Oktsec grew out of security research and open-source engineering. We build controls for the tools AI agents use, the actions they can take and the evidence teams need to review their work.
AI agents change what organizations need to secure. They can act across tools and systems, carry out tasks and pass work to other agents. Preparing for this requires clear limits on their authority, records people can verify and teams who understand when to intervene.
Our vision is a world ready to work with AI agents, with the security controls and practical skills to use them responsibly. Across industries and countries, organizations need both systems they can govern and people prepared to supervise the work they delegate.
Turn the permissions people grant into controls that hold when agents act. Our mission is to carry that authority across tools, systems and other agents: define the limits, enforce them at execution and preserve evidence people can verify.
Gustavo co-founded Brelo, a fintech startup in São Paulo, where he spent seven years as CTO developing and patenting low-level device-locking technology for loans secured by mobile phones. Today, he works full-time on Oktsec, drawing on that experience alongside his security research and open-source work.
Building Oktsec to help companies stay in control as AI agents gain access to more tools and systems. Oktsec checks actions against the team’s policies and keeps a verifiable record of each decision. Security assessments and dependency reviews help teams find weaknesses in the workflows they plan to deploy.
As Chief Product and Technology Officer, led product and technology in regulated financial services.
Spent seven years building Brelo in São Paulo, Brazil, working with the team on patented device-locking technology for mobile collateral lending.
Agree the scope and permitted tests first. Your team reviews the findings and decides which controls to adopt.
Start with one workflow. Explicit rules of engagement. Findings with executable evidence.
Enforcement stays in environments you own. No inbound requirement to run Oktsec Control.
Prove the path without escalating beyond the agreed scope. Keep a full trail after the run.
Use forms to describe the workflow. Do not include secrets, credentials, customer data or source code.
Explore the research, customer example and open source projects behind oktsec.
Read the attack analysis, reproduction methods and sources in the research archive.
See how Certuma combines agent assistance, policy checks and physician review.
Explore Aguara for dependency inspection and nanostack for structured development. How the projects fit together.
