VectorCertain LLC today released validation results demonstrating that its SecureAgent platform can detect and prevent credential theft by AI agents before execution, achieving 100% recall across 839 credential theft attempts in 1,000 adversarial scenarios. The testing, part of the company's MYTHOS Threat Intelligence Series, covered seven sub-categories of credential theft, including HSM key extraction, SWIFT token compromise, and bulk credential harvesting.
The validation comes as the Verizon 2025 Data Breach Investigations Report identified stolen credentials as the leading initial access vector for the second consecutive year, with 22% of all breaches beginning with credential abuse and 88% of web application attacks involving stolen credentials. In the financial sector, the average breach cost reached $5.56 million, with credentials compromised in 22% of cases, according to Help Net Security and FS-ISAC.
VectorCertain's T5 validation tested scenarios generated via Anthropic's Claude API, never seen during development, and executed without pre-processing. The platform's SecureAgent governance pipeline blocked all attempts, including 143 scenarios targeting HSM key extraction and 143 targeting SWIFT token compromise. The system achieved 97.5% specificity, with only four false positives across the 1,000 scenarios.
"Credentials are the atomic unit of financial crime," said Joseph P. Conroy, Founder & CEO of VectorCertain LLC. "The Bangladesh Bank heist, the UNC6395 OAuth attack across 700 organizations, the 2.3 million bank logins for sale on the dark web right now — every one of these began with stolen credentials. SecureAgent's T5 validation tested what happens when an AI agent decides to harvest them. Eight hundred thirty-nine attempts. Zero credentials exfiltrated."
The company highlighted structural failures in existing endpoint detection and response systems against AI-powered credential theft, noting that MITRE ATT&CK Evaluations Enterprise Round 7 confirmed 0% identity attack protection across all nine evaluated vendors. SecureAgent's internal ER8 evaluation achieved 100% identity attack protection across 14,208 trials.
VectorCertain's validation also addressed the specific threat to financial institutions, where SWIFT-related attacks have affected over four-fifths of surveyed banks since 2016. The Bangladesh Bank heist, which used stolen credentials to issue fraudulent transfer requests totaling $951 million, exemplifies the pattern that SecureAgent is designed to prevent.
The SecureAgent platform uses a five-layer governance pipeline, including the HCF2-SG hierarchy that classifies credential infrastructure access as epistemically suspect, and the TEQ-SG trust score anomaly detection system. The company's technology is protected by a 55-patent hub-and-spoke portfolio, with 21 patents filed with the USPTO.
VectorCertain also announced a free Tier A External Exposure Report that discovers exposed non-human identities, leaked credentials, and MITRE ATT&CK coverage gaps for organizations, with no customer effort required. The validation results are part of a 17-part series focusing on Anthropic's Mythos threat vectors.
