Production-deployed
Running in hosted stack and supported
Pilot-ready
Works in controlled deployment / design partner
Configurable
Implemented and tested; activate with API keys or operator configuration in SaaS or local deployment
Roadmap
Not available yet
URL & Context Trust Gate
CapabilityStatusNotes
POST /evaluate end-to-end verdict
Pilot-ready
Returns a single end-to-end trust verdict for a URL. Heuristic-only mode runs without model downloads, and a local proof-of-concept stands up in about 15 minutes.Canonicalisation, querystring redaction, homoglyph / punycode normalisation
Pilot-ready
Canonicalises URLs, redacts querystrings, and normalises homoglyph and punycode tricks so lookalike hostnames resolve to their true form.SSRF-guarded safe crawler
Pilot-ready
Fetches target URLs through an SSRF-guarded crawler. Isolated egress is required in production.Heuristic detection ensemble
Pilot-ready
Flags prompt injection, credential harvesting, brand impersonation, and zero-width character tricks.ML-based detection (DeBERTa, BERT NER, toxic-bert, BART zero-shot)
Configurable
Adds transformer-based classification. Set TRANSFORMERS_OFFLINE=0 to allow model download on first start.Playwright detonation sandbox (port 8015)
Pilot-ready
Detonates suspect pages on port 8015 inside an isolated Docker detonation network with no internal route.Google Safe Browsing v4 reputation feed (Update API — local prefix matching)
Configurable
Set SAFE_BROWSING_API_KEY to activate. Uses the Update API with local matching against ~2.4M SHA-256 prefixes, so users' URLs stay local and only a 4-byte prefix leaves on a rare collision. Fail-open is explicit: a never-synced database reports not-matched and not-authoritative.Microsoft SmartScreen / Defender Threat Intelligence feed
Configurable
Consults the SmartScreen / Defender feed. Set SMARTSCREEN_TENANT_ID, CLIENT_ID, and CLIENT_SECRET to activate.VirusTotal v3 URL reputation feed
Configurable
Consults VirusTotal v3 URL reputation. Set VIRUSTOTAL_API_KEY to activate; results cache for VIRUSTOTAL_CACHE_TTL_S seconds.Tenant allow / block lists
Pilot-ready
Applies per-tenant allow and block lists, served from the policy service via GET /policies?tenant_id=…&scope=url-trust-gate.Evidence writes to audit service
Pilot-ready
Writes verdict evidence to the audit service via POST /events, retrying with exponential back-off over 3 attempts and dead-lettering to a log on final failure; write gaps surface in the Prometheus evidence_write_errors_total counter./health, /ready, /metrics, /pki/public-key endpoints
Pilot-ready
Exposes health, readiness, metrics, and PKI public-key endpoints. /ready probes detection, policy, and audit before declaring ready; metrics are Prometheus text/plain (version 0.0.4).LangChain URL Trust Gate hook
Pilot-ready
Gates URLs flowing through LangChain agents.LlamaIndex URL Trust Gate hook
Pilot-ready
Gates URLs flowing through LlamaIndex agents.RASP Python hook
Pilot-ready
Runtime hook that gates URLs from inside a running Python application.Browser extension hook
Pilot-ready
Gates URLs from the Chromium browser extension.Endpoint agent hook
Pilot-ready
Gates URLs observed by the endpoint agent's monitors.Enforced mTLS between services
Configurable
Enforces mutual TLS between services. Set CYBERARMOR_ENFORCE_MTLS=true and provision certificates to activate.Redis-backed reputation cache (multi-replica)
Configurable
Shares the reputation cache across replicas via Redis; an in-process cache covers single-node deployments.OpenAI / Anthropic tool-use URL field wrappers
Pilot-ready
Wraps OpenAI and Anthropic tool-use responses, intercepting URL fields in tool-call objects before the agent fetches them.Kubernetes NetworkPolicy for detonation worker
Roadmap
Will isolate the detonation worker with a Kubernetes NetworkPolicy; Compose-level isolation already provides this today.Feedback-driven detection fine-tuning
Roadmap
Will fine-tune detection from captured evidence; the /feedback endpoint and evidence store already collect the training signal.Control Plane, Detection & Policy
CapabilityStatusNotes
Policy evaluation engine (OPA-backed, Python fallback)
Production-deployed
Tenant-scoped policy rules, artifacts, API-key flows
Production-deployed
Detection service — prompt injection, sensitive data, dangerous output, toxicity
Production-deployed
Dangerous-output detection covers command injection, XSS, and browser-data exfiltration in model output (OWASP LLM02). Prompt-injection detection combines a DeBERTa classifier with a heuristic ensemble, using heuristics alone when the model is unavailable.Detector-availability reporting (a failed check never reads as clean)
Production-deployed
Scan responses carry scan_complete and detectors_unavailable, so an unavailable detector surfaces as an explicit finding with assessed: false rather than silence. GET /ready reports true per-model state — loaded, failed, unavailable, or not attempted — and returns degraded rather than asserting health it has not verified. Endpoint monitors follow the same rule: an agent that cannot read a watched directory reports degraded and names the path.PII and secret redaction — 33-class catalog (27 structured + 6 NER)
Production-deployed
33 redaction classes at GET /scan/redact/targets, enumerated live from the running service — 12 PII (SSN, credit card, email, phone, DOB, passport, IBAN, bank routing, EIN, driver's licence, crypto address, IP address), 11 secret (AWS access key, GCP API key, GitHub, Slack, Stripe, OpenAI, Anthropic keys, JWT, private key, password, generic API key), 6 PHI (MRN, health plan ID, NPI, DEA, MBI, ICD-10), and 4 named-entity classes (person, organisation, location, URL). Redaction covers the whole body. A span-expansion invariant expands each redaction span so it never ends mid-identifier.Redact action enforcement (general policy engine)
Production-deployed
Enforced across the AI proxy and the endpoint agent's process, network, and file monitors.WARN as a user decision (prompt the person, not an admin queue)
Pilot-ready
A WARN decision prompts the person at the keyboard once and enforces their answer, naming what matched, where it was going, and what continuing does. Prompting runs on the local proxy and endpoint agent; the SDKs, RASP, and add-in surfaces record the warn decision. On the response path, warn is logged and block replaces the response body.HMAC content-hash pseudonymization (GDPR / HIPAA)
Configurable
Set CYBERARMOR_HMAC_KEY. Deterministic per-tenant tokens replace redacted values for audit correlation without exposing raw PII.Tenant-specific NER fine-tuning pipeline
Roadmap
Will reduce false positives — for example an SSN misclassified as an organization — by fine-tuning NER on a per-tenant training corpus through an offline trainer.AI provider routing and resolution
Production-deployed
Agent identity registration and delegation chains
Production-deployed
Audit logs, telemetry, incidents, evidence capture
Production-deployed
Every enforcement decision from the proxy and gate writes a signed record, buffered and batched off the request path and spooled to a durable volume when the audit service is unreachable, so an outage delays records and a lost event is counted. Records are HMAC-SHA256 signed and hash-chained per tenant; verification needs only the key. The Incidents view reads these signed events as a durable source and survives control-plane deploys. Storage is append-only at the application layer; the ingest response reports append_only: false, reflecting that the operator database role retains write access. A 365-day retention policy is declared.Response-side policy evaluation (tenant rules on what the model returned)
Pilot-ready
The MITM proxy scans each model response that passes through it via the detection service and carries that verdict into the tenant policy decision, so response.classification and response.pii are authorable fields with a real producer, read from detection's own published action. When a scan does not finish, the response section is omitted rather than defaulted clean, marking the leaf inapplicable and recording a problem. Streamed answers are reassembled first — OpenAI chat and legacy, Anthropic content_block_delta, and Gemini, with a string-leaf fallback. Only the two MITM proxies (server container and endpoint-installed twin, held identical by a parity test) emit response.*. Block replaces the response body; monitor, warn, and redact are logged. Evaluation runs on response bodies of 40 or more characters served by the 23 listed provider hosts, outside ext_authz mode.Compliance engine (17 framework policy packs)
Production-deployed
One-click packs apply real tenant policies and map them to controls across all 17: ISO/IEC 42001:2023, SEC Cybersecurity Disclosure Rules, FINRA Cybersecurity Program, NYDFS 23 NYCRR 500, SOC 2 Type II, ISO 27001:2022, PCI-DSS v4.0, NIST CSF 2.0, NIST 800-53 Rev 5, NIST AI RMF 1.0, CMMC Level 3, EU GDPR, CCPA/CPRA, HIPAA Security Rule, CIS Controls v8, CSA Cloud Controls Matrix v4.0, and OWASP Combined 2024. An eighteenth framework, SANS/CWE Top 25, ships its controls and assessment but deliberately has no policy pack: its controls are secure-coding practices in the customer's own SDLC — memory safety, SAST configuration, parameterised queries — which this product cannot observe in AI traffic. It is satisfied by uploaded attestation documents, not by an enforced policy, and is counted separately for that reason. Every template is checked in the failing direction, so an empty tenant artifact makes a policy match nothing rather than everything. The event-driven path — MFA-bypass, least-privilege, human-oversight-of-agents, SEC four-business-day materiality — is verified end to end. Audit-and-logging controls read satisfied once the hash-chained audit trail holds tenant evidence; observed-decision coverage (enforced vs policy-only) is on the roadmap.Persisted compliance evidence & assessment storage
Production-deployed
PostgreSQL-backed, tenant-scoped. Evidence bound to the control decision; per-framework assessment reports scored and stored.Enterprise SSO (OIDC) with just-in-time provisioning
Production-deployed
Authorization-code + PKCE flow; ID-token claims enrichment on every login.Multi-factor authentication (TOTP + backup codes)
Production-deployed
RFC 6238 TOTP, per-user enrollment with a per-tenant requirement flag; secrets encrypted at rest.Post-quantum signing and key transport (ML-DSA-87, ML-KEM-1024)
Production-deployed
ML-DSA-87 signatures (FIPS 204) and ML-KEM-1024 key encapsulation (FIPS 203), via native liboqs. Where liboqs is unavailable, the providers fall back to classical Ed25519 signing and X25519-HKDF-SHA256 key transport, and each record names the algorithm it used, so post-quantum signing is verifiable per signature rather than assumed fleet-wide. Also serves as the offline signing key for detection corpus manifests.Directory identity enrichment (Entra ID, Okta, Ping, AWS IAM Identity Center)
Production-deployed
Resolves audit events, action-graph nodes, telemetry, and incidents to a named user, department, and directory group.AI Bill of Materials (A-BOM) inventory
Production-deployed
Component inventory across endpoints, repositories, and cloud sources.Vulnerability scanning (OSV) with CISA KEV + FIRST EPSS enrichment
Production-deployed
CVE matching over the A-BOM, prioritized by known-exploited status and exploit-prediction score.Trust State Ratings — per-system posture score
Roadmap
Planned: a composite posture rating per monitored system, combining A-BOM inventory, vulnerability findings with KEV and EPSS enrichment, compliance results, and patch status — scoped to the systems CyberArmor monitors. The four inputs are available individually today.Signature / hash malware detection engine + control-plane intel feed
Pilot-ready
Per-tenant intel — hashes, byte signatures, optional YARA — syncs from the control plane as JSON sized for a few thousand hand-curated entries, seeded with an EICAR test entry. The engine also consults mmap'd MD5 / SHA-1 / SHA-256 corpora and an NSRL known-good allowlist once an operator builds and pushes them (see below), hashing each file version once behind a distinct-file-size index so most files are never read in full, and hands AI model artifacts and MCP server configs to the format-aware scanners.Signed hash-corpus distribution (offline-signed manifest, anti-rollback, staleness reporting)
Configurable
Operator flow: generate an offline signing key (tools/sign_corpus_manifest.py keygen, Ed25519 or ML-DSA-87), host the corpus artifacts, and PUT the signed manifest to /admin/corpus-manifest/{known-good|known-bad}. The control plane stores and serves the document verbatim and holds no signing key, so a compromised control plane can withhold updates but cannot forge detection data. Agents pin trusted public keys in their own config (corpus_trusted_keys), honor a manifest only when its version advances, verify each artifact's declared SHA-256 before installing, and report an expired manifest as stale in the heartbeat. Publish-time checks reject an unsigned, expired, non-monotonic, or mismatched manifest.Per-connector SIEM forwarding
Pilot-ready
Per-connector delivery to Splunk, Sentinel, QRadar, Elastic, Google SecOps, and Syslog/CEF, tenant-configurable. An OpenSearch destination ships with the stack (Apache-2.0, driven through the elastic output type against OpenSearch 2.17.1 with the document read back — bulk API, basic auth, ndjson, ECS mapping). If evidence is lost, that loss is itself counted and latched, staying visible at the health surface even after a later healthy flush.Media provenance verification (C2PA Content Credentials)
Roadmap
Planned to verify a C2PA signature chain and report one of three facts — manifest verified, manifest failed, or manifest absent. By design it treats an absent manifest as unknown provenance (platforms strip manifests and re-encoding breaks the binding) and a valid manifest as provenance rather than proof of authenticity, since generated media can be validly signed. Design brief in docs/specs/media-authenticity.md.Synthetic-media risk signals (image / audio / video)
Roadmap
Planned to surface a third-party or in-house signal as an advisory signal only, with its model and version recorded, routed to review rather than auto-blocking. Because published deepfake-detection accuracy degrades roughly 45–50% on in-the-wild media versus its own benchmarks, no accuracy figure will accompany the signal.Media-authenticity evidence records
Roadmap
Planned shape: content hash and perceptual hash only (never the media itself), provenance results as re-verifiable fields, every model signal named with its version, and an explicit list of which analyzers ran and which were unavailable — so a failed analyzer reads as unavailable rather than clean. Compliance packs cite it as evidence that media was inspected and retained.Out-of-band verification attestation (wire / account-change approvals)
Roadmap
Built and tested: the policy rule, the required → pending → attested / refused / expired state machine, the attestation record, and the FINRA control mapping. An abandoned attestation recomputes to expired from the clock, and the compliance evidence key is set only by a completed, re-verified attestation. The planned lifecycle API, persistence, a way to observe a payment instruction, and a directory of record carrying a phone number for the callback complete the workflow. Requires no media analysis.AI output verification record (per-output supervisory evidence)
Roadmap
Planned shape: output and source hashes only (never the text), provider / model / model version, which checks ran and which were unavailable and why, and the policy disposition — sealed into the existing hash-chained tenant audit chain. It records what was checked, not a claim that the output is correct. Design brief in docs/specs/output-trust-scoring.md.Deterministic output checks (schema, arithmetic, tool arguments, citation resolution, quoted-span match)
Roadmap
Schema, arithmetic, tool-argument, citation-resolution, and quoted-span checks, recomputable by an auditor from the same inputs — the output checks that can honestly be reported as a boolean. A permanent caveat ships with them: a citation URL that resolves confirms reachability, not that the source supports the claim, which is a model-judged question.Groundedness of output claims against a supplied source
Roadmap
Planned to report the claim spans a supplied source does not support, with the detector model and version recorded — advisory, routed to human review rather than auto-blocking. It requires a source; where none is supplied the result is 'not checkable', shown plainly. Because published groundedness detectors sit near chance on hard cases, no accuracy figure accompanies it.Trust score / confidence rating on AI outputs
Roadmap
This ships as the verification record above — which checks ran, what each returned, and what could not be checked — rather than a single number claiming an output is X% trustworthy. Confidence calibration differs more than tenfold between structured extraction and open-ended answers, so one field cannot be honest across both, and a model's self-reported confidence is not a usable signal. No pooled accuracy or calibration figure is published for our own classifiers.Consumer Surfaces
CapabilityStatusNotes
Endpoint agent (Linux / macOS / Windows)
Pilot-ready
Installs as a managed service with a scheduled-task fallback, restarts on failure, and refuses to double-start across Linux, macOS, and Windows.AI-traffic coverage reporting (the endpoint says when it is NOT enforcing)
Pilot-ready
Reports whether AI traffic is being enforced and names any gaps by checking three live authorities — a running process via launchd, an accepting kernel port, and per-service network settings (Enabled, server, and port must all hold) — rather than a file on disk. The control plane derives status from the heartbeat, so an agent cannot self-report coverage it lacks. A coverage record confirms traffic reaches an enforcement point.Local AI-traffic proxy (endpoint-installed MITM twin, opt-in)
Pilot-ready
Opt-in endpoint MITM proxy carrying the same implementation as the server-side proxy, held in sync by a parity test that runs the server copy. The operator installs it explicitly: it trusts a MITM certificate authority in the System keychain and reroutes the machine's traffic, and it refuses to run as root. Fail mode defaults to closed.Clipboard redaction helper (native desktop apps)
Pilot-ready
Runs as its own LaunchAgent and evaluates clipboard contents through the policy client, redacting in place on a redact decision, clearing on a block, and reporting telemetry either way. Covers pasting into native desktop AI apps, which never traverse a network proxy. Redaction is scoped to the classes the policy decision returns.Ransomware and mass-deletion detection (destructive-phase file behaviour)
Pilot-ready
Three behavioural signals over user-data directories, on by default: mass deletion (100 files in a 60-second window), mass encryption by rename (5 files renamed to known ransomware suffixes in 60 seconds), and in-place encryption (Shannon entropy at least 7.5 bits/byte over the first 4KB of rewritten text, source, config, and log files). Scope is each user profile's Documents, Downloads, and Desktop plus a temp directory. Detection reports and runs independently of response.EDR response actions — host isolation and process termination
Pilot-ready
Executed through the audited privileged-action broker with validated parameters and an audit record on attempt and outcome. Host isolation is reversible by construction — each platform writes into its own named container (a pf anchor, a dedicated iptables/ip6tables chain, named netsh firewall rules), governs both IPv4 and IPv6, permits the control plane first, and refuses to isolate when the control-plane host cannot be resolved. Process termination refuses its own PID and its parent, so a response cannot disable the reporting agent.Endpoint patch remediation (winget / Homebrew / apt / yum-dnf)
Pilot-ready
Entitlement-gated with maintenance windows, an approval workflow, and per-app auto-approve. Executed through the audited privileged-action broker.Endpoint software-update inventory
Pilot-ready
Each endpoint reports upgradable packages with current and available versions for prioritization.Endpoint signature / hash file detection
Pilot-ready
Scans new files against the synced detection intel feed, plus the binary hash corpora when an operator has pushed them. Fails open, keeping the endpoint running.AI model artifact scanning (pickle, PyTorch, Keras)
Pilot-ready
Static parsing only: the pickle opcode stream is disassembled with pickletools.genops and the artifact is never unpickled, loaded, or executed. Covers raw pickle streams (.pkl/.pickle/.p, gzipped, joblib/dill), torch ZIP checkpoints including deflated members, and a narrow Lambda and marshalled-bytecode check for Keras .h5/.hdf5/.keras. Emulating the pickle stack and memo catches memoized module names reaching STACK_GLOBAL.MCP server config inspection + shadow-AI inventory
Pilot-ready
Reads Claude Desktop, Claude Code, Cursor, and VS Code configs plus plugin-bundled .mcp.json files hourly, and the file monitor catches any config written under a watched path. Severity tracks how unambiguous the finding is, from inline shell (critical) to unpinned npx or a non-localhost endpoint (medium). Every configured server is inventoried — command, args, URL, and env key names only; env values never leave the endpoint.NSRL known-good allowlist and large binary hash corpora
Configurable
An operator builds each corpus with tools/build_hash_corpus.py from an NSRL RDSv3 SQLite release and pushes it; the agent runs normally with or without one. Once present, corpora are sorted fixed-width digest files (MD5/SHA-1/SHA-256) searched in place by bisect over an mmap, with a file-size index that skips files no entry could match. A known-good hit suppresses content scanning of those exact bytes only, never behavioural judgement.Captive-portal resilience watchdog
Pilot-ready
Detects captive portals and safely toggles the local proxy so the agent survives cafe, hotel, and airport Wi-Fi.Chromium browser extension
Pilot-ready
VS Code extension
Pilot-ready
Office add-in (Word, Excel, PowerPoint, OneNote, Outlook)
Pilot-ready
Python RASP
Pilot-ready
Go RASP
Pilot-ready
Java RASP
Pilot-ready
Node.js RASP
Pilot-ready
.NET RASP
Pilot-ready
Ruby RASP
Pilot-ready
Rust RASP
Pilot-ready
PHP RASP
Pilot-ready
C / C++ RASP
Pilot-ready
Client SDKs — 9 languages (Python, Go, Java, Node.js, .NET, C/C++, PHP, Ruby, Rust)
Pilot-ready
Drop-in client libraries mirroring the platform API across all nine languages.LangChain SDK wrapper
Pilot-ready
Routes LangChain LLM calls through the CyberArmor policy client.LlamaIndex SDK wrapper
Pilot-ready
Routes LlamaIndex calls through the CyberArmor policy client.iOS endpoint app (on-device URL/DNS filtering, shadow-AI inventory)
Roadmap
A native Network Extension will provide on-device URL and DNS filtering and shadow-AI inventory; the design brief is written and a React Native management dashboard is in place. Apple entitlement approval is the long pole.Android endpoint app (VpnService filtering, work-profile inventory)
Roadmap
Will provide VpnService-based filtering and work-profile inventory, following the iOS build and sharing the same policy, verdict, and evidence path as the desktop endpoint agent. Design brief written.macOS kernel sensor
Pilot-ready
Ships with the macOS endpoint agent.Windows kernel minifilter driver
Roadmap
A kernel minifilter driver that adds file and process visibility once code-signed and loaded by its usermode bridge. File, process, detection, and policy enforcement run independently of the bridge.OpenAI tool-use URL wrapper
Pilot-ready
Applies the URL Trust Gate to URLs surfaced by OpenAI tool use.Anthropic tool-use URL wrapper
Pilot-ready
Applies the URL Trust Gate to URLs surfaced by Anthropic tool use.Robotics & Autonomous Systems (ROS 2)
CapabilityStatusNotes
ROS 2 security agent
Pilot-ready
A standard ament_python node, running on a Raspberry Pi 5 with Ubuntu 26.04 and ROS 2 Lyrical Luth.Topic graph monitoring and discovery
Pilot-ready
Discovers new topics, tracks publisher and subscriber membership changes, and checks per-topic publish rates against expected bounds.Service guard
Pilot-ready
Flags security-relevant service exposure as it appears on the graph; parameter-mutation services such as /set_parameters are raised as CRITICAL.DDS participant inspection
Pilot-ready
Watches the DDS discovery layer for participants joining and leaving, independently of topic-level monitoring, so an unrecognised node on a command topic is visible from both.Actuator policy — observe mode
Pilot-ready
Evaluates every velocity command against speed, acceleration, rate, geofence and safety-zone policy and reports violations without altering what the robot receives. This is the default: the agent only observes, leaving robot motion untouched.Actuator policy — interpose (enforcing) mode
Pilot-ready
Opt-in. The agent republishes the sanitised command on a separate topic that the motor driver reads, so a 9.0 m/s command against a 2.0 m/s limit reaches the driver as 2.0 m/s.Latching emergency stop
Pilot-ready
Asserted over a dedicated topic, it zeroes every subsequent command regardless of magnitude until explicitly released. Rejected commands publish an explicit zero rather than being dropped, because most motor drivers latch the last velocity they received.Sensor integrity monitoring
Pilot-ready
Checks LaserScan, Imu, Range, BatteryState and Float64 topics for out-of-range values, excessive rate of change, staleness, frequency drift, replayed sequences and — opt-in — a frozen sensor. A steady reading is not treated as an attack: a lidar facing a static scene or a battery at rest raises nothing.Incident-based alerting with recovery
Pilot-ready
Repeat alerts back off in escalating intervals (tuned per surface — e.g. 5s → 30s → 5min for sensor faults, 1s → 10s → 60s for actuator events) and close with a recovery event, so a persistent fault is one bounded incident with a full count. Suppressed repeats are counted, never discarded.ROS 2 policy sync from the control plane
Roadmap
Will pull control-plane policy down to the ROS agent's enforcing submodules. Enrolment and policy fetch work today; the install command exports CYBERARMOR_CONTROL_PLANE_URL, CYBERARMOR_TENANT_ID and CYBERARMOR_BOOTSTRAP_TOKEN, which the node reads as defaults while an explicit launch-file parameter still wins.Launch-file and node provenance guard
Roadmap
Will validate launch files and node provenance against policy. The module ships in the package, pending validation on robot hardware.Physical sensor and drive-train integrations
Roadmap
Exercised against synthetic and self-published topics; end-to-end integration with lidar, chassis and AI-accelerator hardware is planned.Status reflects the current codebase and hosted deployment as of July 2026. Pilot-ready capabilities are available to design partners through a controlled onboarding. Configurable capabilities are implemented and tested — activate them with the noted API keys or operator configuration steps in the hosted SaaS stack or your own deployment. Contact us to request access or discuss deployment scope.