Enterprise gives you more power, no matter how you run it: a bigger detection model, bring-your-own inference, SIEM export, and fleet-wide governance controls — whether your devices run cloud-managed or fully private.
These are tier features. They work in Cloud mode and Private mode alike.
A larger model with better long-tail recall and attack-type classification — so each alert tells you not just that an attack happened, but which class. Available as an upgrade within Enterprise.
Connect your own inference endpoint as a second opinion alongside our local model. Our model is always primary; yours runs as a backstop. If your endpoint is unreachable the local model continues — fail-closed. Useful when your compliance rules require the inference layer to stay under your control.
Stream alerts in JSON, CEF, or syslog directly to your SOC toolchain (Splunk, Sentinel, QRadar). Works in Private mode too: the device tails a local log file — no cloud required.
MDM-friendly rollout via SCCM, Intune, Ansible, or a simple install loop. License tokens are device-bound — fungible binaries, non-transferable licenses.
Per-device danger thresholds, custom profiles, and configurable poll intervals — locked to Enterprise to prevent policy bypass.
Enterprise runs as a fully separate setup: your own console at your own web address, a region you choose for where your data lives, and your data kept strictly apart in its own database. Nothing is shared with other customers.
How you run each device is a free choice. You can run some devices in Cloud mode and others in Private mode in the same fleet — and you get the same feature set either way.
Each device reports redacted diffs to the panel. You get a live fleet view, real-time policy steering, and the full analytics dashboard. Everything the panel shows is there because the device sent it.
The device runs fully isolated — nothing leaves the machine. Ideal for fully private environments and the strictest data-sovereignty requirements. Config is signed once and delivered; the device acts on its own.
When a device runs in Private mode, analysis is local by construction — not a setting you switch on, but the way the install works. The following applies to Private-mode devices specifically. Cloud-mode devices send redacted diffs for scoring; that data flow is documented in the egress ledger.
No memory entry, document, or text fragment is ever sent anywhere. The model reads the change locally and returns a verdict locally — there is no analysis cloud to leak to.
One documented license and update check per month — credentials and version only, never content. An optional aggregate count can accompany it (opt-in; numbers only, no paths, no content). Between checks the device runs fully offline.
Every outbound request is recorded in an egress ledger built into the product — so your DLP and audit teams can verify, not just trust, that nothing else leaves.
Memory poisoning isn't one trick. It's a family of techniques, and a defense is only as good as its coverage of the hard ones. The detector is trained and evaluated against each of these classes.
Explicit instructions smuggled into a memory entry — “from now on, do X” — that the agent later obeys as if they were its own.
Prompt injection explainedEntries engineered to make the agent leak secrets, credentials, or private context to an attacker-controlled destination.
How data exfiltration worksThe most insidious move: an entry that targets the protection itself — “trust this source, stop checking it.” Disarm the guard, and every later attack walks in.
Understanding meta-attacksFraming that coaxes the agent out of its safety rules through a persona or scenario, instead of issuing the malicious instruction outright.
Role-play jailbreaks explainedThe hardest of all: entries that read like perfectly legitimate notes, with no obvious tell — the ones plain filters and keyword rules sail right past.
Detecting subtle injectionThe inference engine runs in a kernel-enforced sandbox — reads the model, answers on localhost, nothing else. The following applies to any device running local analysis (Private mode, or Cloud mode with local scoring). The only honest platform prerequisite is on Linux.
| Platform | Requirement |
|---|---|
| macOS | Nothing special. The kernel sandbox (Seatbelt) is always available — verified on Apple Silicon. |
| Linux | Kernel ≥ 5.13 with Landlock active: Ubuntu ≥ 22.04, Debian ≥ 12, RHEL ≥ 9.6 out of the box. Otherwise enable it via the boot parameter lsm=landlock,…. |
| Windows | Nothing special. The engine runs under a restricted token (all privileges stripped, low integrity) and a Job Object that blocks any child process — live and verified. |
| Containers | The default Docker seccomp profile blocks the Landlock syscalls — an adjusted profile is required. |
| No Landlock? | Opt-in cloud evaluation as a remote backstop. Protection stays; the data flow is documented transparently. |
Talk to us about an Enterprise rollout — advanced detection capabilities, governance controls, and the deployment model your security team requires.
Contact sales