The world's first consultancy built only for agent security and integrity.
We start by telling you how many autonomous agents are running inside your organisation right
now, who owns them, what they can reach — and what it would cost you if one of them were
wrong.
Most organisations cannot answer the first question. Not because they are careless, but
because an agent is created in an afternoon by someone who is not in security, and nothing in
the building is counting. The census is the engagement — and it is usually the first
time anyone has seen the real number.
WHY THIS CONSULTANCY EXISTS
Where everyone competes
Other major players serve the Fortune 500 — €2M engagements, 6–18 month timelines
Generic AI-governance frameworks, not agent-specific architecture
No named attack surface, no crypto-native context
Product vendors will sell you a tool, not an answer
Where nobody is swimming
Organisations of 500 – 2,000 people — too big to improvise, too small for a €2M engagement
Already running agents in production, with no agent-security team
Over 60% of cyber-attack victims are smaller businesses; fewer than 14% have dedicated security staff
30% of organisations say they lack the specialist AI skills to judge any of this
SEVEN SERVICE LINES
Each one answers a question you can put to your board, and each one stands on its
own. None of them requires you to buy software first.
01
Shadow Agent Census & Costing
Discover every agent in the organisation — declared or not. Who owns it, what it can reach,
and what a breach through it would cost. You get a register and a risk-cost matrix.
€15,000 – €40,000
2–3 weeks · any sector
02
Agent Passport Programme
Every agent given a governed identity and a written mandate, so “who authorised this?” has
an answer before you need one.
€25,000 – €80,000
4–6 weeks · any sector
03
EU AI Act & DORA Readiness
Obligations enforcement began in August 2026. We map what applies to your agents, what
evidence you must be able to produce, and what is missing today.
€30,000 – €120,000
6–10 weeks · regulated sectors
04
Quantum Migration for Agent Identity
Agent credentials signed with classical cryptography are a long-lived exposure. We plan and
execute the move to post-quantum signatures.
€20,000 – €75,000
4–8 weeks · finance, CASP, health
05
Agent Red Team
We attack your own agents the way a capable adversary would — including stripping the
safety training from any open-weight model you self-host, to show you what that produces.
€35,000 – €90,000
3–6 weeks · any sector
06
Agent Governance Design
The written constitution: what your agents may do, who approves an exception, and what
happens automatically when one exceeds its mandate.
€25,000 – €70,000
4–8 weeks · any sector
07
Fractional Agent-CISO
For the 500–2,000 organisation that needs the judgement but cannot yet justify the hire.
A named person, a standing cadence, and continuity.
from €8,000 / month
retained · any sector
HOW WE WORK, AND WHAT WE WILL TELL YOU
We will tell you when you do not need us. If the census finds eleven agents, all owned,
all mandated, we will say so and invoice the census — not manufacture a programme.
We name what is partial. Where a control only partly covers a door, our own register says
partial, and you get it as it is.
Consulting is not a route into a licence you did not ask for. Every engagement produces a
deliverable you own. If it also shows that INTEGRITAS
BUSINESS would close what we found, we will say that plainly — and you remain free to close
it another way.
WHY NOW
Enforcement of the EU AI Act's general-purpose AI obligations began on 2 August 2026 —
and the regulator can require information, mandate mitigations, impose fines and
order a model recall. An organisation told to stop every agent running a named model has
to be able to do it, and to show that it did. Most cannot do either today. That is a
three-week census away from being a fact you know rather than a risk you carry.
CryptoShield AI BV · Amsterdam · adama@cryptoshieldai.ai SECURITY FOR AI AGENTS — NOT AI FOR SECURITY.
Market figures on this page are drawn from published research and are cited on request.
No client names appear anywhere on this site.