AI Security
Your people are already using assistants you did not choose, and increasingly so are the tools on their machines — coding agents that read a repository, scripts that run at machine rate, MCP clients that call tools on their own. This sees every one of them on the wire: which service, used by whom, processing data where, sanctioned or not — then lets you decide who may use what, and inspects what leaves before it goes. On your own firewall, with the model that judges running on your hardware.
Assistants arrive without a procurement decision. Somebody signs up, somebody else installs an editor plugin, and the first honest answer to “which AI services do we use?” is a guess. You cannot write a policy for traffic you cannot name.
Every AI service seen in your traffic, with the vendor behind it, where it processes data, and whether you have sanctioned it. Seventeen provider rules cover the assistants and, separately, the coding agents — Cursor, Codeium, Windsurf, Tabnine and GitHub Copilot — plus a catch-all for anything else classified as AI. Nothing is installed on a laptop to get this.
A coding agent reading a repository, a script with a borrowed API key, an MCP client calling tools on its own — all three reach the provider your staff use, and a filter that knows only the destination writes the same log line for a person and for a loop.
Browser, SDK, agent, MCP or unknown — each gets its own action, and a different one per provider where that matters. On top of that: allow and block lists on the client, the tool names a request may carry, a rate limit per source, a request-size cap. The class is decided before the body is read, so a caller can be refused without inspecting a word of what it wrote.
The prompt is the leak. Source code, a customer list, a credential pasted in for convenience. And the answer is its own problem: an assistant can be talked into writing the instruction that does the damage.
69 content detectors in 8 groups — national identifiers from 22 countries, cloud secrets, personal and payment data, prompt injection, and eight for the instructions that turn an assistant into a tool against you: a script piped to a shell, a reverse shell, an exfiltration instruction, an attempt to talk an agent past its own guardrails. The response leg can be tapped too, where it marks and records and never blocks.
Unstructured text is judged by a language model running on your own hardware. No prompt, no upload and no excerpt is sent to a third party to be scored, which is the difference between a control you can put in a procurement answer and one that adds a sub-processor to it.
Classification always runs, so the inventory and the class are on the flow record from the first day and you can see what is already out there before you decide anything. The controls are a separate switch, off by default, set per policy group.
All five of these reach the same AI provider within a minute of each other. Only one of them is a person.
chromesends a browser's own headersAllowedpython-httpxSDK transport announces itselfLoggedclaude-codetool results fed back to the modelLogged with tool namesmcp-clientJSON-RPC frame, method tools/callread_file deniedspoofed-chromeclaims a browser, sends none of its headersBlockedDemo & pricing: info@zedmos.com
Request a demo