RayShield

AI workforce protection

Protect the AI workforce you're already running

Claude Code, Cursor, and Cowork run on your engineers' machines today — reading credentials, writing to internal connectors, and making API calls your DLP was never built to inspect. RayShield contains what they can reach, blocks data leaving through AI connectors, and records what they actually did. Shadow AI discovery covers what you don't know you're running.

Book a discovery pilot See how it works

The problem

Where the risk comes from

Some are fully approved. Others arrive without procurement. Either way, none of these AI sessions are covered by the DLP and logging your security team runs today.

Custom development agents

LLM API scripts in CI pipelines, scheduled jobs and on developer laptops. Written in an afternoon. Never security reviewed.

Workflow bots

Built by one engineer, approved by no one, connected to internal systems your policies were not written to cover.

IDE coding agents

Cursor and Claude Code are approved tools on most engineering teams. But their access to codebases, credentials, and AI connectors is uninspected — your existing DLP has no hook into these sessions.

AI connectors and Cowork

Notion AI, Cowork, and similar tools write internal data to AI backends on your engineers' behalf. There is no DLP between the model and the connector — the write happens before any policy can fire.

Coverage gap

Your existing stack was not built for this

EDR watches what people run. CASB inspects traffic metadata. SIEM aggregates logs from systems that were never designed to report on agent behaviour.

Capability EDR CASB / SIEM RayShield
Agent tool calls and file reads NoNoYes
Shadow and custom agent discovery NoPartialYes
Contained agent execution NoNoYes
Independent record vs agent self-report NoPartialYes
Human and application endpoint protection YesYesComplementary

EDR, CASB and SIEM remain necessary. RayShield covers the agent-behaviour gap they do not address.

Architecture

Four controls, one record

Discovery

A passive sensor that inventories every human and agent using AI in your org — live, from your first log ingest. No agent, no certificate, no network change.

  • TLS SNI and JA3 fingerprints off a SPAN port — no decryption
  • 14 SASE, IdP and MDM log formats — Zscaler, Netskope, Okta, Jamf, Intune and more
  • 215-service catalog across 18 categories, risk-ranked 0–100
  • Per-user and per-device attribution, change detection, agentic burst flagging

Endpoint protection

DLP and credential isolation for every AI tool your engineers run — Claude Code, Cursor, Cowork, Claude Desktop and AI in the browser.

  • AI traffic inspected in memory before transmission — blocks, not just alerts
  • Connector write blocking: Cowork and Notion writes intercepted before the model acts
  • Real API keys never reach any AI tool — sentinel injection at the transport layer
  • AI-scoped name-constrained CA — cryptographically cannot MITM non-AI traffic

Sandbox

Agentic workloads run in a hardware-isolated microVM with deny-all egress, kernel-level audit and binary attestation. Boot time under two seconds.

  • libkrun microVM, Linux 6.12.x, Apple Hypervisor.framework — destroyed on exit
  • Egress blocked at hypervisor level before kernel routing — no bypass path
  • Per-syscall exec audit via seccomp USER_NOTIF, reading argv from /proc
  • Named detections: SENSITIVE-ACCESS, EXFIL, REVSHELL, EGRESS-SPIKE, PERSISTENCE

Fleet

Deploy, monitor and enforce policy centrally across your engineering org through your existing MDM — without touching each machine.

  • Signed packages via Jamf, Kandji or Intune — no engineer action needed
  • Policy is a TOML file in source control — push once, applies to the fleet
  • Monitor → warn → block posture set centrally, without reinstall
  • Observatory portal: live connections, verdicts, token spend, egress anomalies

Developer experience

Deny-all is the default, not the destination

Deny-all egress means nothing is reachable until it is declared. It does not mean the agent works in a vacuum. Package registries, source control, model APIs and your internal services are declared once in policy and available to every session from then on.

Ships with a working baseline

The default policy already permits the destinations a coding agent needs: npm and PyPI registries via curated bundle sets, source control, model APIs and your own domains. Teams start from a working environment, not an empty one.

Adding a destination takes minutes, not a ticket queue

Policy is a TOML file in source control, pushed centrally and applied to the fleet without a reinstall. Approval can be delegated to engineering leads.

Start in monitor mode

Deploy with nothing blocked. RayShield records every destination your agents reach for. After two weeks you have a real allowlist derived from actual behaviour, and you decide what to enforce. Monitor, then warn, then block.

You are not guessing at a policy. You are approving one that was written from what your agents already do.

egress-policy.toml fleet 
[base]
allow_hosts = [
  "api.anthropic.com:443",   # model API
  "github.com:443",          # source control
  "api.github.com:443",      # GitHub REST
  "*.internal.acme.com",     # your services
]

[egress]
bundles = ["npm", "pypi"]    # package registries
mode    = "monitor"          # monitor | warn | block

Standards

Built against the controls you are assessed on

OWASP ASI05

Unexpected code execution

The OWASP Top 10 for Agentic Applications names sandboxed execution and deny-by-default egress as the mitigations for agent code execution risk. That is what RayShield enforces.

MAS

AI risk management

The MAS AI Risk Management Toolkit (March 2026) and the Association of Banks in Singapore Handbook on Generative AI Guardrails in Banking (March 2026) expect identification of AI usage, risk materiality assessment and AI inventorisation. RayShield discovery produces that inventory as evidence.

SOC 2 · ISO 27001

Audit evidence

Agent access events export into your existing SOC 2 and ISO 27001 evidence package and your SIEM pipeline.

The pilot

Protect your AI workforce — and find what else is running

Two weeks. We deploy through your existing endpoint management and activate endpoint DLP for your AI workforce — Claude Code, Cursor, Cowork and similar tools — while running passive discovery across your SASE logs or network traffic. You get DLP enforcement from day one and an inventory of every AI agent and AI tool in your engineering organisation, risk-ranked against a 215-service catalog. No production workflow is touched.

Book a discovery pilot

Deployed via Jamf, Kandji or Intune. No engineer action needed.