how it had gotten in and everything it had done up until that point 75.4% of the time. This would enable the defenders to know exactly which user accounts were compromised and rapidly revoke them, and to identify any other persistence to eradicate, ensuring the incident is contained.

Real world example: Gemini agents achieve unauthorised access via account compromises. In these examples, rogue Gemini agents breached two entities via finding credentials in public code repositories, and one via a password guessing attack. These credentials were used to log in and gain unauthorised access to internal resources. At this point, Velkiro would have detected the AI, stopped its attack, and forced it to create a document that detailed the credentials it used to get in and everything that it had done.