How Capchase stays secure with Superagent
Serving Fortune 500 companies, Capchase uses Superagent to secure its software and production AI agents.
Daniel Füvesi, Lead Engineer, Capchase
Read the video transcript
Because of the amount and speed of changes, it's becoming a tremendous challenge to oversee all the changes. So there is an increasing need to automate security checks.
At Capchase, we leverage Superagent end to end, as it provides tools and services starting from the coding agents, through PR scans, all the way to agentic workflows running in production and monitoring thereof.
At Capchase, we process a lot of external documents, for instance financial documents, so it is important to scan them. We use Superagent capabilities to run these data sources through their context guardrail system to ensure their safety.
What I found is that Superagent takes the entire process into consideration, not just part of it, and provides solutions holistically.
The key motivation for using Superagent is to allow us to focus on what Capchase does well, and go to sleep at night thinking that, in this area of increased threat level, we are safe because Superagent is there to provide the necessary support.
Capchase provides financing for enterprise technology deals, serving Fortune 500 companies and their customers, including CDW and Insight. Its platform lets buyers pay over time while software and hardware vendors get paid upfront.
The company has secured more than $1 billion in combined debt and equity financing.
Its team uses AI to build software and automate financing workflows. Superagent helps secure both the software it ships and the agents running in its product.
More AI work meant more security checks
Capchase has built a team of specialized AI agents that works across engineering and the business. In engineering, those agents help take features from planning through to production.
That creates a review problem. More work gets done, but people still need to understand the changes and decide what is safe to ship. For Daniel Füvesi, a lead engineer at Capchase, security checks need to keep up with that pace.
"Because of the amount and speed of changes, it's becoming a tremendous challenge to oversee all the changes. So there is an increasing need to automate security checks."
Daniel's approach combines automation with earlier human judgment. He wants useful feedback closer to the decision being made, so problems can be addressed while the work is taking shape.
Checking code before it ships
Capchase uses Superagent with its coding agents, through pull request review, and into production. During development, that includes PR Security and Secure Dependency Updates.
These checks help the team find security issues in code changes and assess the dependencies its software relies on. Superagent also supports monitoring of agent workflows running in production.
For Capchase, this means security checks are part of how the team develops and runs its software. They cover the work of both its engineers and its coding agents.
Protecting the agents inside the product
Financial documents are one of Capchase's main examples. Customers upload them from external sources, and the customers themselves may have received them from somewhere else. Capchase cannot assume that the content is safe because it arrived through a customer.
The documents can also be used by downstream systems later. A malicious instruction in one file can therefore affect more than the first step that reads it.
Capchase runs these documents through Context Guardrails before its agents use them, checking for prompt injection and other unsafe content. The checks also cover emails, messages, files, and URLs.
Sending findings to Capchase's own agents
Capchase uses its own AI agents to follow up on findings from Superagent Red Team runs.
When a run produces new findings, Capchase's agents are notified. They triage the findings, investigate whether the issues can be reproduced, and gather evidence. The workflow includes human review and can lead to a fix.
This connects the security work to the agents already doing engineering work at Capchase. The findings enter the team's own process for investigating and addressing issues, with people involved in the decisions.
More time to focus on the product
Capchase is a fast-moving team. It cannot research every new security threat itself while also building its product. Working with a team dedicated to security lets its engineers focus more of their attention on the business.
Daniel values Superagent's coverage across development and production.
"What I found is that Superagent takes the entire process into consideration, not just part of it, and provides solutions holistically."
As Daniel puts it, the motivation is to "allow us to focus on what Capchase does well."
