The Missing Security Layer.
Explained in Two Minutes.
Why enterprise AI has a gap no existing tool covers — and how CyberArmor closes it before content reaches your AI.
Enterprise AI Is Moving Faster Than
Security Can Follow.
Security teams are asked to govern AI systems, agents, providers, and workflows that outrun traditional review cycles. The hard part is not seeing AI risk. It is controlling it in both directions — what reaches your AI and what leaves it — and proving the control worked.
Source: IBM Cost of a Data Breach 2025 →
Traditional URL filters were built
for human browsing.
A page can look completely harmless to a user while hiding instructions in CSS, comments, metadata, Unicode tags, or zero-width characters. Existing Safe Browsing, SmartScreen, and VirusTotal feeds answer “is this site malicious for a human?” — not “is this content safe for an AI agent to ingest?”
CSS and off-screen hidden text
display:none, visibility:hidden, opacity:0, font-size:0. Invisible to a user, read verbatim by an LLM.
Unicode-tag and zero-width encoding
Instructions encoded in Unicode tag characters (U+E0000–E007F) or zero-width spaces. Browsers render nothing; AI contexts ingest everything.
Metadata, comments, and structured data
JSON-LD, Open Graph tags, HTML comments, and schema markup are never shown to a human visitor. They can carry arbitrary instructions for an AI reader.
CyberArmor evaluates external content before it enters AI context, then allows, warns, redacts, sandboxes, blocks, or isolates based on tenant policy — with evidence written on every non-cached decision.
URL Trust Gate runs end-to-end.
The 15-minute local PoC installer brings up the full gate stack on any developer laptop and submits four crafted attack pages — benign, CSS-hidden promptware, zero-width injection, credential-harvest — all producing live verdicts in under 120 ms.
Implemented and Tested
- FastAPI service — end-to-end, health-checked, Prometheus metrics on port 8014
- URL canonicalization, querystring redaction, homoglyph / punycode normalization
- SSRF-guarded safe crawler — no cookies, no credentials, redirect-hop revalidation
- Playwright detonation sandbox on an isolated Docker network (port 8015, internal)
- Heuristic detection: prompt injection, credential harvest, brand impersonation, zero-width stripping
- ML-based detection via detection service — phishing, promptware, DLP, IOC scoring
- Google Safe Browsing v4, Microsoft SmartScreen, and VirusTotal v3 reputation feeds
- Tenant allow/block lists via policy service (GET /policies?tenant_id=…&scope=url-trust-gate)
- Policy decisions: allow, warn, redact, sandbox, block, isolate
- Evidence writes to audit service on every non-cached decision
- Consumer hooks: browser extension, endpoint agent, RASP Python, LangChain SDK, LlamaIndex SDK
Flagship Proof — ROS 2 Robotics
We don't just flag prompts. We stop actuators.
A 9.0 m/s velocity command against a 2.0 m/s policy reached the wire as 2.0 m/s — and 0.0 under emergency stop. Verbatim transcripts from the Raspberry Pi 5 validation session.
What Leaves Is as Controlled as What Enters.
Gating hostile content before it reaches the AI is half the loop. CyberArmor closes the other half on the way out: secrets and PII are redacted before a prompt leaves, AI responses are checked for dangerous output before they reach downstream systems, and every decision is written to evidence. Not only input — output too.
Outbound — Data Protection
Redact the secret before it becomes an incident.
Credential leakage into generative AI is the leak nobody sees. CyberArmor inspects AI-bound content and redacts secrets, PII, PCI, NACHA, NPI, and non-public indicators before the prompt leaves — and records the control that ran.
The response coming back is checked too — insecure output handling, OWASP LLM02. Caught on the way out:
BEFORE
Summarize this log: OPENAI_API_KEY=sk-... and password=hunter22AFTER
Summarize this log: OPENAI_API_KEY=[REDACTED-OPENAI-KEY] and [REDACTED-PASSWORD]Evidence: decision=ALLOW_WITH_REDACTION, policy=redact-secrets, findings=OPENAI_API_KEY/PASSWORD, raw secret preview suppressed.
Evidence — Bound to the Control
Not just logs. Control you can prove.
Every gate, redaction, block, and route writes a structured record: which user or agent acted, which provider and model, what data classification was involved, which policy applied, and what response ran. The proof is attached to the action — which is exactly what an auditor, an examiner, or your own incident-response team asks for.
Zero-width prompt injection in an external page — blocked before it reached AI context
API key removed from an AI-bound prompt before it left the browser
Command-injection pattern detected in an AI response before downstream delivery
A Clear Boundary Between What Is Deployable and What Is Being Expanded.
CyberArmor.AI is being built with security-led design partners and controlled pilot deployments. The platform already includes working control, detection, policy, redaction, routing, identity, audit, endpoint, and onboarding paths. Broader enterprise workflows are intentionally marked as pilot-stage while they mature.
Available Today
- URL & Context Trust Gate — 15-minute local PoC with four live attack-page demos (display:none promptware, zero-width injection, credential harvest, benign)
- SSRF-guarded safe crawler and optional Playwright detonation sandbox for JavaScript-heavy content
- External reputation feeds: Safe Browsing v4, Microsoft SmartScreen, and VirusTotal v3 with in-process caching
- Tenant URL allow/block lists with scope-based policy integration
- AI request monitoring and policy decision logging
- Prompt-risk, credential leak, and sensitive-data inspection
- Redaction-mode policy decisions for supported browser, endpoint, SDK, extension, and provider paths
- AI provider routing, provider resolution, credential-handling, and audit event patterns
- Agent identity registration, tenant scoping, delegation metadata, and revocation paths
- Endpoint-assisted AI tool and connection discovery
- Tenant-scoped policy builder, artifacts, and API-key flows
- Audit logs, telemetry, incidents, and evidence capture
- Enterprise SSO (OIDC) with just-in-time provisioning and multi-factor authentication (TOTP + backup codes)
- Directory identity enrichment — Entra ID, Okta, Ping, AWS IAM Identity Center — resolving every event to a named user, department, and group
- 17-framework compliance policy packs including ISO 42001, SEC Cyber, FINRA Cyber, and NYDFS 500, with persisted tenant-scoped evidence
- AI Bill of Materials (A-BOM) with OSV vulnerability scanning, enriched by CISA KEV and FIRST EPSS
- Per-connector SIEM forwarding to Splunk, Sentinel, QRadar, Elastic, Google SecOps, and syslog/CEF
In Pilot / Design Partner Phase
- Endpoint protection with automated, policy-gated patch remediation across Windows, macOS, and Linux
- Signature and hash-reputation malware detection with a control-plane-synced intelligence feed
- Expanded shadow AI inventory across SaaS and identity sources
- Agent trust verification and delegation-chain workflows
- Proof Vault evidence packaging and external audit exports
- Advanced fail-closed runtime enforcement across more enterprise control points
- Native PQC deployment validation where customer environments support required cryptographic dependencies
- Deeper industry-specific compliance assessment depth with design partners
URL Trust Gate runs end-to-end in 15 minutes on a developer laptop — detection, policy, evidence, and four live attack-page verdicts.
Audit, action graph, compliance, and evidence paths are tied to enforcement decisions, not just reporting copy.
Endpoint agents, browser/IDE/Office extensions, SDKs, RASP hooks, and LangChain/LlamaIndex wrappers support pilot validation.
Built for pilots. Honest about the boundary.
Security buyers deserve to know exactly what runs in production, what is pilot-ready, and what is roadmap. Here is where CyberArmor stands today.
In production
The policy engine, detection (prompt injection, 21 redaction classes, dangerous output, toxicity), the compliance engine with 17 framework packs, persisted evidence, SSO with MFA, directory enrichment, and A-BOM vulnerability scanning run in the hosted stack and are supported.
Pilot-ready
Endpoint agents on Windows, macOS, and Linux, patch remediation, the URL Trust Gate with detonation sandbox, browser / VS Code / Office extensions, RASP and SDKs in nine languages, SIEM forwarding, and the ROS 2 robotics agent deploy today in controlled pilots.
Roadmap
The Windows kernel minifilter driver is not yet code-signed and does not ship. SOC 2 certification is planned, not attained. Self-service onboarding is still being refined.
Compliance evidence in the frameworks your examiners use.
Competitors treat compliance as a badge on the deck. CyberArmor ships it as a product: 17 framework policy packs run in the production compliance engine, and every assessment persists tenant-scoped evidence bound to the control decision that produced it.
FINRA 2026 Oversight Report
FINRA's 2026 Annual Regulatory Oversight Report expects member firms to log AI-agent actions and decisions, put guardrails on agent behavior, and monitor which systems agents can access. Those are the control decisions CyberArmor records — as evidence, bound to policy.
SEC Cybersecurity
Maps control decisions to SEC cybersecurity risk-management and incident-disclosure expectations, with stored evidence for examination.
FINRA Cybersecurity
Maps runtime controls — agent identity, action logging, guardrail decisions — to FINRA cybersecurity program expectations.
NYDFS 500
Maps controls to the NYDFS Cybersecurity Regulation (23 NYCRR Part 500) for covered financial-services entities.
SOC 2-Aligned Controls
Maps platform controls to SOC 2 Trust Services Criteria and stores the evidence. This is a control mapping — SOC 2 certification itself is on the roadmap, not attained.
Four of the 17 framework policy packs in the production compliance engine. The full list, with per-capability status, is on the capability status page.
Broader AI Governance Alignment
Real Threats. Real Buyers. Real Answers.
CyberArmor.AI is built around the security challenges enterprise teams are already facing: AI data leakage, prompt misuse, agent identity, provider sprawl, and the lack of proof when AI activity crosses a boundary.
Shadow AI Discovery & Governance
The Problem
Employees and vendors are connecting to AI tools, APIs, and models without security review. You have limited inventory, uneven controls, and little evidence when usage crosses policy.
The Solution
CyberArmor.AI uses supported endpoint, browser, API, and integration signals to surface AI usage, connect it to policy, and preserve evidence as coverage expands with each deployment path.
Five things that make this different.
Runtime control, not paperwork — policy resolves to block, redact, route, or warn at the moment of the AI action.
Both directions — hostile content is gated on the way in; secrets are redacted and dangerous output is caught on the way out.
Evidence bound to enforcement — every decision records the actor, the policy, the data classification, and the response that ran.
Content trust for AI agents — the URL Trust Gate answers “is this safe for an AI to ingest?”, not just “is this site safe for a human?”
Honest boundaries — production, pilot-ready, and roadmap are stated plainly on the capability status page.
Built by a Security Practitioner for Teams That Need Control and Proof.
CyberArmor.AI is founder-led by Patrick Kelly — his full-time work — and built from the operating reality of enterprise security: policy has to become enforcement, sensitive data has to be protected before exposure, incidents need evidence, and AI adoption cannot wait for a perfect governance program.
The company is intentionally transparent about product maturity, design-partner work, and where the platform is strongest today. That posture is part of the product.
Read the company storySecurity practitioner
Built from application, data, cloud, endpoint, identity, and AI security operating problems.
Hands-on builder
Rooted in working controls, tests, demos, runbooks, and deployment paths instead of slideware.
Enterprise lens
Designed for regulated environments, uneven ownership, legacy systems, and real security-team workflows.
Official brand and domains: CyberArmor.AI is operated by CyberArmor AI, Inc. Official web properties are served from cyberarmor.ai and its subdomains — app, admin, docs, and support. CyberArmor.AI is not affiliated with similarly named third-party domains, services, or social profiles unless they are linked from an official property.