AEGIS
Book a demo
Runtime security for AI agents

AI agents can do more than you approved.

Aegis finds the AI agents and AI tools across your clouds, SaaS apps and employee laptops, scores their risk, and puts a policy decision in front of risky actions. Every decision is recorded.

Book a demo Get a free agent assessment

Trusted by security teams at

  • U.S. Department of
    Health and Human Services

For security and AI teams in financial services, healthcare and other regulated industries.

Policy decisionsbefore each tool runs
  1. refund-agentholdcrm.issue_refund · amount=12000 USDOver $5,000. Two approvers required.
  2. support-agentmaskemail.send · body contains an SSNSSN masked before sending.
  3. payout-agentblockpayments.create_payout · currency=EURCurrency not in allowed values.
  4. ops-agentallowslack.post_message · #ops-alertsWithin policy.
Illustrative decision stream. Every decision is recorded on the trace.
  • Read-only cloud and SaaS discovery
  • Fails closed if no decision
  • US-hosted SaaS or on-prem
  • SOC 2 Type II
  • First findings within an hour
The problem

Agents act on your systems. Most teams can't see, limit, or prove what they do.

01 · See

Agents nobody registered

Agents ship inside cloud functions, containers and SaaS platforms, and employees bring AI tools and coding agents to work. The inventory in the wiki is never complete.

Unregistered agentsShadow AI
02 · Limit

Actions nobody bounded

A model can be talked into a $12,000 refund or a payout in the wrong currency. Reviewing configuration can't stop that at runtime.

Money movementData egress
03 · Prove

Behavior nobody can prove

Auditors ask what the agent did and which control stopped it. Logs alone rarely answer.

Audit trailAIUC-1
71% vs 16%

71% of large-enterprise security and IT leaders say AI has access to core business systems. Only 16% say that access is governed effectively.

Cybersecurity Insiders and Saviynt, 2026 CISO AI Risk Report (January 2026). 235 CISOs, CIOs and senior security leaders, US and UK, 5,000+ employees.
5%

feel confident they could contain a compromised AI agent.

Cybersecurity Insiders and Saviynt, 2026 CISO AI Risk Report.
150,000+

agents Gartner predicts the average global Fortune 500 enterprise will have in use by 2028, up from fewer than 15 in 2025.

Gartner press release, 28 April 2026.
How it works

How Aegis works

Four steps on one platform. Start with discovery, then add control where it matters.

  1. 01 · Discover

    Find agents nobody registered

    Connect your clouds and SaaS apps read-only, and add the browser extension and endpoint agent to laptops. Aegis finds the agents and AI tools, says how sure it is, and explains the risk in plain words.

    Outcome: the agents and AI tools found, what each can reach, and an owner for each.

  2. 02 · Control

    Decide before the tool runs

    Wrap your agents' tools with the Aegis SDK. Each call is allowed, masked, held for approval or blocked before it runs, and a kill switch stops one agent or all of them. On laptops, unapproved AI tools are blocked or trigger a warning.

    Outcome: risky actions wait for a person. Blocked actions never run.

  3. 03 · Right-size

    Allow only what each agent does

    Aegis compares what each agent is allowed to do (AWS IAM permissions, tools and connector scopes) with what it actually used, then drafts the change for you to approve.

    Outcome: least privilege based on evidence, not guesswork.

  4. 04 · Protect

    Keep data out, keep proof in

    Customer, health, financial and secret data is masked or blocked in agent tool calls, and detected or masked in what employees paste or upload into AI tools. Runtime decisions map to AIUC-1, a security standard for AI agents.

    Outcome: audit answers come from records, not screenshots.

How Aegis works across your estateAegis discovers AI in four places: clouds (AWS, Azure, Google Cloud) and SaaS apps (Salesforce, ServiceNow, Microsoft Copilot Studio, Workday) connect read-only; laptops and browsers, and the Python agents you build, also receive policy, which is enforced on the device and inside the agent's process. Aegis runs as SaaS in US regions or in your network, and works in four steps: discover, control, right-size and protect. You get one AI inventory, decisions before actions, least privilege, and audit-ready evidence.Where AI runsAegisWhat you getCloudsread-onlyAWS · Azure · Google CloudSaaS appsread-onlySalesforce · ServiceNow · Copilot Studio · WorkdayLaptops and browsersenforced on deviceAI apps · coding agents · MCP serversAgents you buildenforced in processPython, through the Aegis SDKSaaS in US regions, or in your network01 · DISCOVERInventory, confidence and risk02 · CONTROLAllow · mask · hold · block · kill switch03 · RIGHT-SIZEAccess granted vs used → change set04 · PROTECTSensitive data masked where AI actsOne AI inventoryEvery agent and AI tool, with an ownerDecisions before actionsFails closed. Every decision recorded.Least privilegeBased on what each agent usedAudit-ready evidenceDecisions mapped to AIUC-1
Clouds and SaaS apps connect read-only. Policy is enforced where AI acts: inside the agents you build, through the SDK, and on laptops, through the browser extension and endpoint agent. Sensitive values are masked there, before anything reaches Aegis.

See each step in detail →

Coverage

What Aegis covers today

Where Aegis looks, and how it connects to each.

Discover · read-only

Clouds

AWS
Lambda, ECS, EC2, EKS, Bedrock Agents
Azure
Functions, AKS, Virtual Machines, AI Foundry and Azure OpenAI
Google Cloud
Cloud Run, Cloud Functions, GKE, Compute Engine, Vertex AI Agent Engine
Code, optional
Git repositories, checked for committed secrets and risky patterns
Discover · read-only

SaaS apps

Agents in
Salesforce Agentforce, ServiceNow, Microsoft Copilot Studio, Workday
Connector scopes
Slack, Stripe and Salesforce, for right-sizing
Discover · control · protect

Laptops and browsers

Finds
AI apps, accounts and extensions, such as ChatGPT, Claude, Gemini and Copilot; coding agents and local MCP servers
Controls
Blocks or warns on unapproved AI tools. Detects or masks sensitive data pasted or uploaded.
Runs on
macOS and Windows; Chrome and Edge. Detection runs on the device and only metadata reaches Aegis.
Control · protect

Agents you build

Python
LangChain, LangGraph, LlamaIndex, CrewAI, MCP
Traces calls to
OpenAI, Anthropic, Amazon Bedrock, Gemini and Vertex AI, Azure OpenAI

Where it runs: SaaS in Google Cloud US regions, with a separate database per customer, or a single-tenant appliance in your network with no outbound connection needed.

Not yet: runtime control for agents inside SaaS apps or written in other languages, approvals in Slack, Teams or email, and masking of prompts your agents send to model providers.

See all limits →
In the product

From finding to fix

What discovery tells you about one agent, and what a policy changes for another.

billing-summarizer
lambda · us-east-1 · owner: unassigned
Possible shadow AI · 25Risk 65 · High

This function calls an outside AI provider under an administrator-level role, on a schedule, with nobody in the loop.

Risk 65 of 100: IAM blast radius 40, autonomy 15, model provider 10.

  • "Role has administrator-equivalent managed policy AdministratorAccess attached"
  • "Invoked by an automated trigger (EventBridge) with no human-approval step"
  • "Model provider is external (openai), no approved gateway or logging"

Next step: assign an owner, scope the role.

refund-agent · access
before → after the change set
iam:* · never used in 90 daysRemoved via pull request
s3:GetObject on every bucketrefund-attachments/* only
Any tool the code can reachcrm.issue_refund only
Any amount$1 to $25,000
No approvalOver $5,000: two approvers
No rate limit2 calls per second
No recordEvery decision on the trace

Illustrative example. You approve every change; IAM changes go out as a pull request.

Your stack

Where Aegis fits with what you have

Aegis connects read-only alongside your existing tools. It adds the parts they were not built for.

How Aegis fits with existing security tools
You already haveIt coversAegis adds
Agent registries (Microsoft, AWS)Agents someone registered or syncedThe agents nobody registered, their risk, and a decision before their actions
Cloud posture tools (CNAPP)How your cloud is configuredA decision on each agent action at runtime, with the record
SSE and DLPWeb traffic and the data channels they inspectAI tools, coding agents and MCP servers on laptops, and policy inside the agents you build

More questions security and AI teams ask →

Security

Safe to connect. Ready for your security review.

Read-only by design

Clouds and SaaS apps connect read-only, with nothing installed. In AWS, Aegis uses temporary credentials and never holds long-term keys.

Values aren't kept

Discovery keeps names and settings; values are dropped on arrival. Laptops send metadata only. In your agents, personal data and secrets are masked before anything is recorded.

Your own database

A separate database per customer in Google Cloud US regions, encrypted record by record. You set retention, or run Aegis in your network.

Fails closed

Unknown tool, evaluation error, or no decision service: the call does not run.

Read the security details, including NIST AI RMF and OWASP mappings →

Proof

Measured, not promised

“The first scan showed us agents and LLM credentials that weren’t on anyone’s list, and told us why each one mattered.”

CISOUS healthcare company

In evaluation with 5+ security teams in healthcare, financial services and technology.

0false positives on controls across 40 benchmark workloads
0.22 msp99 SDK overhead per policy check, network mocked
29,900trace events per second, measured throughput

Measured on 24 September 2026. The round trip to the decision service depends on where it runs; we measure it with you.

Get started

See what your agents can reach, from one read-only scan.

Connect one AWS account or Salesforce org and see the first findings within an hour. We walk your team through them. You keep the findings.

Get a free agent assessmentBook a demo