Trust is the new perimeter.

The human element is involved in 62% of breaches, and in 70% across Europe, the Middle East and Africa.¹ Generative AI made the lure cheaper. In 2019 the head of a UK energy company wired €220,000 after a call from what sounded like his boss at the German parent company; the voice was synthetic.² In 2024 an employee at Arup transferred HK$200 million after a video call with deepfaked senior colleagues.³ For 2025 the FBI counted US$893 million in losses from AI-assisted fraud.⁴

The counterexample matters as much. A Ferrari executive took calls from a cloned voice of his CEO, asked about a book the CEO had recommended days earlier, and the caller hung up.⁵ One trained person with one verification habit. It still works.

AI agents now read email, open documents, call tools and hold tokens. The Model Context Protocol for connecting them to company systems was released in November 2024,⁶ and a year later more than 10,000 public MCP servers were active.⁷

Agents inherit the human attack surface and add their own. Prompt injection tops OWASP’s list of risks for LLM applications.⁸ NIST showed hijacking attacks lifting success against a frontier agent from 11% to 81%.⁹ In June 2025 one crafted email could make Microsoft 365 Copilot leak internal data without a click.¹⁰ An agent with a token is a colleague with keys.

Under NIS2, management bodies approve and oversee cybersecurity risk measures, can be held liable for them, and must follow training.¹¹ Germany’s implementing act took effect on 6 December 2025, without a transition period.¹² The AI Act asks companies to ensure the AI literacy of their staff, supervised by national authorities since August 2026.¹³ For a machine builder in Augsburg, phishing training, AI use and agent oversight are now evidence a board must be able to show.

People and agents both receive messages, hold credentials and can be talked into the wrong thing. One tool for email, another for awareness, a third for AI use and a fourth for agents leaves exactly the gaps attackers walk through.

So Haldir sees who and what is acting, verifies what they are asked to do through a channel the attacker does not control, and controls what happens next: the lure is removed, the customer list is masked, the payment waits for its owner. We start with people and bring agents under the same policy and audit trail, hosted in Frankfurt and pseudonymous by default. Every decision shows its evidence and its owner.