Regtank Partners with FailSafe to Secure Against Agentic Attacks

Regtank provides KYC, KYB and AML compliance technology to regulated businesses, covering identity verification, corporate onboarding, ownership analysis and sanctions screening. In September 2026, Regtank engaged FailSafe to run an AI-assisted penetration test of its platform, combining frontier AI models with FailSafe's security engineers to assess how the application holds up against automated, agent-driven attacks.

The threat model has changed

Compliance platforms sit on some of the most sensitive data in financial services: passport and national ID scans, beneficial ownership structures, screening results, analyst case notes and the audit trail that regulators expect to be intact. Any one of these is valuable to an attacker. Together, they describe a customer base in detail.

Until recently, finding the weaknesses that expose this data took skilled people and time. AI agents have reduced both. An agent can read an application's front-end bundle, reconstruct its API surface, and test every route against every account it holds, repeating the process with modified inputs until something gives. Authorization gaps in multi-tenant, multi-role systems are especially exposed to this approach, because finding them is mostly a matter of trying every combination, which is exactly what an agent does well.

Regtank's objective was to have its platform tested by an adversary working at that speed and breadth, before a real one did.

Engagement scope and approach

FailSafe conducted a black-box assessment of Regtank's web application and backend API in a dedicated testing environment provisioned for the engagement. The work followed the OWASP Web Security Testing Guide (WSTG) v4.2 as its procedural baseline, with results mapped to the OWASP Top 10:2025.

FailSafe's testing agents carried out route discovery, authorization checks and input testing at scale, while FailSafe engineers directed the work, validated each result and decided where to stop. The assessment used accounts at several staff permission levels, so that every function and record could be tested from the perspective of each role and data-access scope the platform supports.

Areas under test included:

• Authorization and data scoping: whether each role and tenant boundary is enforced on every function and every record, including direct object lookups and administrative operations.
• Authentication and account recovery: login, multi-factor authentication, password reset and the abuse controls around each.
• Document handling: storage, preview and retrieval of KYC and onboarding attachments.
• Client-side security: how the analyst interface renders data supplied by onboarding customers.
• Platform exposure: third-party dependencies, diagnostic endpoints and management interfaces reachable from the network.

Evidence and verification

Agent-driven testing produces a high volume of signal, and its value depends on how carefully that signal is checked. Every finding in the Regtank report was reconciled against the engagement's event log before inclusion, so that each issue traces to observed requests and responses. Each finding carries a CWE classification and a CVSS v4.0 vector, and scores were recomputed from their vectors to confirm consistency.

The engagement was run non-destructively. Where confirming the full impact of an issue would have meant altering shared configuration or taking control of a real account, FailSafe established the underlying defect, documented the remaining steps for Regtank's engineers and did not execute them.

Remediation

FailSafe delivered a full report to Regtank's engineering team, with reproduction evidence, root-cause analysis and specific remediation guidance for each issue, along with the expected behaviour after a fix so that changes can be verified objectively. Regtank is working through remediation, and FailSafe will retest each fix as it is deployed. Details of individual findings will remain confidential until that work is complete.

Our clients rely on Regtank to verify identities, understand business ownership and manage financial crime risk. Protecting the sensitive data behind that work is central to the trust they place in us. Working with FailSafe has helped us better understand how our platform stands up to AI-driven attacks. Their combination of automated testing and expert verification gave our engineers clear evidence and practical guidance for remediation. We are now addressing the findings, with FailSafe retesting each fix to confirm it works as intended. That commitment to seeing the process through is how we continue to earn our clients’ trust.

Security testing for compliance infrastructure

For companies whose product is trust in their customers' data, a periodic manual test leaves long gaps between assessments while the attack tooling keeps improving. Regtank chose to measure its platform against agent-driven methods now and to build retesting into its remediation process.

If you operate compliance, identity or financial-crime infrastructure and want to understand how it performs against automated attackers, get in touch with FailSafe.