Local · hash-only · free forever, no account · Prompts never stored · runs on your machine · Publicly benchmarked · + activated installs outside the team
Beyond guardrails — behavioral, never signatures
Catch the moment an AI agent turns.
Antivirus, for AI agents. Except a hijacked agent looks exactly like a healthy one — same app, same permissions. Only its behaviour changes. So AariaSec learns what each of your agents normally does, flags the one that stops behaving like itself, and leaves you something an auditor will accept: proof of what your agents did, without keeping what they said.
Four words. The same four you will see in the sidebar.
Not a platform diagram. These are the product's own navigation groups, so what
we call it here is what it is called once you install it.
MONITOR
Find every AI agent already running — on this machine, or across your network from VPC
flow logs with nothing installed. Then learn what each one normally does: a hijacked
agent keeps the same app and permissions, only its behaviour changes.
Discovery · Fleet · Cost · Alerts · Threat intel
INVESTIGATE
Follow one agent session by session, tool call by tool call, with the score that
flagged it. Every critical alert is argued by three isolated models first, and opens
with one plain-English line that also goes to Slack, PagerDuty or your ticketing system.
ACT
Kernel-enforced scope on macOS, Linux and Windows — an out-of-scope connection is
refused by the kernel, not declined by a model. Windows passed 18 of 18 hardware
assertions on 2026-09-12. Enterprise-only, and it covers agents launched under
AariaSec's scope lock, not ones already running. Plus network policy and a kill switch — and, on every
plan, decoys: fake keys, services and tools that turn any touch into a CRITICAL alert.
Step through the real probes →
PROVE
A hash-chained record of what every agent did, and the SOC 2, ISO 27001, HIPAA or DORA
report your auditor asks for, generated from it. We don't hold those certificates — we
produce the evidence they ask for.
Patent-pendingbehavioral engine
Your infrastructure only— never ours
Prompts never stored— SHA-256 only
Verifiable builds— checksum every download
OWASP Agentic Top 10— all 10 risks mapped
The alert itself
The same detection. Written for whoever is on call.
Both of these are the same event. The one on the left is accurate and gets
overruled, because the person holding the pager at 2am is usually not the person who deployed
the agent.
This agent just sent 5.9 MB to an address it has never contacted
before. It normally sends about 2 MB, only to your GitHub.
It is holding your AWS deploy key.
Three parts, always: what it did, what is normal for it, and what it was
holding at the time. Generated from byte counts, hostnames and tool names — never from a
model, so it cannot invent a consequence, and never from your prompts, which we do not keep.
It reaches Slack, PagerDuty, Jira and your SIEM, not just the dashboard.
Try it — no install, no signup
Watch a guardrail miss it. Then watch us catch it.
A real slice of the AariaSec console, running on sample data right here in your browser. Run a session, and see the content firewall wave it through while behavior gives it away.
app.aariasec.local — demo · sample data
Launch the interactive demo
Click through discovery, the live catch, session replay, and enterprise onboarding — in about two minutes.
Catch an agentSession replayFleet onboardingCost layer
How it works
Live in three steps
Zero-instrumentation monitoring for your AI agent. No agents to rewrite, nothing to instrument. Point your AI traffic through AariaSec and it does the rest.
1
Connect
Install the app and route an agent with one line — HTTPS_PROXY. Discovery finds the rest of your AI apps automatically.
2
Baseline
AariaSec learns each agent's normal — tools, egress, timing, token rhythm — recognized from day one, fully baselined in about three days.
3
Catch
When an agent drifts or is hijacked, a Red/Blue/White panel returns a clear verdict and risk score (0–100) — full debate transcript included as evidence you can replay — and can contain it, automatically.
Why it's different
Behavioral, not block-lists
Most tools scan the words an agent sends. AariaSec watches how it behaves — so an agent that's been tricked, and still has all your access, gets caught. Signatures miss that. Behavior doesn't.
Most companies deployed their agents in the last eighteen
months and cannot say what one of them did last Tuesday. The usual answer is a guardrail: a rule
stating what the agent must not do. In August, an OpenAI agent told it had no internet access
reached Hugging Face over the network anyway. “You have no internet access”
turned out to be a sentence, not a boundary.
An agent behaves more like a teenager than a program. You
do not keep a teenager safe by lengthening the rule sheet — you learn what normal looks like
for that particular one, and you notice when it changes. That is applied behaviour analysis, the
clinical discipline one of our founders practises. The method came before the product.
✷
It learns each agent's normal
Tool cadence, egress targets, token rhythm — measured continuously, scored against its own normal, not a generic rule set.
⚖︎
A verdict you can defend
An independent AI panel argues both sides of every alert and returns a clear verdict with a risk score — not a black-box flag you're asked to trust.
↗
Catches drift, not just attacks
Agents don't only get hacked — they wander. AariaSec watches for the slow drift away from normal, not just one-off injection attempts.
🌐
Herd immunity for your fleet
When one deployment flags a bad agent, every other recognizes it on day one — collective defense, while only anonymous hashes ever leave a device.
$
See what your agents actually cost
An estimated per-agent token spend — including browser and web-app AI that never shows up on any bill. A sudden cost spike is often the first sign an agent has gone off-script.
🔒
Local & private by design
Nothing leaves your device but an anonymous hash — backed by a tamper-evident audit trail to prove it.
⛔
It stops the action, not just the alert
A response telling your agent to call a destructive tool gets a 403 before the agent ever receives it. Under scope lock, stepping outside the sanctioned scope is refused by the kernel itself — Landlock and seccomp on Linux, Seatbelt on macOS, AppContainer on Windows. Both are pre-execution. Neither depends on the agent cooperating.
The same idea, as geometry
Why a threshold cannot see this, and a baseline can.
A fixed limit is a sphere — one radius, every direction, blind to
orientation. A learned baseline is an ellipsoid, shaped by what this agent actually does.
An agent can drift well inside the sphere while walking far outside the ellipsoid: every permission
intact, nothing over any limit, and still not behaving like itself.
Fixed threshold · ‖x−μ‖0.00
within limit — no alert
Learned covariance · dM0.00σ
inside baseline
dM(x) = √( (x−μ)ᵀ Σ⁻¹ (x−μ) )
Σ is learned per agent, from its own history. Remove Σ⁻¹ and this collapses to a
sphere — that is the entire difference. Geometry, not a benchmark claim: measured numbers,
including the class we score worst on, are at
pramana.aariasec.com.
The record
Prove what your agents did — without keeping what they said.
Every regulation heading your way asks the
same question: show us what the system did. The obvious way to answer it is to
log the prompts — and then your evidence file is the worst thing you own. We never
had that option, because we never store prompt or response text at all. Which turns
out to be the only comfortable place to be standing when someone asks for records.
A record that cannot become a liability
Prompt and response text is reduced to a SHA-256 fingerprint at the
moment of capture. What remains is behaviour: which tools ran, in what order, how
much moved, where it went. The log is hash-chained — each entry carries the hash of
the one before it — so a missing or altered entry is arithmetic, not opinion.
There is no content in it to leak, subpoena, or breach.
That is why we can hand you the whole trail and why
our benchmark
corpus is public when a content-reading vendor's never could be.
The honest tradeoff: you get behaviour, not the literal text — which
tool ran, in what order, how much moved, where. If your incident process needs the
actual prompt content for forensic replay, or a regulated program requires content
logging, this architecture will not give you that, on purpose. Some organizations
will decide that trade is wrong for them, and that is a legitimate call to make
before you deploy, not after a breach.
What it produces, on your own hardware
EU AI Act, Article 12 — the logging & traceability record for
high-risk AI systems, generated from what actually ran.
GDPR, Article 22 — automated decision-making: which agent acted,
when, against what.
HIPAA Security Rule — audit-control evidence cited to §164.312(b),
§164.308(a)(1)(ii)(D), §164.312(c)(1), §164.308(a)(6)(ii) and §164.312(e)(1). ePHI
never enters the monitoring system, so the record cannot become the liability.
DORA — ICT risk-management evidence for Articles 10(1), 10(2), 17, 19 and
13(1), including the alert thresholds in force.
SOC 2 & ISO 27001 — control evidence assembled from real activity.
Incident forensics — the tamper-evident answer to "what did it touch,
and when did it start" that follows any breach.
OWASP mapping & SARIF export — for the tooling your security team
already runs.
Being straight about the boundary. This is a record of what your agents did and
a control to stop them — it is not a certification, and installing it does not make you
compliant. It produces the evidence the assessment asks for. We hold no SOC 2 ourselves
yet either, and the
security-review section shows that position control by
control, including the three that are only partial.
How this fits
Where your existing security tools stop.
An AI agent that has been tricked is still using access you deliberately granted it.
Every control below is doing its job correctly and still cannot tell you that happened.
What you have
What it decides
Why the agent slips past
Network firewall / SSE
Which destinations are reachable
The agent calls an approved LLM endpoint. Allowed, and correctly so — the destination was never the problem.
EDR / XDR
Whether a process behaves like malware
Same signed binary, same permissions, no exploit. An agent reading a file it has rights to is indistinguishable from normal work.
DLP / CASB
Whether content leaving matches a pattern
Requires reading the content. The agent's risk is a sequence of individually-authorised actions, not one document.
LLM gateway / router
Which model, which key, what it cost
Sees the traffic that was routed through it. Says nothing about whether the agent's behaviour changed.
Prompt firewall / guardrails
Whether a message looks malicious
Scans words. A hijacked agent's next request is ordinary text — the instruction arrived hours ago, inside a document.
AariaSec
Whether this agent is behaving like itself
Learns each agent's own baseline — tools, egress, timing, token rhythm — so an authorised agent doing something out of character is visible without reading a single prompt.
None of these need replacing. AariaSec covers a different question, and exports to
the stack you already run —
Splunk, Sentinel, Elastic, OpenTelemetry.
Coverage map
Every governance layer — and the one nobody maps.
Six layers is roughly where the industry has landed for governing AI. Here is the whole
surface, marked honestly — including the layer that is yours to decide, where we give you tooling rather than claim it, and a seventh row the frameworks leave out.
Click any cell for what does the work, how it gets green, and whether it is Free or Enterprise.Every cell is listed below, with what does the work and whether it is Free or Enterprise.
Layers · inner to outer
Covered — built and measured
Partly — real limits, stated
Yours — your decision, our tooling
Drag to turn · click a tile
01 Inventory 5 / 5
Derived from observed traffic, not a form someone filled in.
●AI system inventory
Every agent that talks to an LLM endpoint appears, whether or not anyone registered it. The list is built from traffic, so an agent nobody declared shows up the first time it makes a call.
The fleet view and Discovery build the list from traffic. Free
●Risk classification
A composite risk score per agent from five weighted sub-scores, plus a baseline risk derived from what that agent can actually reach.
The CVR score on every agent. Free
●Ownership & roles
Whoever registers an agent owns it; an admin can reassign it, and every change is audit-chained. An agent nobody owns is listed as a gap, not ignored. Alerts record who owned it at the moment they fired — not who owns it now.
The accountable-owner panel on each agent page, and the owner-gap list. Free · IdP-synced owners on Enterprise
●Model & tool registry
Declared tools beside observed tools. The gap between the two is the part worth looking at.
Each agent page: declared tools and models beside the ones actually seen. Free
●Usage visibility
Per-agent call volume, token counts and cost, priced against a versioned table so historical cost can be recomputed when pricing changes.
The Cost page: calls, tokens and spend per agent. Free · per-agent dollar caps on Enterprise
02 Deployment yours
Decided by you, before anything runs. We give you the tools to record, check and enforce those decisions — we don't make them for you.
◈Use-case selection
Whether an agent should exist at all is your judgement, not ours. What we give you is a register of approved AI use cases — purpose, owner, risk tier and the agents that serve each — approved by someone other than the person who proposed it. Any agent that no approved use case covers is listed as a gap.
Turns green in your deployment when every running agent is covered by an approved use case. Your AI decisions → Use cases lists the ones that aren't. Enterprise
◈Architecture choice
Which models and providers to build on is your call. Record it as an approved list — patterns like gpt-4o* or claude-* — and every agent using something outside it is shown, from what the proxy actually saw. Opt in to block and the proxy refuses those calls; your listed models keep working.
Turns green when your approved list is set and no agent is outside it. Your AI decisions → Approved models & providers. Enterprise
◈Deployment practices
How you ship is your process; we plug into it. A GitHub Action in your release job fails the release when an agent's live risk score is over your threshold — and fails closed when it can't get a score, rather than waving the release through.
Turns green when your release pipeline runs the AariaSec gate before an agent ships. Enterprise · the CI step needs an API key
◈Change control
Whether a change ships is your call; making sure a second person saw it is ours. A new model, a new LLM provider or a declared upgrade on an agent with a baseline is recorded for approval — flagged by default. Opt in to block and the proxy refuses the unapproved model on its first call until someone other than the requester approves it.
Turns green when change control is on and nothing is waiting unapproved. The Change control page. Enterprise
◈DevSecOps
Your pipeline is yours. What we add is policy as code: a fleet policy file in your repository, checked on every build. The check fails the build on a violation and names every rule in your policy it did not evaluate, so a pass never implies more than it checked.
Turns green when your fleet policy lives in version control and CI runs the policy check on every build. The Fleet policy page. Enterprise
03 Security & access 4 / 5
Blocked before execution, and enforced by the kernel.
●Identity & access
Agents are identified from headers, framework and traffic, and each is tied to an accountable owner. On Enterprise, owners come from your IdP — Okta, Entra or Google via SSO and SCIM — so when someone is deprovisioned, every agent they own is flagged at once and written to the audit chain. An agent's own Entra Agent ID is linked as a reference, not validated live.
Agent identity from headers, framework and traffic; owners on each agent page. Free · IdP sync and deprovisioning flags on Enterprise
●Data protection
Prompt and response content is never written to disk. What is stored is a SHA-256 hash and a byte count. PII is detected without retaining what was found.
Built into the proxy. Hash-only by construction, with nothing to switch on. Free · every plan
●Tool & MCP controls
Destructive tool calls are matched against a denylist and blocked before the response reaches the agent — not flagged after the fact.
The proxy's destructive-tool denylist, applied to every agent. Free
◐Access controls
An agent's network and syscall scope is derived from its declared manifest and enforced by the kernel — Landlock and seccomp, Seatbelt, or AppContainer. Two honest limits: it is Enterprise, and it only covers an agent launched under the scope lock, so it does not retroactively cover one already running.
Covered: the kernel scope lock, for agents launched under it. Missing for green: agents already running, or started outside the launcher. Enterprise
●Data integrity
Detection records are append-only at runtime. No normal code path can update or delete an alert, a verdict or a fingerprint.
Append-only detection tables. Architecture, not a setting. Free · every plan
04 Testing & monitoring 4 / 5
The centre of the product.
◐Pre-production eval
Your detection is tested before you rely on it: adversarial scenarios run through your own rules and baselines. The agent itself is not exercised before production — that is your eval harness, not ours.
Covered: Simulate. Missing for green: running the candidate agent itself. Eval here builds a starting baseline from a profile; it does not test the agent. Free subset · full suite on Enterprise
●Red teaming
Every serious alert is argued by three isolated agents — one prosecuting, one defending, one ruling — before a human sees it.
The debate panel on every serious alert: a local model in three isolated contexts. Free
●Runtime monitoring
Every LLM call from a routed agent is intercepted in-line on the host. Metadata only: the content is hashed and dropped in the same breath. What is not routed is Bypass detection's job, not this cell's.
The local proxy on each host. Free
●Drift detection
Each agent is scored against its own history across ten behavioural dimensions, plus the magnitude of the arguments it passes. A tool it is allowed to use, used at a size it has never used, is visible.
A behavioural fingerprint per agent, across ten dimensions. Free
●Incident response
Alerts carry a severity, a recommended action, a drafted remediation, and a record of who approved and executed it.
Alerts with a severity, a recommended action and a drafted remediation; containment and its approvals. Free alerts · containment on Enterprise
05 Human oversight 5 / 5
Shape and magnitude, never meaning.
●Decision review
Every verdict records its reasoning, both arguments, and the size of the disagreement between them.
Every alert page: the reasoning, both arguments, and how far apart they were. Free
●Escalation paths
Severity routes the alert — critical to the panel, medium to provisional, low to the log — and a human-required flag is set explicitly rather than inferred.
Severity routing, delivered to Slack, PagerDuty or email. Free
●Override authority
Containment and remediation require a named approver, recorded with a timestamp.
Containment and remediation approvals; decision rights say who may give them. Enterprise
●Output validation
Always: truncation, low entropy, and argument magnitude outside the agent's own range. Opt in to local content inspection and the output is also checked, on the device, for a credential, for the model repeating its own system prompt, and for injection instructions aimed at the next agent or tool. Only the verdict is kept. It is never checked for meaning.
The heuristics are always on. The content checks use the Local content inspection switch on the Compliance page, off by default. Free heuristics · content checks on Enterprise
●Accountability mapping
Agent to owner to organisation, resolved at the moment the alert fired rather than at the moment you read it.
The owner is recorded on each alert at the moment it fired. Free
06 Compliance & audit 5 / 5
Evidence an auditor can sample.
●Policy & decision rights
On Enterprise, you author decision rights here: for each consequential action — containing or releasing an agent, approving a deployment, reassigning an owner — choose which roles may take it, custom roles included. The server enforces it, a rule can only narrow access, and every change and every denied attempt is audit-chained.
Organisation → Decision rights. Enterprise
●Regulatory alignment
Rules carry an OWASP LLM reference and alerts map to OWASP ASI, so a finding lands inside a framework your reviewer already uses.
OWASP LLM and ASI references on every rule and alert; framework reports on the Compliance page. Free references · reports on Enterprise
●Audit evidence
Signed receipts for coverage, for data purges, and for every release gate. Evidence a Type II auditor can sample rather than take on trust.
The Proof page: signed coverage, purge and release-gate receipts. Enterprise
●Incident reporting
Findings export with their full evidence chain, content-free by construction.
Evidence exports for your SIEM, as STIX, CEF or OCSF. Enterprise
●Audit trails & logs
A SHA-256 chained audit log where an altered entry is arithmetic rather than opinion. It survives even the authenticated purge ceremony.
The hash-chained audit log, kept on every plan; the Audit page and its chain verifier. Chain on every plan · Audit page on Enterprise
07 Proof of coverage 5 / 5 · ours alone
Not in any governance framework we have seen.
●Independent observation
Four observers outside the interception path — DNS, TLS SNI, open sockets, and the macOS endpoint security framework. A collector cannot attest to its own completeness.
DNS, TLS SNI, socket and endpoint-security observers running beside the proxy. Free
●Bypass detection
A DNS query for an LLM host with no matching intercepted call is the signal. That is an agent that went around us, and it is recorded as exactly that.
Dual-path correlation raises a bypass alert. Free alerts · the Network egress view on Enterprise
●Signed attestation
Each session produces an Ed25519-signed receipt carrying a key fingerprint, verifiable by someone who has no reason to trust us.
The coverage receipt on each agent page; the Proof page collects them. Free on the agent page · Proof page on Enterprise
●Indeterminate reporting
When no independent observer was available, the receipt states that no claim can be made. Not 100 percent. Not an estimate. This is the code path most products do not have.
Part of the same receipt. Free
●Shadow discovery
The agents nobody registered are the ones that matter, and they appear the first time they make a call.
Discovery. Free
We would rather show you the blanks than round them up. The five blue cells are decisions, not
observations — which use cases, which models, how you ship and change things. Those stay yours. What we
add is the tooling to record each decision and hold the fleet to it, and each cell says exactly what turns it
green in your deployment. We would rather say that plainly than make a claim we cannot stand behind.
Why this is hard to defeat
A defense you can buy is a defense they can study.
The attacker only has to be right once and the defender every time. That asymmetry
is arithmetic and it is not moving. There is a second one, quieter, that has decided far more
breaches — and it is the one that moves here.
For thirty years the defense was also a purchasable artifact. You buy the
EDR. You fuzz the WAF. You test the payload offline until it comes back clean. Detection
content ships identically to every customer, so defeating it once defeats it everywhere,
and the attacker knows the defense perfectly before the first packet leaves.
There is nothing here to buy. What decides whether your agent is behaving is a
baseline learned from your agent's own traffic — the same software in every
deployment, a different boundary in every deployment. Our source would tell an attacker the
shape of the test and nothing about where the line sits for you. To find that out they have to
generate traffic through the sensor that is measuring them, which makes reconnaissance and
attack the same observable act. And there is no route around it: an agent cannot do anything
without calling a model, so the one interface it cannot avoid is the one we are on.
And evading it one agent at a time means not coordinating
The attacks that matter most do not spike. They sit inside each agent's
own normal — many agents each shifting slightly, in the same direction, at the same time.
Individually invisible; collectively obvious. No per-agent threshold separates that at any
setting, and tuning one harder only buys false alarms.
So AariaSec scores the fleet as well as the agent. To stay under that, an attacker
has to stop coordinating — which is to stop doing the thing they compromised several agents in
order to do.
What that is worth, on a benchmark we publish and do not win outright
Our benchmark is public, held-out, and scored against simple baselines that
sometimes beat us. On the coordinated multi-agent class a ~40-line longitudinal baseline
catches 10 of 10; we catch 8. We publish that. The reason we would still run in your fleet is
the other column:
A detector that cries wolf on one benign trace in six does
not survive contact with a real on-call rotation — it gets muted, and then it catches nothing.
We give up four detections to remove fifteen false alarms, and we would make that trade again.
See the full benchmark, including the classes
we lose →
Regulated environments
Built for places where the data cannot leave.
The reason AariaSec works in a regulated environment is architectural, not a setting:
detection runs on your own machine, and prompt and response text is reduced to a SHA-256 fingerprint
at the moment of capture. There is no content to export, subpoena, or breach.
Financial services · DORA
KYC and AML screening, fraud and claims triage, trade reconciliation — agents handling
customer money and customer data, watched without their prompts ever being written down.
DORA wants anomalous activity detected promptly and an incident record to hand over:
behavioural detection produces the first, the tamper-evident hash-chained trail is the
second, and the DORA report assembles
both against Articles 10, 17 and 19.
Healthcare & life sciences · HIPAA
Patient intake, clinical documentation, prior authorisation, coding and billing — agents
working on records you are accountable for. HIPAA's audit-controls requirement wants that
activity recorded and reviewable; ours is hash-chained and tamper-evident, and because no
prompt or response content is stored anywhere, ePHI never enters the monitoring system
in the first place. Air-gap mode switches off every outbound feature the product has.
Software & platform teams · EU AI Act
Coding and code-review agents, CI and deployment automation, internal tooling — the agents
with the most access and the least supervision. Article 12 wants logging and traceability for
high-risk AI systems: the evidence pack
is generated from real activity, alongside ISO 27001 and SOC 2 collectors that assemble
control evidence the same way.
Customer operations · GDPR Art. 22
Support and SDR agents — drafting and sending responses, scoring leads, updating
records, sometimes deciding what a customer sees next. GDPR Article 22 gives people
the right not to be subject to a decision based solely on automated processing
without meaningful human oversight. The GDPR report
reconstructs, for any agent and window, how many decisions were automated, how many
a human actually reviewed, and where customer PII entered the loop — generated from
what actually ran.
Security review & procurement
The answers your reviewer will ask for, before they ask.
Most of a security review is finding out what a vendor will not put in writing.
Here is the short version. The full position — including the parts that are not finished
— is on its own page you can send to whoever is doing the review.
SOC 2
Readiness assessed, audit not started. Our own control-by-control
review, not a third-party opinion: 12 of 15 criteria implemented, 3 partial, 0 outright gaps.
The full 15-criterion table names each remaining gap.
Data residency & retention
Your infrastructure only. No account, no cloud plane, no telemetry
of content. Raw event telemetry prunes on a configurable window, 30 days by default; alerts,
verdicts and the hash-chained audit log are never touched by that job.
Subprocessors
None. There is no cloud plane for one to sit behind.
Connection integrity & post-quantum
We verify the provider’s certificate, and we don’t downgrade
your post-quantum TLS. Both legs of the interception negotiate hybrid X25519MLKEM768,
gated by a test. Our own signing is still classical, so we are not CNSA 2.0 compliant and
don’t claim to be.
Enforcement
Pre-execution, at two layers. A destructive tool call is refused
with a 403 before your agent receives it, and a scope-locked agent is stopped by the kernel
before the syscall completes — Landlock/seccomp, Seatbelt, or AppContainer depending on
platform. Fail-closed if the sandbox cannot be established.
Known limits
Published, not buried. Our benchmark shows the attack class we
handle worst, and our platform notes list what a host-emplaced sensor cannot prevent.
Read the full security review →
· DPA, EULA & NDA, identity, air-gapped deployment, evidence generation,
NIST AI RMF mapping, deletion & exit, support SLA, and the 15-criterion SOC 2 breakdown.
Reviewing us and need something not listed?
Ask directly —
a real answer, including “we do not have that yet”.
For teams & enterprises
Fleet-grade control. Your data never leaves.
The free app secures the machine it runs on. Enterprise runs it across your whole fleet from one console — a single pane of glass that never takes your data to anyone's cloud. Prompts and behavioral data stay on each endpoint; the console only ever sees health, versions, and the anonymous hashes you consent to share. Straight about where we are: every capability below ships in the product today, but we're pre-revenue on Enterprise and taking on our first design partners now — direct access to the founders, and real influence over what ships next, not a queue behind existing accounts. What is signed today is three small-business pilots — agentic-orchestrator and real-estate verticals — running with ongoing check-ins, not one-time installs, with more in the pipeline. No enterprise contract is signed yet, and we would rather say that than blur a pilot into a logo.
See every enrolled install's health, version, and drift in one place. Push policy and staged version rollouts to a group, promote canary → broad, and roll back centrally — all without touching an endpoint.
🔭
Discover every agent from the wire, zero install
Spot AI agents on machines you haven't put an endpoint on yet — from VPC flow logs or a gateway proxy at the network edge — then one-click deep-inspect the ones that matter. An agent that never identifies itself is still named: we ask the OS which process owns the connection, so policy binds to it without its cooperation.
🔑
SSO, SCIM & custom roles
SAML / OIDC single sign-on (MFA enforced by your IdP), SCIM user & group provisioning that maps directory groups to roles, and org-defined custom roles with least-privilege permission sets.
🗄️
Fits your SOC stack
Stream detections to Splunk, Sentinel or Elastic, export fleet metrics and a trace span per alerted session to any OpenTelemetry collector, open tickets in Jira / ServiceNow, and bulk-export events & alerts to your own warehouse. Metadata only — never prompt or response content.
🛡️
Decentralized data, by design
Each install's management identity is kept cryptographically separate from the anonymous threat-intelligence it contributes. Enterprise-grade fleet manageability, with a privacy guarantee most EDR platforms can't make.
Watch how it works
Five short walkthroughs
Five clips, under four minutes total — see it work, then why it matters.
Questions
The questions a security team asks first
Does AariaSec read or store my prompts?
No. Every prompt and response is SHA-256 hashed at the moment of capture — the raw text is never written to disk, logs, or any database. AariaSec keeps behavioral fingerprints and metadata only, which is why it can run on sensitive workloads.
Can it actually stop an agent, or only tell me afterwards?
Yes. We're a firewall for actions, not addresses — a network firewall decides where an agent may connect, we decide what it may do, because we can read the tool call. On by default: a response that instructs your agent to call a destructive tool (delete_*, drop_*, wipe_*, and 17 more) gets a 403 before the agent ever receives it. At the kernel (Enterprise): an agent launched under AariaSec's scope lock runs inside Landlock+seccomp (Linux), Seatbelt (macOS), or AppContainer + Windows Filtering Platform (Windows) — stepping outside the sanctioned scope is refused by the kernel before it can happen, and fail-closed if the sandbox can't be established. Between watching and stopping: containment used to be all-or-nothing. You can now pin one agent's egress to an authorized exit, cap its bandwidth, or cut just the channel two coordinating agents share — both keep doing their real work while the shared channel closes. Without the certificate: a quarantined agent is refused at the connection itself, so containment works even in discover-only mode with nothing decrypted and no certificate installed. All three kernel tiers are now verified on real hardware — Windows completed its end-to-end run on 2026-09-12 (18 of 18 assertions, Windows 11 build 26100), which took six defects to reach, five in the product and one in the test harness itself. Four honest limits: the agent must be launched through AariaSec for scope lock, scope lock is Enterprise-only, proxy-level network containment fails open if its policy file is missing or corrupt, and bandwidth caps are applied by the proxy — there is no kernel-side shaping, so an agent that leaves the proxy is unshaped.
Which agents and LLMs does it support?
Any agent that reaches an LLM over the network — OpenAI, Anthropic, Google, Mistral, local Ollama, and the newer gateways/routers (OpenRouter, Azure OpenAI, Bedrock). Connecting an agent is one line (an environment variable); discovery finds the rest automatically.
A proxy on all my traffic — doesn't that mean you can see everything?
It runs entirely on your machine and binds to localhost only — nothing of yours is sent to AariaSec. Your agents' requests still go to their normal destinations; AariaSec sits in the middle just long enough to compute a SHA-256 fingerprint, then drops the raw content. The TLS certificate authority is generated on your device and its private key never leaves the machine.
All 12 questions →
· alert quality, containment, the learning window, deployment, and who is behind this.
Coverage you can verify
Do you see all your AI traffic?
Most tools assume they cover everything. AariaSec measures it — and shows you the gap. New AI gateways and routers (OpenRouter, LiteLLM, Azure OpenAI, Bedrock) quietly move agent traffic off the paths other tools watch. We detect them, flag any app pointed at an unmonitored one, and let you bring it under watch in one click.
Illustrative example
AI traffic monitored92%
Monitored — routed & inspected2 endpoints not yet monitored
Unmonitored gateway detected — api.openrouter.ai
Agent routed off-path — Custom LLM proxy
Open research
We publish what we find — including where we fail.
Two public artifacts, free to anyone. One documents how AI agents
actually break in the wild. The other measures whether a monitoring system would
catch it — ours included, and open for any other vendor's to be scored right next
to it.
Field Notes · VRITTANTA
How AI agents fail in the wild
A curated library of real-world incidents — prompt-injection
campaigns, agent breaches, espionage patterns — each mapped to the behavioural
rules that catch it and the controls we recommend. 25 incidents tracked
and growing. No login, free on every tier.
Every other agent benchmark scores the agent — whether it
can be jailbroken. PRAMANA scores the detector. It exists because our
architecture never stores prompt content, so the corpus is publishable where a
content-reading vendor's never could be.
We do not top our own leaderboard. On season v3 our
weakest attack class scores 0.71 recall (roughly 3 in 10 missed on that
one class) against a 4.6% false-positive rate (about 46 false alerts per
1,000 benign traces). Real gaps, published deliberately. To be precise about what these
numbers are: benchmark-corpus figures, not a demonstrated production rate —
real-world numbers on your own fleet may differ in either direction, and we
don't yet have data claiming they won't.
The live season's labels, the labeled dev split, real attack-class
names, and the trace generators are withheld on purpose, not to obscure the
method — publishing them would let anyone mint unlimited training data and
destroy the holdout. The scoring code and full methodology are open;
what's withheld is only the answer key.
Honestly, right now every row is ours — our detector plus
five baselines we built ourselves, because no other vendor has submitted yet.
That's a real, current gap, not a hidden one: if you build agent-monitoring
tooling, a helper script formats the submission for you — you run your
detector on your own hardware, we never execute submitted code, and losing a
column is worth more to this benchmark than another vendor claim would be.
python3 submit_helper.py --detector you:detect --name yourco
The detection method came out of clinical behavior analysis, not a security roadmap.
Two people build AariaSec. One spent seventeen years
shipping security into the enterprise infrastructure you already run. The other measures
behavioral change for a living — clinically, from observable behavior alone, without ever
reading a mind. That second discipline is why this product works the way it does.
Ajith Chandran
Founder · Engineering
Seventeen years at a Fortune 100 networking company, most recently technical lead on
the next-generation architecture for a $10B+ enterprise switching portfolio — the class
of equipment that is probably carrying this page to you.
Product security across that portfolio: hardware root of trust, FIPS
certification alongside government certification teams, secure-boot enablement, and
anti-counterfeit cryptographic validation. That work runs on one assumption — a device will
not tell you it has been tampered with, so you verify from the outside. AariaSec applies the
same assumption to AI agents.
Named inventor on five US patent filings in networking and systems, before the
223 claim families behind this product. MS Electrical & Computer Engineering,
University of Wisconsin–Madison. Earlier: patient-monitoring systems at GE Healthcare,
DVD+RW silicon at Philips Semiconductors, embedded ARM systems at Nalanda Telematics.
Liji Chalatil
Co-founder · Behavioral methodology
Clinical supervisor in applied behavior analysis, working with children on the
autism spectrum — behavior intervention plans and the daily measurement they depend on.
She holds a graduate certificate in Applied Behavior Analysis from
UMass Global and is a Registered Behavior Technician
certified by the Behavior Analyst Certification Board; the coursework and supervised-fieldwork
requirements for Board Certified Behavior Analyst (BCBA) certification are complete,
with the board exam next.
ABA is a field built on a constraint that should sound familiar: you never get access to
internal state. You cannot ask what something was thinking. You infer function from
what is observable and measurable, and the discipline has spent a long time making that
rigorous.
That is the same constraint a monitor operates under when it is forbidden from reading
prompts. She mapped the clinical toolkit — Functional Behavior Assessment, behavioral
momentum, single-subject design, inter-rater reliability — onto agent telemetry, and it
produced the claim family the detection engine is built on.
It is not a metaphor in a slide deck. It is in the schema: every alert carries an FBA
function classification (escape · access · attention · sensory), a 0–100 behavioral
momentum score, and an inter-rater reliability figure between the Red and Blue debate agents.
Those are column names in the product, not talking points.
She is also founder and CEO of Aaria's Blue Elephant, a 501(c)(3) running inclusive
programs for neurodivergent children — the applied end of the same discipline.
What that means for your vendor review. A two-person company is a legitimate procurement
concern and we are not going to pretend otherwise — no succession plan or key-person insurance
exists. What you get in exchange: direct access to the people who built it, a product that runs
entirely inside your perimeter with no runtime dependency on us existing, documentation deep
enough that the platform isn't locked in one person's head, and a benchmark that publishes our
losses next to our wins.
The full security-review posture — including what we do not have
yet →
We're hiring
Two engineers built the product. We're looking for the people who put it in front
of the teams that need it.
Open now: marketing and sales — the first commercial hires, working
directly with the founders. A security or infrastructure background helps. Caring that
every claim on this page can be checked matters more.
