I'm speaking at theISC2 Security Congress 2026

Learn more

About
Services
Labs
Insights
Resources
Contact

Connect

eric@medoya.com
Pennsylvania, USA

Privacy

Home Services Insights Labs About

Subscribe to receive new insights

Subscribe to our newsletter

Medoya | Put AI Agents to Work, Safely

From our Insights

85%
of the time, AI coding agents ran an attacker's command planted in a fake bug report
Tenet Security vendor test, 2026
7 of 7
popular AI coding agents compromised through a malicious plugin update
arXiv preprint, 2026

Agents could save your team hours. Where do you start, and what could go wrong?

When a pilot stalls, it's rarely the model. Nobody owns it, nobody quite trusts the output, and nobody's sure what the agent can touch. We start with one workflow that matters to you, get it running in production, and make it safe enough to build on.

The risk isn't the model. It's what the agent can reach.

In May 2026, six national cyber agencies, CISA and NSA among them, said it plainly: keep agents on low-risk work and don't give them broad access. I agree. Every agent I build gets the access it needs to do its job, and nothing more.

Your agent reads web pages, tickets and logs. So can an attacker.

Attackers are already hiding instructions in live web pages, hoping an agent will read them and delete a database or send a payment. So I treat everything an agent reads as untrusted, and I design the workflow around that.

Sooner or later, your auditor will ask what your agents touched.

If you answer to SOC 2 or ISO/IEC 27001, you'll need to show what the agents changed, who reviewed it, and what data they saw. The good news: the guardrails that keep agents safe also produce most of that evidence.

When an agent does something it shouldn't, who stops it?

Many teams find out they have no off switch on the day they need one. Every agent I build can be paused, what it did is on record, and your team knows who to call and what to check first.

30 minutes. No deck, no pitch.

Tell me where you are with AI and what's slowing you down. You'll leave knowing the three biggest things in your way and a first step for each.

Book a free 30-minute call

Services

Start with a workshop or one workflow, and grow from there once it's working. Governance and security are part of each one.

Half or full day

Team Workshop

Your team learns to use AI agents on your own tasks, with good habits from day one.

Learn more→

3 to 4 weeks

First Workflow

The task that takes the most hours, handed to an agent and put into daily use.

Learn more→

3 to 6 weeks

Dev Team Rollout

AI coding agents used safely across your development process, from ticket to production.

Learn more→

2 weeks

AI Readiness Review

How your team uses AI today, what could go wrong, and a 90-day plan.

Learn more→

2 to 4 weeks

Agent Security Review

I test your agents the way an attacker would, then help you fix what I find.

Learn more→

3 months, then month to month

Fractional CTO

I join your leadership team part time and help guide your AI rollout.

Learn more→

Fractional CTO · AI agents, software delivery and security

Put AI agents to work. Safely.

Most AI agent pilots don't fail on capability. They stall in security review. I help you ship with the controls and evidence reviewers expect.

Contributor, OWASP Top 10
CISSP, CCSP and CDPSE certified
25 years building software in healthcare
Speaker, ISC2 Security Congress 2025,2026

Latest insights

September 21, 2026 · LLM Evaluation
A fast hallucination check that knows when it's unsure
September 3, 2026 · Agentic AI
Agent harnesses trust plugin updates. A study compromised all seven it tested.
August 14, 2026 · HIPAA
The HIPAA Security Rule overhaul is now a long-term action

Connect

Newsletter

From our Insights

Agents could save your team hours. Where do you start, and what could go wrong?

30 minutes. No deck, no pitch.

Services

Put AI agents to work. Safely.

Latest insights