AI Insider Threat Defence

The most dangerous person in any regulated organisation is not the hacker on the outside. It is the trusted insider on the inside: the administrator with root access, the analyst with clearance, the operator with signing rights. They already hold the keys. When intelligence walks out of the building, it almost never does so through a broken firewall. It leaves through a legitimate login, a valid credential, and an action that looked, for one fatal moment, entirely authorised.

We built Mickai, our Sovereign Intelligence Operating System, to close that exact gap. The principle is simple to state and hard to defeat: no single human being, however senior, however trusted, can move intelligence alone. High-stakes actions demand multiple brains and a living voice. This is the architecture of insider-threat defence, and it is already built and running on hardware our customers own.

The insider is the threat the public cloud cannot see

Perimeter security assumes the enemy is outside. But the regulated boundary, the place where classified files, patient records, defence schematics, and market-moving data actually live, is defended against the wrong direction. A cloud provider can encrypt your data at rest and in transit and still have no answer when a privileged user of yours decides to exfiltrate it. The credential is valid. The session is legitimate. The egress looks like business as usual.

Cloud giants such as Microsoft, Amazon Web Services, Google, Oracle, and OpenAI are allies operating at a different layer, and they do their layer superbly. What they cannot do is cross into the customer's own trust boundary and adjudicate whether a single insider should be permitted to move sovereign intelligence. That adjudication has to happen where the data lives, on infrastructure the customer controls, with zero data egress. That is the boundary Mickai was built to hold, on the customer's own terms.

Multi-brain approval breaks the single point of failure

Inside Mickai, intelligence is not governed by one monolithic model. It is governed by a pantheon of specialised brains, each a revocable subsystem with a defined remit. When an action carries real consequence, whether that is exporting a dataset, decrypting an archive, or transmitting a document beyond the boundary, that action is never authorised by one brain and one human in isolation. It requires the independent assent of multiple brains, each evaluating the request against its own domain of policy, precedent, and risk.

This is a deliberate separation of powers. One brain understands regulatory constraint under frameworks such as the General Data Protection Regulation (GDPR), the EU Artificial Intelligence Act, and the Digital Operational Resilience Act (DORA). Another understands the classification and provenance of the specific intelligence in play. Another understands the behavioural baseline of the requesting operator. For the action to proceed, they must concur. A single compromised or coerced brain cannot wave intelligence through the door, because it does not hold the door alone.

Voice biometrics bind the action to a living human

Passwords are shared. Tokens are stolen. Sessions are hijacked. A credential proves only that someone once knew a secret, not that the person at the keyboard right now is who they claim to be. So for high-stakes actions we add a second, harder factor: the human voice itself, captured live and matched against an enrolled biometric profile at the moment of approval.

This binds the decision to a specific, present, breathing person. An insider cannot pre-authorise an exfiltration and walk away while a script completes it overnight. They cannot hand their credentials to a colleague to move the data on their behalf. The system demands a live voice, at the point of action, from a person whose biometric signature it already trusts. Combine that with multi-brain concurrence and the mathematics of collusion changes entirely: you no longer need to compromise one insider, you need to compromise several brains and a living voiceprint at once, in real time.

Every action is signed before it happens

Approval is only half of the defence. The other half is proof. In Mickai, every action generates an Operation Attestation Record (an OAR), and that record is signed before the action executes, never after. The attestation is not a log written once the deed is done. It is a cryptographic precondition of the deed being done at all. If the record cannot be signed, the operation does not run.

Those records are sealed with post-quantum signatures using the FIPS 204 ML-DSA-65 standard and chained together with SHA-3-512 hash-linking, so each attestation cryptographically depends on the one before it. The result is a tamper-evident audit ledger that cannot be quietly rewritten. An insider who moves intelligence leaves a signed, ordered, unforgeable trail of exactly which brains approved, which voice confirmed, and when. Deleting the evidence would break the chain, and a broken chain is itself the alarm.

Offline, air-gapped, and answerable to no one but the owner

None of this depends on a connection to us or to anyone else. Mickai runs on hardware the customer owns, air-gapped or on-premise, with zero data egress. The brains, the voice-biometric enrolment, the attestation ledger, and its verification all operate inside the customer's own boundary. The audit chain can be verified offline, by the customer, without trusting any external party, including us.

That matters enormously for organisations bound by the most demanding regimes: defence and dual-use work under International Traffic in Arms Regulations (ITAR), healthcare under the Health Insurance Portability and Accountability Act (HIPAA), financial institutions under the Basel framework, the Markets in Financial Instruments Directive II (MiFID II), and the Sarbanes-Oxley Act (SOX), and any body preparing for the Network and Information Security Directive 2 (NIS2), ISO 42001, or the NIST AI Risk Management Framework. For these organisations, intelligence that leaves the boundary is not an inconvenience. It is a reportable, sometimes criminal, event. The whole point of a sovereign boundary is that the answer to who can move the intelligence lives inside it, and stays there.

The capability is patented, not promised

This architecture is not a roadmap slide. Mickai holds 104 filed UK patent applications covering about 2,340 claims, owned by Mickai LTD, and among them are the primitives described here: attestation-before-execution, multi-brain adjudication of privileged actions, voice-biometric binding for high-stakes approval, and post-quantum, hash-linked audit chains. We frame our patents by the capability they protect, and the capability protected here is precisely the one that stops a single insider from moving intelligence alone.

The bottom line

Insider threat is not solved by trusting people harder or watching them more closely after the fact. It is solved by making the dangerous action structurally impossible for any one person to complete. Multiple brains must concur. A living voice must confirm. Every step is signed before it runs and chained so it cannot be erased. And all of it happens inside a boundary the customer owns, offline, answerable to no outside party. One insider, acting alone, simply cannot move sovereign intelligence out of Mickai. That is not a promise. It is the architecture, built and live.