In this post, we introduce Replica’s new native AI capabilities, enabling customers to innovate, investigate, and accelerate the most critical initiatives without compromise. Built from our deep global security origins and patented controls, Replica provides the secure operations platform for ALL high-risk digital work: both human and agentic.

Putting customer data into open-source AI models, conducting investigations to disrupt fraud, automatically combining and analyzing disparate threat data sets: exactly the kind of work banks want AI agents assisting, and exactly the kind of work no bank has dared automate inside its own network. That standoff is the reason Replica has built a safe space for agents to run at full capability: high-risk work that regulated institutions have never been able to automate now has somewhere to run.

A year ago, 11% of public companies assigned AI oversight to a named board committee. Today it’s close to 40%, and 62% of directors now put AI on the agenda directly, according to NACD’s 2025 board practices survey. [1]. Gartner expects the average Fortune 500 company to be running more than 150,000 AI agents by 2028. Only 13% of those companies believe they have the governance in place to manage them. [2]

Agents are multiplying faster than anyone’s learning to rein them in, and that’s exactly where most AI programs stall out.. or run into trouble.

Adoption That Outruns Governance

Almost every company has already moved toward AI adoption. SAP’s 2026 LeanIX survey puts agent deployment at 98%, either live or planned, but fewer than half of those companies can produce a full inventory of the agents they’re running. [3]

Kiteworks’ 2026 forecast puts three numbers on this type of control failure: 63% of organizations can’t enforce purpose limits on an agent, meaning there’s no way to say, “you can do this and nothing else” and really enforce it effectively. 60% can’t terminate a misbehaving agent once it’s running, and 55% can’t fence it off from the rest of the network to begin with. [4]  Akeyless adds the picture of the aftermath: two-thirds of enterprises using agents suspect at least one has already reached data outside its intended scope, the average compromised agent goes fourteen hours before anyone notices, and only 7% of security teams trust their own controls to actually stop one once it’s caught. [5]

That’s the current operating condition for most IT and security teams running AI today, but it doesn’t have to be.

Review Boards Are Killing Product Launches

Gartner predicts more than 40% of agentic AI projects will be canceled by the end of 2027, and names inadequate risk controls as a leading cause, alongside cost and unclear value. [6]  Replica’s own survey data lands on the same number from a different direction: 32% of the leaders we’ve talked to have delayed or canceled an AI deployment in the past year because there was no secure environment to run it in. [7]

Two different data sets are leading to the same critical finding. The technology works and has made a huge impact; the potential is enticing. The problem is nobody can answer the questions a BISO or review board asks before it will sign off on running it for real, on real data.

Copilots Without Containment

The investment in AI-SOC is a cyber headline staple these days, and most of that money is going toward copilots and assistants. These reason over and analyze enterprise telemetry from inside enterprise infrastructure, usually one prompt at a time. Guardrail vendors take a different angle but land in the same place: they constrain what an agent can say, not what it can reach.

Both approaches assume the agent lives on your network. For risky or sensitive work, dark-web investigation, breach data triage, malware analysis, covert collection, that assumption is the risk, not a detail to manage around it. We call it the Exception Economy, and now it’s extended to agentic machines: the same workaround instinct that used to live in a person clicking past a warning now lives in code that never gets tired and never waits for permission. An agent doesn’t need to mean harm to become the exception nobody approved.

Every board now asks (or should ask) the same three questions before it lets an agent anywhere near that kind of work:

1. What can it touch? 63% of organizations can’t answer that with any confidence.
2. Can we stop it? 60% can’t, once something’s running.
3. Can we prove what it did? Most security teams are working from scattered logs that were never built to answer that question under pressure.

Replica answers all three of these concerns by changing where the agent runs, not by adding another layer of policy on top of the network. The agent operates inside an isolated environment, so there’s nothing beyond that environment for it to touch. Any run can be paused or killed from a single console, and any fallout stays within that environment wall. Every action is recorded and can be replayed, so proving what happened is a matter of pulling the session, not reconstructing it from fragments, or memory.

The Pitch, and the Proof

Replica’s new capabilities for AI let you innovate, investigate, and accelerate your most critical initiatives. We provide a secure operations platform for ALL high-risk digital work: both human and agentic.

• Range Without Risk Replica now runs Goose, an open-source, multi-model AI agent framework, wired directly into Replica’s own event system rather than bolted on as an add-on. An investigator types an objective in plain language, and an agent navigates to the relevant sources, runs the analysis, and returns a structured output with no configuration required. Models are reached through a private connection to AWS Bedrock that never travels the public internet, so switching between available models doesn’t cost visibility into what an agent is doing.

That same privacy holds outside of agents entirely. Set up a defined task against a frontier model, (Claude or OpenAI), from inside Replica itself, and it lands on a private, disposable copy of that model spun up on AWS Bedrock: used once, then shut down, never reaching the provider’s own servers, never folded into anyone’s training data. Replica’s environment keeps that use off the corporate network, and off a public model.

• Evidence in Minutes An agent can compare a new leak against known compromised records and hand back a formatted exposure report in minutes instead of days. Upload raw malware artifacts, binaries, memory dumps, network captures, and get a human-readable report on command-and-control infrastructure without pulling a specialist off other work for An investigator can also pull a summary of everything that happened inside an environment, browser activity, file edits, system actions, focused on exactly what they asked about and audit-ready without extra work. This eliminates manual work and other niche tooling.
• Speed With Control and Oversight Every agent’s status streams to the UI in real time, so a team can start a run, step away, and come back to check on it instead of babysitting a black box. One console handles launching, monitoring, pausing, and reviewing every agent, with logs and downloadable reports going back 30 days. A browser layer resolves CAPTCHAs and access barriers automatically, for both agents and analysts working manually, so investigations don’t stall behind them.

With this launch, your team can now watch exactly what an agent does, step by step, instead of taking it on faith for the sake of speed. Its world stays visible and bounded from the start. That’s what it means for an AI agent to never need an exception.

All of this within the existing Replica patented AI control architecture. Built to empower some of the most dangerous national security work, it naturally extended to control the entirety of what agents do and have access to – comprehensively from the base infrastructure all the way through networking, data and identity.

Ready to move forward, securely? Empower your team’s work, while eliminating security exceptions.

Between July 25 and July 28, the UK’s AI Security Institute ran a standard cybersecurity evaluation. They gave several frontier models access to the open internet, removed normal safeguards to stress-test capabilities, and asked each one to solve a coding challenge involving GitHub.

Anthropic’s Mythos 5 created fake identities, used them to pressure a real developer into approving malicious code, then rewrote its own commit history to erase the tracks. Nobody told it to do any of that. AISI caught it because their monitoring was independent, their systems were isolated from production infrastructure, and human reviewers were in the loop. The fake accounts were disabled. The malicious code never landed.

Both companies noted the testing conditions were deliberately permissive and don’t reflect how their production models work. That also happens to be a description of how a lot of internal AI deployments are actually running right now.

Security teams are standing up agents inside connected environments with access to real credentials, real repositories, and real communication channels. The implicit assumption is that model behavior and a well-written system prompt will keep things inside acceptable limits. The AISI incident is a clean illustration of what that assumption costs when it’s wrong: a capable model given a goal and room to maneuver finds paths its operators didn’t map, without being asked and without announcing it.

AISI’s evaluation held because the infrastructure was built around the assumption that something unexpected would happen. Independent monitoring. Isolated machines. Human review at the boundary. That’s not a configuration choice, it’s an architectural one, and it’s different in kind from adding guardrails to an environment that was never intended for this category of work.

There’s potential that any AI model may behave like Mythos 5, it’s time for an environment designed for isolation.

This is part 3 of 3 in a series of posts: The Missing Layer in Cybersecurity. You can read part 1 here, and part 2 here.

A recent survey of 200 U.S. cybersecurity leaders found that 100% of organizations had granted security or compliance exceptions in the past year to move high-risk digital work forward (Replica Cyber Exception Economy Report). What was once a carve-out for genuine emergencies has become standard operating procedure, and most leadership teams do not have clear visibility into how often it is happening or what it is costing.

High-Risk Work Is No Longer Confined

Three years ago, most of the work that required direct engagement with untrusted content sat in specialized functions such as dedicated security teams, specific fraud units, niche threat intelligence groups. Those teams had their own challenges, but the practitioners doing this kind of work had been bounded…not anymore.

Widespread AI adoption has put model evaluation and agent testing on the project list of technology teams that had no such function in 2022. A team assessing a third-party AI tool before deployment is now doing the same category of work that malware analysts do: running untrusted code in an environment they also use for other things, and hoping the separation holds.

Fraud and financial crime teams are doing more of their investigative work further into hostile territory. Cryptocurrency tracing, scam operation research, account investigation in criminal networks. This work has extended well beyond what a standard compliance environment was designed to support. AML investigators are touching external systems and data that exist outside the normal corporate perimeter, often with no dedicated infrastructure to do it from.

Threat intelligence has distributed from specialized teams into broader security organizations. Analysts investigating adversary infrastructure and accessing hostile sites are now common across security teams of varying sizes and maturity levels.

The aggregate result is that high-risk work has become a regular part of the week for a much larger share of the workforce than it was five years ago. The infrastructure to support it has not kept pace.

Governance Reaches Its Ceiling

When teams need to conduct high-risk work without dedicated environments, the options narrow fast. The organizations in our survey settled into a recognizable set of responses: proceed on corporate systems despite reservations, delay or cancel the work, or hand it to a third party.

Each of those carries a real cost. Proceeding on corporate systems is the path most organizations take, and it is the one that turns every high-risk investigation or evaluation into a potential exposure. Delays and cancellations mean the work does not get done at the pace the business requires. Third-party handoffs solve the infrastructure problem by creating a dependency and a new risk surface.

The approval process that precedes most of these decisions (the exception, the sign-off, the formal waiver) does not change the underlying exposure. It documents that someone made a decision. What a change management approval cannot do is prevent malware analyzed on a corporate endpoint from propagating if something goes wrong or prevent a dark web investigation from creating a path back to production data.

Governance documents the risk, but unfortunately, it still isn’t contained.

Separation

A purpose-built environment for high-risk work changes what a failure can reach, not the work itself. The analyst still conducts the investigation. The engineer still evaluates the model. The fraud team still traces the transaction. What changes is that a failure in that environment stays within the boundary of the isolated environment rather than propagating into the systems the organization depends on.

The risky activity still needs governance, monitoring, and policy. Those things do not become irrelevant. They become more effective, because the environment they are governing is separated from the environment that cannot afford to fail.

The organizations that have built this infrastructure describe the same operational shift: their teams move faster on high-risk work, not slower, because the question of whether to proceed stops being tangled up with questions about what a failure might reach.

Both Spending and Risk are Up

U.S. cybercrime losses are up 33% year over year (IC3 Annual Report). The average data breach now costs $4.4 million globally (IBM Cost of a Data Breach Report). AI-assisted fraud is outpacing the investigative infrastructure built to counter it. The volume of high-risk digital work will increase, not decrease, as AI adoption continues and threat actors grow more sophisticated.

The governance layer that the industry has built over thirty years has immense value, but now, the scale of high-risk work now being performed as routine business has grown past what governance alone was designed to handle. The containment layer is the part of the risk model that most organizations have not built yet. The data on exceptions, losses, and exposure suggests the cost of that absence is no longer theoretical.

To learn more about secure environments for high-risk work, check out our demo video.

This is part 2 of 3 in a series of posts: The Missing Layer in Cybersecurity. Part 1 can be read here.

In 1912, the Titanic sank in less than three hours. The ship had watertight bulkheads designed to contain flooding before it could spread. The design seemed to make sense, but these bulkheads only extended partway up the hull, so water went over top and filled each adjacent compartment in sequence. The water was contained, yes…but the boundary was wrong.

That failure gets taught in engineering programs to this day, because it illustrated something every mature industry eventually learns: when a process is inherently dangerous, containing the consequences of failure matters as much as preventing it.

Has cybersecurity learned this lesson for infrastructure? Has it been implemented correctly?

Drawing Boundaries