Aegis
Governed AI assurance and adversarial validation.
Aegis tests the guardrails and agents around an AI system before it goes live, using benign, approved test content. Each result becomes signed evidence, with OSCAL assessment results and a POA&M, that your assessor can verify offline.
AI you can authorize, with proof that travels.
Programs are fielding AI models and agents faster than they can show those systems are safe to authorize, and Aegis closes that gap.
Tested guardrails and contained agents, on the record.
Before an AI system is fielded, its guardrails have been probed and its agents checked against what they are allowed to reach. The Authorizing Official receives assessment results and a plan of action in the format the system of record expects.
Untested AI and evidence no one can re-check.
AI often goes live with guardrails nobody tested independently, or with agents that can reach far more than the mission needs. Packages built from screenshots cannot be re-verified when an inspector asks a year later.
Pre-deployment AI testing is now expected.
OMB M-25-21 calls for pre-deployment testing of high-impact AI, and M-25-22 carries testing into AI acquisition. Authorization is moving to machine-readable OSCAL packages, and AI is reaching networks where cloud-only tools cannot follow.
From modeled terrain to evidence that verifies anywhere.
Each stage produces a durable artifact scoped to tenant, workspace, and classification. The workflow runs the same way when connected or entirely from files inside an enclave.
Model the terrain
Register the AI endpoints, agents, and systems under test. Ingest telemetry and build a graph of what can reach what.
Plan governed campaigns
Pick scenarios aligned to MITRE ATT&CK, MITRE ATLAS, and the OWASP Top 10 for LLM Applications. Nothing runs until an approver signs off under separation of duties.
Validate safely
Run read-only control checks and benign guardrail probes inside approved scope. A kill switch and an allowlisted egress guard bound every run.
Analyze containment
Compute blast radius and flag agents that can reach sensitive assets outside their authorized scope. Scores show their factors, and missing data is reported as missing.
Turn findings into defenses
Route findings to owners and tickets. Generate policy changes with verified rollback and starter Sigma rules for the SOC.
Package and verify
Map results to controls and emit OSCAL assessment results, a POA&M, and an eMASS-aligned export. Sign it all into an evidence pack that verifies with no network.
One enclave, four layers, one audit ledger.
Everything that tests, decides, and signs runs inside the customer-controlled boundary. Only signed evidence and records leave it, and only signed, verified content enters.
The operator console.
Operators run campaigns, track findings, and act on approvals under a classification banner. A workspace selector scopes every view.
What makes the result defensible.
Evidence an assessor verifies offline
A standalone verifier checks each pack on any machine using only the public key. Tampered, incomplete, unsigned, and forged packs are rejected.
One step from validation to OSCAL
Assessment results and a POA&M come from the same control results that go into the signed pack. Outputs regenerate identically, so an assessor can rebuild one and confirm it matches.
Guardrail testing without weaponized content
Probes are benign canaries that show whether a guardrail held, and they run only inside approved scope. Each bypass becomes a tracked finding with an owner.
Agent containment tied to real topology
Agent reach is computed from the same dependency graph used for blast radius. An over-privilege finding reflects the actual environment instead of a reading of the agent's prompt.
Built for disconnected enclaves
Air-gapped and high-side profiles need no hosted model or cloud console, and update bundles are verified before install. Evidence leaves the enclave as files that carry their own integrity proof.
Platform security an AO can check
CAC and PIV sign-in, step-up authentication, and tenant and classification ceilings apply on every request. Every action lands in an append-only, tamper-evident audit ledger.
It sits where four categories stop.
Each category does its own job well. Aegis covers the overlap: testing AI and controls, then producing authorization evidence from the result.
| Capability | Aegis | AI security and AI red-team tools | Breach and attack simulation | Federal GRC and OSCAL tools | Traditional penetration testing |
|---|---|---|---|---|---|
| AI guardrail probing | Yes, starter coverage | Yes, typically broad | Emerging | No | Varies by team |
| Agent containment tied to topology | Yes | Partial | No | No | No |
| OSCAL results, POA&M, eMASS-aligned export | Yes | No | Rare | Yes | No |
| Signed, offline-verifiable evidence | Yes | No | No | Partial | No |
| Disconnected and high-side profiles | Yes | Rare | Rare | Rare | Manual |
| Runtime guardrail or AI firewall | No, by design | Yes | No | No | No |
Where another category is stronger, we say so. AI security tools usually carry broader probe libraries, and established GRC and simulation vendors hold federal authorizations that Aegis does not. Many programs run Aegis alongside a runtime guardrail and a GRC system.
Five roles, one workflow.
Authorizing Officials and ISSMs
Evidence packs they verify on their own machine, plus OSCAL results and a record of who approved each test.
Chief AI Officers
Pre-deployment guardrail evidence for high-impact AI, mapped to OWASP LLM categories and MITRE ATLAS.
Red and purple team leads
Scope, approvals, and a kill switch enforced by the system that runs the test.
SOC and detection engineering
Starter Sigma rules built from the same content the campaign used, so the SOC can confirm it sees the behavior.
Program and enclave owners
One platform for connected, air-gapped, and high-side enclaves, with no mandatory cloud control plane.
Start with one AI system and one signed pack.
The first engagement covers one AI system or enclave, one governed campaign, and one evidence pack your assessor checks independently.
Pre-deployment guardrail evidence
Test evidence for a high-impact AI use case before it goes live, in support of OMB M-25-21 practices.
Agent least-privilege review
Compare what an agent can reach with what it is authorized to reach, before it is fielded.
Disconnected AI assurance
The same testing and evidence workflow, run entirely inside an air-gapped or high-side enclave.
Who buys it. A program office, Chief AI Officer, or ISSM taking an AI system toward authorization. Pricing is scoped per program and per AI system under test.
Aligned to the guidance your reviewer already cites.
The formats listed are implemented outputs, not certifications. Aegis holds no FedRAMP or Impact Level authorization; it supports an authorization decision.
- Testing is non-destructive and limited to authorized endpoints under approved scope
- Aegis tests guardrails; it is not a runtime guardrail or AI firewall
- A clean probe result is evidence, not a guarantee
- Scores are explainable weighted factors, not predictive models
- It supports Authorizing Official judgment and rules of engagement and does not replace them
This page is a public-safe overview. Probe content, scoring logic, and internal design are shared under appropriate agreements.
Test one AI system, then verify the pack yourself.
We run a sanitized guardrail and containment campaign end to end and hand you the signed evidence pack and its OSCAL output. You check it on a disconnected machine.