Agent Control Efficacy
Your AI agents are the part no one does — in production, ungoverned, and exactly what the board is starting to ask about. We find what's running, test whether your controls hold, and hand you the whole story for the board.
The gap
You see the whole chain. You control a slice of it. Agents are the most ownerless part — stood up by product, by ops, by engineering, half of them never approved, none of them in your board deck. Knowing they're there was never the hard part. Acting takes authority you don't have until the board sees what you see.
That's the discipline gap. Agents are its sharpest edge.
The discipline gap, in full → SRA's Joe Cicero saw the same at Gartner →
What you get
What your board heard last quarter, beside what's true of your agents. Same company. Same quarter.
The board heard
The part with an owner.
ACE found
The part no one owns.
What it is
We measure whether the controls you already have work against the agents you're already running. Nothing to deploy. Quay runs the assessment, a human signs off on every finding, and the board gets the truth. Seven domains, each scored on whether the control works, not just whether it exists.
How it runs
Automation finds what is exploitable and proves it. Passarel decides what it means, what to fix first, and how to say it to a board. Neither half is worth much alone.
Phase 01
Establish a proven baseline across the agents you're running.
Proof
Tests your agents the way an attacker would and proves every finding with a working exploit. Days, not weeks.
Judgment
Frames each finding against your policies, your delegation model, and what the board is actually accountable for.
Phase 02
Turn proven findings into fixes, and into governance that holds.
Proof
Recommends the specific control and scope changes, then re-tests each one on demand to confirm it closed.
Judgment
Fixes the process behind the findings: who approves an agent, what authority it may pass on, what evidence gets kept.
Phase 03
Make agent security match the pace your agents actually change.
Proof
Re-tests on every release and flags new exposure as agents, tools, and permissions change.
Judgment
Embeds the new way of working into ownership and governance, so it outlasts the engagement and stays audit-ready.
Most firms stop at proof and hand you a findings list. The reason this ends in a board conversation rather than a spreadsheet is that Passarel sits at the top of the ladder as well as the middle.
Who's behind it
Steve Curtis ran Accenture Security as a Global Managing Director and took Pangea into the AI-detection thesis CrowdStrike bought for $260M. He is a DDN-certified Qualified Technology Expert who advises corporate boards alongside the Digital Directors Network, and he sits inside agent security as it is being built.
Specialist work runs on a curated bench. You buy one result from one firm, and Passarel owns the outcome.
What it costs
Snapshot
$9,950
One-time · 2 weeks · diagnostic
What's actually running and where it looks weak. Your agent inventory and a control-posture read across all seven domains, scored and handed to you.
No exploit proof. No remediation plan. No board deck.
Reserve the Snapshot →Program
$99K
Fixed fee · 6 to 8 weeks · Phases 01 & 02
Every finding proven with a working exploit, not asserted. The delegation and approval model rebuilt behind those findings, each fix re-tested to confirm it closed, and Steve in the room when it goes to your board or audit committee.
Scope it with Quay →Two ways in and one way to stay. The Snapshot tells you whether you have a problem. The Program fixes it and puts it in front of your board. Continuous keeps it fixed as your agents change.
Continuous
Phase 03. Re-tested on every release, new exposure flagged as agents, tools, and permissions change, governance kept audit-ready between board cycles.
from $8K/mo
Scope it with Quay →For comparison: a consultancy-led AI risk review runs $75K to $150K over 6 to 10 weeks and ends in a document. This ends in proof, a delegation model that holds, and a board conversation. You're pricing the outcome, not the hours behind it.
Most teams start with the Snapshot. No meeting to begin, no payment until you sign.
Quay scopes it with you — what you're running, where you're exposed, which tier fits. No meeting. A human reviews everything she finds. You sign when it's right.
Talk to Quay →Not ready to talk? Take the 2-minute self-check · or [email protected]