VectorCertain LLC today announced validation results demonstrating its ability to detect and prevent credential exfiltration before execution across large-scale adversarial testing. The validation, part of the company's MYTHOS Threat Intelligence Series, tested 1,000 adversarial scenarios across seven sub-categories of credential theft, including HSM key extraction, SWIFT token compromise, and bulk credential harvesting.
According to VectorCertain, its SecureAgent governance pipeline achieved 100% recall, detecting and preventing all 839 credential theft attempts before any credential left the governed environment. The system also achieved 97.5% specificity, with only four false positives across the 1,000 scenarios. The results were statistically certified at ≥99.65% using the Clopper-Pearson exact binomial method at 99.7% confidence across the full 7,000-scenario MYTHOS validation.
The announcement comes amid rising concerns over AI-powered credential theft. The Verizon 2025 Data Breach Investigations Report, covering over 22,000 security incidents and 12,000 confirmed breaches, found that stolen credentials remain the number one initial access vector for the second consecutive year, accounting for 22% of all breaches. In the financial sector, the average cost of a data breach reached $5.56 million in 2025, with credentials compromised in 22% of cases, according to a report by Help Net Security and FS-ISAC.
VectorCertain's T5 validation tested seven sub-categories of credential theft: HSM key extraction, SWIFT token compromise, bulk credential harvesting, OAuth token and API key theft, session hijacking and token replay, environment variable and config file exfiltration, and credential forwarding and exfiltration. Each scenario was generated via Anthropic's Claude API and executed without pre-processing.
“Credentials are the atomic unit of financial crime,” said Joseph P. Conroy, founder and CEO of VectorCertain LLC. “The Bangladesh Bank heist. The UNC6395 OAuth attack across 700 organizations. The 2.3 million bank logins for sale on the dark web right now. Every one of these began with stolen credentials. SecureAgent's T5 validation tested what happens when an AI agent decides to harvest them. Eight hundred thirty-nine attempts. Zero credentials exfiltrated.”
The company emphasized that traditional endpoint detection and response (EDR) systems fail structurally against AI-powered credential theft. MITRE ATT&CK Evaluations Enterprise Round 7 confirmed 0% identity attack protection across all nine evaluated vendors, according to VectorCertain. In contrast, SecureAgent's internal ER8 evaluation achieved 100% identity attack protection across 14,208 trials.
VectorCertain's technology is protected by a 55-patent hub-and-spoke portfolio, with 21 patents filed at the U.S. Patent and Trademark Office. The company also offers a free Tier A External Exposure Report to help organizations discover exposed non-human identities, leaked credentials, and MITRE ATT&CK coverage gaps.
