Your agents are already in production. They make decisions, call tools, and delegate to each other. Passarel secures them at every altitude: the board conversation, the governance model, the identity they carry, the ones your staff brought in, the red team that tests them, and the incident when one goes wrong.
The software side of agent security took roughly $3.6 billion this year and is consolidating fast. What all that funding has not produced is anyone accountable for the whole problem. Six altitudes, six vendors, nobody owning the result.
Passarel is the services layer. One firm, one owner, from the board deck down to the breach.
The ladder
Directors are being told to expect an agentic breach and to ask what the company has done about it. That question needs an answer in governance language, from someone who has sat on both sides of the table.
What agents are allowed to do, who approves them, what authority they can pass on, and what evidence gets kept. Most organizations are deploying first and governing never.
Not a service account. A dynamic identity that reasons, delegates across domains, and leaves a chain of authority an auditor can actually follow back to the human who authorized it.
Shadow AI is the ungoverned version. BYOA is the sanctioned one, with the added benefit of not locking you to a single vendor. We discover what is already running, then write the policy that converts one into the other.
Prompt injection, tool abuse, delegation escape, and the paths that only open when one agent hands work to another. Continuous validation against the agents you have actually deployed.
Agents act at machine speed, so containment is its own discipline. Who revokes authority, how you reconstruct what it did and on whose behalf, and what the board hears on Monday.
Where to start
Most programs start at rung five, because it is the rung with evidence attached. Agent Control Efficacy is a fixed-scope assessment that answers the question your board is already asking: do your controls actually hold against your agents? You get an evidence-backed read and the whole story to put on the board's desk.
It also tells us which of the other five rungs you need, and in what order.
See Agent Control Efficacy →How we deliver
Every rung follows the same path. A fixed-scope assessment to establish what is true today. The curated partner stack where specialist product is the right answer. Passarel operating the rung once it is live, and staying accountable for it.
The alternative is six vendors for six altitudes and nobody who can answer the board when it matters. Quay handles the coordination so the engagement never stalls on scheduling.
Selected outcomes
Case study · Operator role · 2024–2025
Joined Pangea as Head of Business Development to lead the pivot to AI detection and response. Built the channel motion and partner ecosystem that positioned the company for acquisition. Eleven months later, CrowdStrike acquired Pangea for $260M as the basis of its AIDR offering.
Result: $260M strategic exit; product line became a named CrowdStrike offering.
Case study · Services P&L · 2013–2021
As Global Managing Director, ran the cybersecurity services P&L across Communications, Media, Technology, and Aerospace. Scaled the business approximately 100X through delivery modernization, automation, and acquisition integration. 1,800-person global org at peak.
Result: ~100X revenue growth; 1,800-person global org; multi-hundred-million-dollar services portfolio.
Case study · Operator engagement · 2026
Through Staris AI, ran continuous attack path validation against an 823,000-line proprietary platform. Surfaced 590 candidates, validated to 6 real, exploitable bugs with PR-ready patches in 7 hours 12 minutes. Shipped the same week.
Result: 99% noise reduction; zero false positives; engineering shipped fixes same week.
About
Steve Curtis led Accenture Security as a Global Managing Director, an 1,800-person practice across hundreds of programs, and ran ecosystems for Prisma and Cortex at Palo Alto Networks. He took Pangea into the AI detection-and-response thesis early; eleven months later CrowdStrike acquired it for $260M as the basis of its AIDR offering.
He isn't commenting from the outside. He's CRO at Staris AI, a board member at SDG, and a DDN-certified Qualified Technology Expert who advises boards alongside the Digital Directors Network. That spans the same ladder Passarel sells: the boardroom at the top, identity and offensive validation in the middle. Passarel is the firm he'd have wanted as a client. Trusted, opinionated, in it for the outcome.
Start with the question your board is already asking: do your controls hold against your agents? A fixed-scope Agent Control Efficacy assessment, board-ready in 90 days.
See Agent Control Efficacy →Or reach us directly: connect@passarel.com
What is Passarel? Who founded it? And how does an engagement actually run? Passarel is an agent security firm. It delivers services, backed by agents, to secure the AI agents an organization has already put into production. It covers six altitudes of the same problem: board advisory, governance, identity and delegation, BYOA, agent red-teaming, and agent incident response. One firm, one accountable owner, at every altitude. Founded by Steve Curtis and based in Newport Beach, California.
The software side of agent security absorbed roughly $3.6 billion in funding in 2026 and is consolidating rapidly, with Snyk acquiring Invariant Labs, Coralogix acquiring Aporia, and the major platform vendors bolting agent protection onto existing suites. The tooling market is crowded and confusing. What it has not produced is a single firm accountable for the whole problem across altitudes. Passarel is that firm.