How AKASEC Is Expanding Its Cybersecurity Capabilities with AI

What if a cybersecurity assessment that takes days could be completed in hours, without sending sensitive client data to an external AI service? HSD premium partner, AKASEC, is putting that idea into practice with a local AI agents designed to take on complex security tasks, accelerate assessments and give specialists more time to focus on the work that matters most.

AKASEC protects organisations against advanced digital threats by conducting Black Team and Red Team exercises that simulate real-world cyber threats. The AKASEC team has a background in the Dutch Intelligence and Security Services and specialises primarily in Living off the Land techniques to minimise the likelihood of detection. This enables its ethical hackers to move undetected through an organisation’s IT infrastructure in search of its most valuable assets; its ‘crown jewels’.

The company deliberately operates on a small scale, with a few permanent employees and a flexible network of specialists. But as demand for its services grew, AKASEC faced a familiar challenge: how to increase capacity without expanding the team. Its answer was to explore how AI could take on substantial parts of the workload while keeping human expertise and oversight at the centre of the process.

From an AI machine to a digital colleague

For AKASEC, adopting AI was not an obvious first step. General-purpose LLM models did not consistently deliver the accuracy required for complex cybersecurity work. There was also a more fundamental concern: using external AI services could mean exposing sensitive client information to systems outside the company's direct control. To address these challenges, AKASEC acquired a compact computer designed to run powerful AI models locally. Instead of relying on an external cloud service, the company could run local models on its own hardware, retaining greater control over how and where information is processed.

The real breakthrough, however, came with agentic AI. Unlike a conventional chatbot, which primarily responds to prompts, an AI agent can follow instructions, use digital tools, break complex assignments into smaller tasks and work towards a defined objective. This makes it possible to move beyond generating answers and towards carrying out practical work. AKASEC applied this approach to its own cybersecurity workflows and developed SAKA, the name for the team of local AI-agents. By incorporating the company's procedures and technical expertise into the agent's instructions, the team taught it how to approach tasks such as investigating an organisation's external attack surface, testing web applications and identifying potential signs of malicious activity with advanced threat hunting.

How SAKA works in practice

One of SAKA’s key strengths is external attack surface assessments. An organisation's external attack surface comprises the digital assets visible or accessible from outside its network, including internet-facing websites, servers and other systems. Mapping these assets helps cybersecurity professionals identify potential vulnerabilities and entry points that attackers might exploit.

When assigned an authorised assessment, SAKA follows a series of predefined instructions. It gathers information from relevant sources, connects related findings and breaks the work down into individual tasks, which it organises on a digital task board. Using the results, it prepares a report for a cybersecurity professional to review. Getting to this point took considerably more than installing an AI model and giving it a task. AKASEC spent months refining instructions, monitoring the agent's decisions and correcting mistakes. The process resembled training a new colleague: explaining how work should be approached, checking the results and adjusting the instructions whenever something went wrong.

That preparation is central to how SAKA operates. Its usefulness depends not only on the underlying AI model, but also on the procedures, technical knowledge and safeguards built around it.

From days of work to hours

The impact is measurable. According to AKASEC, an external attack surface assessment that would typically take a human team member three days or more can now be completed by SAKA in approximately four hours. The agent also changes when work can be done. It can continue operating overnight and at weekends, meaning tasks assigned at the end of the working day may be ready for review the following morning. 

These gains do not mean that cybersecurity assessments have become fully automated. Specialists still verify findings, assess the accuracy of conclusions and ensure that reports meet the required standards. The difference is that they no longer need to perform every step themselves. By automating substantial parts of the process, SAKA gives the team more time for complex analysis, strategic decisions and quality assurance. For a company that intends to remain small, this additional capacity matters. SAKA can also work on multiple tasks in parallel, helping AKASEC manage a growing workload without increasing its permanent headcount.

The result is a different way of scaling expertise: rather than expanding the team for every increase in demand, the company can delegate more of the repetitive and structured work to an AI agent while keeping people responsible for the outcome.

Why local AI matters

Efficiency is only part of the equation. In cybersecurity, the way information is handled can be just as important as the speed at which a task is completed. Security assessments can involve confidential client information, technical vulnerabilities and details about sensitive systems. Sending this information to an external AI service is often not appropriate.

By running AI models locally, AKASEC retains greater control over where information is processed. This approach also connects to the wider debate about digital sovereignty: the ability of organisations and countries to maintain control over their data, digital infrastructure and technological capabilities. Local processing, however, is not a guarantee of security in itself. Systems still require appropriate access controls, secure configurations and clear rules governing which information an agent can access and which actions it is permitted to perform.

These safeguards are especially important in cybersecurity. An agent must remain within the boundaries of an authorised assignment, with its access and activities controlled accordingly. The technology may expand what a small team can accomplish, but it does not remove the need for sound security practices.

The human expertise behind the automation

AKASEC's approach is built on a clear distinction: AI can carry out substantial parts of a cybersecurity assessment, but it cannot take full responsibility for the result.

SAKA does not replace the judgement and experience of a cybersecurity specialist. People must define the assignment, establish its boundaries, monitor the process and critically assess the findings.

As a result, the professional's role begins to shift. Instead of carrying out every technical step personally, specialists increasingly direct the process, evaluate the output and decide what the findings actually mean for a client's security. That shift makes technical expertise no less important. On the contrary, professionals need sufficient knowledge to recognise errors, challenge the agent's conclusions and determine whether its findings genuinely improve an organisation's security posture.

What other organisations may learn from AKASEC

AKASEC's experience illustrates how a small cybersecurity provider can turn emerging AI technology into a practical operational advantage. The key was not simply investing in powerful hardware. It was combining an AI model with established expertise, clearly defined procedures and continuous human oversight.

For the wider cybersecurity community, the implications extend beyond faster assessments. AI agents offer a potential way to increase productivity, make more efficient use of scarce specialist expertise and maintain greater control over sensitive information when models are deployed locally.