Inventory & Discovery
Find every LLM endpoint, MCP server, vector DB, RAG pipeline, embedding model and fine-tune in your VPC. No agent install; log-based and traffic-based discovery.
Read the architecture →AI-SPM Platform for Discovery, Runtime Gateway, Scans and Audit Evidence
Nine subsystems on a shared inventory and findings timeline.
Discovery, runtime enforcement, adversarial scans, and evidence export read and write the same asset inventory, so a discovered endpoint carries through to the control-ID evidence an auditor reads.
11
Asset kinds discovered
LLM endpoints, tools/functions, AI applications, vector DBs, embedding models, fine-tunes, self-hosted models, model providers, RAG, data sources, prompt gateways.
3,201
Probe templates
OWASP LLM + Agentic + ATLAS-aligned.
10/10
Agentic controls probed
every OWASP Agentic Top 10 control has active probes.
7
Frameworks mapped
control-ID level, exported as PDF or JSON.
Nine subsystems, one asset inventory.
Each subsystem stands on its own, and all nine read and write the same asset records, event timeline, and finding history.
Runtime Gateway
Self-hosted egress agent with a DLP firewall. Policy ships as an Ed25519-signed rule blob. Prompts, completions, and tool args stay inside your trust boundary.
Gateway docs →Cloud AI Posture
Continuous posture scoring for hosted AI services across major cloud providers. Read-only role attestation covering drift detection, residency checks, IAM, encryption-at-rest, and AI service exposure.
Read the architecture →Adversarial Scans
3,201 probe templates across OWASP LLM, OWASP Agentic and MITRE ATLAS-aligned families. Verdicts come from deterministic checks that run inside our own infrastructure first; a single model judge scores only what they cannot settle, and every verdict records which tier decided it
View Sample Audit Evidence →Model Supply-Chain Scanning
Score any model from a public registry before you deploy it. Model card analysis flags pickle-format weight risk, license drift, missing safety evaluation, trust_remote_code, and EU AI Act Annex IV disclosure gaps - 50+ checks mapped to OWASP LLM Top 10 and NIST AI 600-1.
Read the threat model →Agent Config Poisoning Scan
Detect the repo-poisoning attack class before an AI coding assistant loads it: static, deterministic scanning of the configs those assistants trust - Cursor, Cline and Windsurf rule files, MCP mcp.json manifests, editor settings, agent hooks - for hidden Unicode (Trojan Source), remote command execution, credential exfiltration, MCP manifest poisoning, and human-approval bypass.
Compliance Mapping
Every finding pre-mapped to OWASP LLM Top 10, OWASP Agentic, NIST AI 600-1, MITRE ATLAS, EU AI Act articles, ISO 42001 Annex A and ISO 27001 Annex A controls. Twenty-five cross-framework overlaps pre-computed.
View control matrix →Findings + Reports
Cross-framework deduplication, attack-path graphs, severity routing, and PDF + JSON export with auditor-ready control IDs. Every finding lands in an append-only audit log with a stable schema.
View Sample Audit Evidence →AI Detection + Response
Runtime signals - gateway blocks, tool-chain anomalies, model drift, volume spikes - correlated into prioritized threats with closed-loop containment: revoke the agent or promote the pattern to a signed block rule.
Explore AI detection + response →How a scheduled scan produces evidence.
A deterministic three-stage pipeline runs on every scheduled scan. Each stage is independently auditable.
Probe
Adversarial prompts drawn from a library covering OWASP LLM Top 10, MITRE ATLAS, and bespoke probes you author. Probes carry the framework references they exercise.
How verdicts are reached
Each adversarial response is scored first by deterministic checks that run inside our own infrastructure; a response they cannot settle goes to a single model judge (OpenAI). A three-judge plus meta-judge panel is also built, in which the meta-judge resolves disagreement between judges; it ships switched off.
Evidence
Every finding is stamped with the framework control ID, severity rationale, and timestamps. PDF exports are auditor-ready; webhooks ship the same payload to Jira, Slack, or your SIEM.
How every response is scored.
Adversarial outputs are scored first by deterministic checks that run inside our own infrastructure, and a response they cannot settle goes to a single model judge (OpenAI) that returns a verdict, a confidence and a rationale. A three-judge panel of independent third-party LLMs with a meta-judge is built and switched off.
Prompt caching is aggressive (5-min TTL, ~90% discount). Judge runs use the Batch API where SLA allows for another 50% off.
Read the architecture deep-dive.
Threat model, rule-blob format, gateway deployment guide and a sample scan report.
Open the deep-dive →No email required. The deep-dive is a page, not a gated download.