Security Agent
The Security Agent runs the security-ops routine most small businesses skip: quarterly access reviews that flag ex-employees and stale accounts, triage of suspicious emails your team forwards, password and MFA hygiene nudges, and monitoring of breach disclosures for the tools you actually use. It reports and recommends — it never remediates on its own and never touches production access.
Setup from CAD $2,500+ Care from $495/mo
What it handles
- Run quarterly access reviews across your accounts — who still has access to what — and flag ex-employees and stale logins
- Triage suspicious emails your employees forward and reply with a verdict and next steps
- Send password and MFA hygiene nudges to accounts that fall behind
- Watch vendor disclosure feeds and alert you when a tool you use reports a breach
- Escalate anything that looks like an incident to a human immediately, with the evidence attached
Where it stops
Anything that looks like a live incident goes to a human immediately. The agent never remediates on its own, never revokes or grants access, and never touches production systems — it reports, recommends, and waits for a human decision.
Can it lock someone out or fix things itself?
No, by design. It has read access, not admin control. When it finds a stale account or a live phishing attempt, it tells you what it found and what it recommends — a human makes every change.
What happens when an employee forwards a suspicious email?
The agent checks the sender, links, and attachments, replies to the employee with a plain-language verdict — safe, phishing, or unsure — and logs it. Anything it can't call with confidence, or anything that suggests an account is already compromised, escalates to a human right away.
What does it cost?
Boilerplate setup from CAD $2,500, plus Care from $495/mo. Compare that to the cost of one ex-employee account nobody remembered to close.
We're a small shop — do we really need this?
Small businesses get phished like everyone else, and the boring controls — access reviews, MFA, closing old accounts — are what actually prevent most incidents. The agent just makes sure they happen on schedule instead of never.
Which tools does it monitor for breaches?
We build the watch list from your actual stack during setup — the SaaS tools your team signs into. When a vendor on that list discloses a breach, you get an alert with what leaked and what to do about it.
Last updated: July 2026