Production-deployed
Running in hosted stack and supported
Pilot-ready
Works in controlled deployment / design partner
Configurable
Implemented and tested; activate with API keys or operator configuration in SaaS or local deployment
Roadmap
Not available yet
URL & Context Trust Gate
14Pilot-ready6Configurable2Roadmap
| Capability | Status | Notes |
|---|---|---|
| POST /evaluate end-to-end verdict | Pilot-ready | Returns a single end-to-end trust verdict for a URL. Heuristic-only mode runs without model downloads, and a local proof-of-concept stands up in about 15 minutes. |
| Canonicalisation, querystring redaction, homoglyph / punycode normalisation | Pilot-ready | Canonicalises URLs, redacts querystrings, and normalises homoglyph and punycode tricks so lookalike hostnames resolve to their true form. |
| SSRF-guarded safe crawler | Pilot-ready | Fetches target URLs through an SSRF-guarded crawler. Isolated egress is required in production. |
| Heuristic detection ensemble | Pilot-ready | Flags prompt injection, credential harvesting, brand impersonation, and zero-width character tricks. |
| ML-based detection (DeBERTa, BERT NER, toxic-bert, BART zero-shot) | Configurable | Adds transformer-based classification. Set TRANSFORMERS_OFFLINE=0 to allow model download on first start. |
| Playwright detonation sandbox (port 8015) | Pilot-ready | Detonates suspect pages on port 8015 inside an isolated Docker detonation network with no internal route. |
| Google Safe Browsing v4 reputation feed (Update API — local prefix matching) | Configurable | Set SAFE_BROWSING_API_KEY to activate. Uses the Update API with local matching against ~2.4M SHA-256 prefixes, so users' URLs stay local and only a 4-byte prefix leaves on a rare collision. Fail-open is explicit: a never-synced database reports not-matched and not-authoritative. |
| Microsoft SmartScreen / Defender Threat Intelligence feed | Configurable | Consults the SmartScreen / Defender feed. Set SMARTSCREEN_TENANT_ID, CLIENT_ID, and CLIENT_SECRET to activate. |
| VirusTotal v3 URL reputation feed | Configurable | Consults VirusTotal v3 URL reputation. Set VIRUSTOTAL_API_KEY to activate; results cache for VIRUSTOTAL_CACHE_TTL_S seconds. |
| Tenant allow / block lists | Pilot-ready | Applies per-tenant allow and block lists, served from the policy service via GET /policies?tenant_id=…&scope=url-trust-gate. |
| Evidence writes to audit service | Pilot-ready | Writes verdict evidence to the audit service via POST /events, retrying with exponential back-off over 3 attempts and dead-lettering to a log on final failure; write gaps surface in the Prometheus evidence_write_errors_total counter. |
| /health, /ready, /metrics, /pki/public-key endpoints | Pilot-ready | Exposes health, readiness, metrics, and PKI public-key endpoints. /ready probes detection, policy, and audit before declaring ready; metrics are Prometheus text/plain (version 0.0.4). |
| LangChain URL Trust Gate hook | Pilot-ready | Gates URLs flowing through LangChain agents. |
| LlamaIndex URL Trust Gate hook | Pilot-ready | Gates URLs flowing through LlamaIndex agents. |
| RASP Python hook | Pilot-ready | Runtime hook that gates URLs from inside a running Python application. |
| Browser extension hook | Pilot-ready | Gates URLs from the Chromium browser extension. |
| Endpoint agent hook | Pilot-ready | Gates URLs observed by the endpoint agent's monitors. |
| Enforced mTLS between services | Configurable | Enforces mutual TLS between services. Set CYBERARMOR_ENFORCE_MTLS=true and provision certificates to activate. |
| Redis-backed reputation cache (multi-replica) | Configurable | Shares the reputation cache across replicas via Redis; an in-process cache covers single-node deployments. |
| OpenAI / Anthropic tool-use URL field wrappers | Pilot-ready | Wraps OpenAI and Anthropic tool-use responses, intercepting URL fields in tool-call objects before the agent fetches them. |
| Kubernetes NetworkPolicy for detonation worker | Roadmap | Will isolate the detonation worker with a Kubernetes NetworkPolicy; Compose-level isolation already provides this today. |
| Feedback-driven detection fine-tuning | Roadmap | Will fine-tune detection from captured evidence; the /feedback endpoint and evidence store already collect the training signal. |
Control Plane, Detection & Policy
23Production-deployed10Pilot-ready2Configurable8Roadmap
| Capability | Status | Notes |
|---|---|---|
| Document and image content inspection with offline OCR | Production-deployed | Extracts text from PDF, DOCX, XLSX and PPTX at rest, and reads images with OCR that runs locally rather than via a cloud service, so it still works in an air-gapped deployment. File format is identified from the file's magic bytes, not its name or declared type. A parser that fails says so rather than reporting empty text. |
| Upload-endpoint discovery with one-click coverage promotion | Production-deployed | Surfaces uploads going to endpoints the built-in catalogue does not cover, aggregated over 30 days by host and path, and lets an administrator bring each into coverage in one action. Answers the standing objection that any catalogue-based control goes out of date when a vendor changes its upload path. |
| Manual control attestation with evidence provenance | Production-deployed | Controls that are procedures rather than machine-observable can be attested by a named person with a note and a supporting document. The compliance score records how it knows each control passed and ranks it — platform-observed above customer-attested above caller-asserted — so an examiner can tell the two apart. |
| Operational report gallery | Production-deployed | Five reports generated over a chosen window from the tenant's own data: executive summary, AI risk, DLP activity, endpoint health, and policy effectiveness. Distinct from per-framework compliance exports; the policy-effectiveness report names policies that have never fired. |
| Policy evaluation engine (OPA-backed, Python fallback) | Production-deployed | |
| Tenant-scoped policy rules, artifacts, API-key flows | Production-deployed | |
| Detection service — prompt injection, sensitive data, dangerous output, toxicity | Production-deployed | Dangerous-output detection covers command injection, XSS, and browser-data exfiltration in model output (OWASP LLM02). Prompt-injection detection combines a DeBERTa classifier with a heuristic ensemble, using heuristics alone when the model is unavailable. |
| Detector-availability reporting (a failed check never reads as clean) | Production-deployed | Scan responses carry scan_complete and detectors_unavailable, so an unavailable detector surfaces as an explicit finding with assessed: false rather than silence. GET /ready reports true per-model state — loaded, failed, unavailable, or not attempted — and returns degraded rather than asserting health it has not verified. Endpoint monitors follow the same rule: an agent that cannot read a watched directory reports degraded and names the path. |
| PII and secret redaction — 30 classes detectable by default (27 structured + 3 NER) | Production-deployed | The catalogue holds 33 classes, enumerated live from the running service at GET /scan/redact/targets — 12 PII (SSN, credit card, email, phone, DOB, passport, IBAN, bank routing, EIN, driver's licence, crypto address, IP address), 11 secret (AWS access key, GCP API key, GitHub, Slack, Stripe, OpenAI, Anthropic keys, JWT, private key, password, generic API key), 6 PHI (MRN, health plan ID, NPI, DEA, MBI, ICD-10), and 4 named-entity classes (person, organisation, location, URL). 30 of those are detectable on a default deployment: 27 are pattern-backed and 3 are named-entity classes the shipped model has labels for. The remaining three — crypto address, IP address and URL — need a named-entity label set the default model does not carry, so they are listed and not detected until one is configured. We state the two numbers separately because a catalogue entry is not a detection. |
| Redact action enforcement (general policy engine) | Production-deployed | Enforced across the AI proxy and the endpoint agent's process, network, and file monitors. |
| WARN as a user decision (prompt the person, not an admin queue) | Pilot-ready | A WARN decision prompts the person at the keyboard once and enforces their answer, naming what matched, where it was going, and what continuing does. Prompting runs on the local proxy and endpoint agent; the SDKs, RASP, and add-in surfaces record the warn decision. On the response path, warn is logged and block replaces the response body. |
| HMAC content-hash pseudonymization (GDPR / HIPAA) | Configurable | Set CYBERARMOR_HMAC_KEY. Deterministic per-tenant tokens replace redacted values for audit correlation without exposing raw PII. |
| Tenant-specific NER fine-tuning pipeline | Roadmap | Will reduce false positives — for example an SSN misclassified as an organization — by fine-tuning NER on a per-tenant training corpus through an offline trainer. |
| AI provider routing and resolution | Production-deployed | |
| Agent identity registration and delegation chains | Production-deployed | |
| Audit logs, telemetry, incidents, evidence capture | Production-deployed | Every enforcement decision from the proxy and gate writes a signed record, buffered and batched off the request path and spooled to a durable volume when the audit service is unreachable, so an outage delays records and a lost event is counted. Records are HMAC-SHA256 signed and hash-chained per tenant; verification needs only the key. The Incidents view reads these signed events as a durable source and survives control-plane deploys. Storage is append-only at the application layer; the ingest response reports append_only: false, reflecting that the operator database role retains write access. A 365-day retention policy is declared. |
| Response-side policy evaluation (tenant rules on what the model returned) | Pilot-ready | The MITM proxy scans each model response that passes through it via the detection service and carries that verdict into the tenant policy decision, so response.classification and response.pii are authorable fields with a real producer, read from detection's own published action. When a scan does not finish, the response section is omitted rather than defaulted clean, marking the leaf inapplicable and recording a problem. Streamed answers are reassembled first — OpenAI chat and legacy, Anthropic content_block_delta, and Gemini, with a string-leaf fallback. Only the two MITM proxies (server container and endpoint-installed twin, held identical by a parity test) emit response.*. Block replaces the response body; monitor, warn, and redact are logged. Evaluation runs on response bodies of 40 or more characters served by the 23 listed provider hosts, outside ext_authz mode. |
| Compliance engine (17 framework policy packs) | Production-deployed | One-click packs apply real tenant policies and map them to controls across all 17: ISO/IEC 42001:2023, SEC Cybersecurity Disclosure Rules, FINRA Cybersecurity Program, NYDFS 23 NYCRR 500, SOC 2 Type II, ISO 27001:2022, PCI-DSS v4.0, NIST CSF 2.0, NIST 800-53 Rev 5, NIST AI RMF 1.0, CMMC Level 3, EU GDPR, CCPA/CPRA, HIPAA Security Rule, CIS Controls v8, CSA Cloud Controls Matrix v4.0, and OWASP Combined 2024. An eighteenth framework, SANS/CWE Top 25, ships its controls and assessment but deliberately has no policy pack: its controls are secure-coding practices in the customer's own SDLC — memory safety, SAST configuration, parameterised queries — which this product cannot observe in AI traffic. It is satisfied by uploaded attestation documents, not by an enforced policy, and is counted separately for that reason. Every template is checked in the failing direction, so an empty tenant artifact makes a policy match nothing rather than everything. The event-driven path — MFA-bypass, least-privilege, human-oversight-of-agents, SEC four-business-day materiality — is verified end to end. Audit-and-logging controls read satisfied once the hash-chained audit trail holds tenant evidence; observed-decision coverage (enforced vs policy-only) is on the roadmap. |
| Persisted compliance evidence & assessment storage | Production-deployed | PostgreSQL-backed, tenant-scoped. Evidence bound to the control decision; per-framework assessment reports scored and stored. |
| Enterprise SSO (OIDC) with just-in-time provisioning | Production-deployed | Authorization-code + PKCE flow; ID-token claims enrichment on every login. |
| Multi-factor authentication (TOTP + backup codes) | Production-deployed | RFC 6238 TOTP, per-user enrollment with a per-tenant requirement flag; secrets encrypted at rest. |
| Post-quantum signing and key transport (ML-DSA-87, ML-KEM-1024) | Production-deployed | ML-DSA-87 signatures (FIPS 204) and ML-KEM-1024 key encapsulation (FIPS 203), via native liboqs. Where liboqs is unavailable, the providers fall back to classical Ed25519 signing and X25519-HKDF-SHA256 key transport, and each record names the algorithm it used, so post-quantum signing is verifiable per signature rather than assumed fleet-wide. Also serves as the offline signing key for detection corpus manifests. |
| Directory identity enrichment (Entra ID, Okta, Ping, AWS IAM Identity Center) | Production-deployed | Resolves audit events, action-graph nodes, telemetry, and incidents to a named user, department, and directory group. |
| AI Bill of Materials (A-BOM) inventory | Production-deployed | Component inventory across endpoints, repositories, and cloud sources. |
| Vulnerability scanning (OSV) with CISA KEV + FIRST EPSS enrichment | Production-deployed | CVE matching over the A-BOM, prioritized by known-exploited status and exploit-prediction score. |
| Trust State Ratings — per-system posture score | Roadmap | Planned: a composite posture rating per monitored system, combining A-BOM inventory, vulnerability findings with KEV and EPSS enrichment, compliance results, and patch status — scoped to the systems CyberArmor monitors. The four inputs are available individually today. |
| Signature / hash malware detection engine + control-plane intel feed | Pilot-ready | Per-tenant intel — hashes, byte signatures, optional YARA — syncs from the control plane as JSON sized for a few thousand hand-curated entries, seeded with an EICAR test entry. The engine also consults mmap'd MD5 / SHA-1 / SHA-256 corpora and an NSRL known-good allowlist once an operator builds and pushes them (see below), hashing each file version once behind a distinct-file-size index so most files are never read in full, and hands AI model artifacts and MCP server configs to the format-aware scanners. |
| Signed hash-corpus distribution (offline-signed manifest, anti-rollback, staleness reporting) | Configurable | Operator flow: generate an offline signing key (tools/sign_corpus_manifest.py keygen, Ed25519 or ML-DSA-87), host the corpus artifacts, and PUT the signed manifest to /admin/corpus-manifest/{known-good|known-bad}. The control plane stores and serves the document verbatim and holds no signing key, so a compromised control plane can withhold updates but cannot forge detection data. Agents pin trusted public keys in their own config (corpus_trusted_keys), honor a manifest only when its version advances, verify each artifact's declared SHA-256 before installing, and report an expired manifest as stale in the heartbeat. Publish-time checks reject an unsigned, expired, non-monotonic, or mismatched manifest. |
| Per-connector SIEM forwarding | Pilot-ready | Per-connector delivery to Splunk, Sentinel, QRadar, Elastic, Google SecOps, and Syslog/CEF, tenant-configurable. An OpenSearch destination ships with the stack (Apache-2.0, driven through the elastic output type against OpenSearch 2.17.1 with the document read back — bulk API, basic auth, ndjson, ECS mapping). If evidence is lost, that loss is itself counted and latched, staying visible at the health surface even after a later healthy flush. |
| Firewall External Dynamic List (EDL) publishing — agentless AI blocking | Pilot-ready | Serves per-tenant AI block lists (the shared AI service catalog minus the tenant's approved providers, plus TTL-bounded incident blocks) as PAN-OS External Dynamic Lists over HTTPS — enforced by the customer's own firewall, no agent, no firewall commit. Fetch-token auth per tenant; policy-service outages serve the last good list with measured staleness; over-cap truncation is surfaced, never silent. Lab-tested against the PAN-OS EDL format; not yet exercised against a live PAN-OS instance. |
| Third-party telemetry ingestion (firewall syslog, EDR, CEF, webhook) | Pilot-ready | Consumes telemetry the customer's stack already generates — PAN-OS syslog (CEF or native format), a lab EDR, any CEF sender, or any SOC forwarder over a webhook — normalized into an OCSF-aligned taxonomy and tagged against the shared AI service catalog at ingest, with zero CyberArmor software on any endpoint. Ingestion fails open by design: a dead feed never blocks anything, and goes loudly stale instead (warning, metric, and a telemetry_feed_stale event). Every volume bound (rate limit, dedup, window) sheds with counters, never silently. Parsers fixture-tested against vendor documentation; not yet exercised against a live PAN-OS or EDR feed. |
| Authenticated syslog ingestion (mutual TLS) | Pilot-ready | Sensor feeds can be authenticated with a client certificate rather than identified by their network address. This matters because the ordinary way syslog is received — trusting the sender's source address — is not authentication: an address can be forged, and behind NAT it identifies a whole network rather than one device. On the mutual-TLS listener the sender proves possession of a key issued by the customer's own certificate authority, and the address is never consulted, so a feed keeps its identity even when it moves. The listener refuses to start on a partial configuration rather than coming up looking authenticated, and each configured feed reports which of the two modes it is actually using. Verified against real certificates and real handshakes, including refusing an untrusted authority that presents a registered identity; not yet exercised against a live firewall. |
| Agentless correlation — identity-attributed shadow-AI findings | Pilot-ready | Deterministic correlation over third-party telemetry: an EDR process sighting and a firewall sighting on the same host inside a two-minute window become one identity-attributed finding — tool, user, host, and every sensor that saw it on a single card, with the time from first sensor signal to finding measured by the system itself. A network-only sighting opens a zero-day finding that upgrades in place when the process half arrives, and sustained data egress to an AI service raises its own finding. Findings flow into the same control-plane views and incident path the endpoint agent uses. Severity is honest about what is unknown: while a tenant's approved-provider list has not been learned, findings cap at high rather than claiming critical. Lab-verified; not yet exercised against live sensor feeds. |
| Enforcement round-trip to Palo Alto (agentless response) | Pilot-ready | Pushes a real enforcement action back to the customer's own Palo Alto firewall when a correlated finding warrants it — a commit-less tag on the source host (via the firewall's User-ID API, enforced by a pre-agreed dynamic address group) for near-instant containment, plus destination blocking through the External Dynamic List and an on-demand list refresh. Every action can be dry-run first, previewing the exact request without sending it; every change names its own rollback; and every action is written to the signed audit trail before and after it runs. The firewall credential is fetched from the secrets service at call time and never stored in this service. Rule-mutating or commit-requiring firewall changes are deliberately excluded. Not yet exercised against a live Palo Alto instance. |
| Media provenance verification (C2PA Content Credentials) | Production-deployed | Verifies a Content Credentials manifest against the bytes it is attached to and reports five distinct states: no manifest, a manifest present but unreadable, a valid signature from a signer outside the deployment's trust list, a valid signature from a trusted signer, and a manifest that does not match the file. An unreadable manifest is kept apart from an absent one so that "we could not check" never renders as "nothing found". The mismatch state is the one hard positive in the media layer — cryptographic proof the file changed after signing, not a probability. A verified manifest prints the origin the file declares verbatim rather than a tick, because the most common verified result today is a trusted signature stating that a model produced the content. |
| Provenance claim consistency (container / codec against a stated origin) | Production-deployed | Checks what somebody says a file is against what the file says it is — "straight off my phone" against a container that names FFmpeg or an editing suite as its writer. Deterministic: no model, no training data, no probability. It runs only when a claim is actually made, and the set of claims it will check is closed, so a claim it cannot check is refused rather than answered. There is no "claim verified" outcome and there will not be one; the strongest result is that we looked and found no contradiction. |
| Synthetic-speech advisory signal | Roadmap | In build, not shipped. It will report indicators of synthesised speech as an advisory band next to a statement of what the model was not trained on — never a verdict, and never able to block on its own. We are training it rather than licensing one: every published detector we audited fails its licence chain at some layer, usually training data restricted to non-commercial research. No accuracy figure will accompany it. Video synthesis classification is planned and not built. It will ship advisory-only and will never name or describe a person: on real footage its most likely output is a false positive, so it is designed to be survivable when it is wrong. |
| Media-authenticity evidence records | Roadmap | The analyzer accounting is built: every media result names which analyzers ran and which were unavailable and why, so a failed analyzer reads as unavailable rather than clean. Persisting that as a retained compliance record — content and perceptual hashes only, never the media — is still to come. |
| Out-of-band verification attestation (wire / account-change approvals) | Pilot-ready | A payment above a threshold the firm sets is held until somebody phones the counterparty back on a number from the firm's own directory of record, and two named people who are not the initiator confirm it. The directory is the control: no code path anywhere turns a caller-supplied number into a callback target, so a counterparty absent from the directory produces a held payment and an explicit refusal to place the call. Approvers are emailed on hold, the queue records whether that notification actually went out, and a completed callback satisfies FINRA-FRAUD-1 on platform-observed evidence. The platform does not watch your payment rails: the system holding the payment posts an event to the ingress endpoint, and until a firm builds that one integration this control sees nothing and produces no record — a payment nobody sends looks exactly like a payment that cleared, which is why this reads Pilot rather than Production-deployed. CyberArmor holds no funds either — recording the outcome produces the evidence, and a resolution endpoint lets the system that does hold the funds poll for it. |
| AI output verification record (per-output supervisory evidence) | Roadmap | Planned shape: output and source hashes only (never the text), provider / model / model version, which checks ran and which were unavailable and why, and the policy disposition — sealed into the existing hash-chained tenant audit chain. It records what was checked, not a claim that the output is correct. Design brief in docs/specs/output-trust-scoring.md. |
| Deterministic output checks (schema, arithmetic, tool arguments, citation resolution, quoted-span match) | Roadmap | Schema, arithmetic, tool-argument, citation-resolution, and quoted-span checks, recomputable by an auditor from the same inputs — the output checks that can honestly be reported as a boolean. A permanent caveat ships with them: a citation URL that resolves confirms reachability, not that the source supports the claim, which is a model-judged question. |
| Groundedness of output claims against a supplied source | Roadmap | Planned to report the claim spans a supplied source does not support, with the detector model and version recorded — advisory, routed to human review rather than auto-blocking. It requires a source; where none is supplied the result is 'not checkable', shown plainly. Because published groundedness detectors sit near chance on hard cases, no accuracy figure accompanies it. |
| Trust score / confidence rating on AI outputs | Roadmap | This ships as the verification record above — which checks ran, what each returned, and what could not be checked — rather than a single number claiming an output is X% trustworthy. Confidence calibration differs more than tenfold between structured extraction and open-ended answers, so one field cannot be honest across both, and a model's self-reported confidence is not a usable signal. No pooled accuracy or calibration figure is published for our own classifiers. |
Consumer Surfaces
2Production-deployed31Pilot-ready2Configurable2Roadmap
| Capability | Status | Notes |
|---|---|---|
| Endpoint-installed AI-traffic proxy for native desktop apps | Pilot-ready | Covers native AI applications the browser extension cannot see — desktop clients and CLI coding agents — by inspecting that traffic on the endpoint with the same engine as the network proxy, held identical by a parity test. Survives captive-portal networks: the system proxy is stood down through the audited privileged-action broker so hotel and airport sign-in works, then restored. macOS and Linux; the Windows installer is not built. |
| Endpoint coverage reporting — the endpoint reports when it is not enforcing | Production-deployed | Coverage is asserted from three live authorities that must agree: the process is running, the port accepts a connection, and the OS network configuration points at it. File presence is deliberately refused as a signal. A newly connected network interface counts as a gap until proven covered. |
| Endpoint protection status indicator (macOS menu bar, Windows tray) | Production-deployed | Shows whether protection is running, with deliberately no pause, disable or uninstall — a user-reachable off switch on a regulated endpoint is an audit finding. It cannot fail green: staleness is judged on the worst of two independent clocks, and a missing, stale or unparseable status document renders as Stopped. |
| Endpoint agent (Linux / macOS / Windows) | Pilot-ready | Installs as a managed service with a scheduled-task fallback, restarts on failure, and refuses to double-start across Linux, macOS, and Windows. |
| AI-traffic coverage reporting (the endpoint says when it is NOT enforcing) | Pilot-ready | Reports whether AI traffic is being enforced and names any gaps by checking three live authorities — a running process via launchd, an accepting kernel port, and per-service network settings (Enabled, server, and port must all hold) — rather than a file on disk. The control plane derives status from the heartbeat, so an agent cannot self-report coverage it lacks. A coverage record confirms traffic reaches an enforcement point. |
| Local AI-traffic proxy (endpoint-installed MITM twin, opt-in) | Pilot-ready | Opt-in endpoint MITM proxy carrying the same implementation as the server-side proxy, held in sync by a parity test that runs the server copy. The operator installs it explicitly: it trusts a MITM certificate authority in the System keychain and reroutes the machine's traffic, and it refuses to run as root. Fail mode defaults to closed. |
| Clipboard redaction helper (native desktop apps) | Pilot-ready | Runs as its own LaunchAgent and evaluates clipboard contents through the policy client, redacting in place on a redact decision, clearing on a block, and reporting telemetry either way. Covers pasting into native desktop AI apps, which never traverse a network proxy. Redaction is scoped to the classes the policy decision returns. |
| Ransomware and mass-deletion detection (destructive-phase file behaviour) | Pilot-ready | Three behavioural signals over user-data directories, on by default: mass deletion (100 files in a 60-second window), mass encryption by rename (5 files renamed to known ransomware suffixes in 60 seconds), and in-place encryption (Shannon entropy at least 7.5 bits/byte over the first 4KB of rewritten text, source, config, and log files). Scope is each user profile's Documents, Downloads, and Desktop plus a temp directory. Detection reports and runs independently of response. |
| EDR response actions — host isolation and process termination | Pilot-ready | Executed through the audited privileged-action broker with validated parameters and an audit record on attempt and outcome. Host isolation is reversible by construction — each platform writes into its own named container (a pf anchor, a dedicated iptables/ip6tables chain, named netsh firewall rules), governs both IPv4 and IPv6, permits the control plane first, and refuses to isolate when the control-plane host cannot be resolved. Process termination refuses its own PID and its parent, so a response cannot disable the reporting agent. |
| Endpoint patch remediation (winget / Homebrew / apt / yum-dnf) | Pilot-ready | Entitlement-gated with maintenance windows, an approval workflow, and per-app auto-approve. Executed through the audited privileged-action broker. |
| Endpoint software-update inventory | Pilot-ready | Each endpoint reports upgradable packages with current and available versions for prioritization. |
| Endpoint signature / hash file detection | Pilot-ready | Scans new files against the synced detection intel feed, plus the binary hash corpora when an operator has pushed them. Fails open, keeping the endpoint running. |
| AI model artifact scanning (pickle, PyTorch, Keras) | Pilot-ready | Static parsing only: the pickle opcode stream is disassembled with pickletools.genops and the artifact is never unpickled, loaded, or executed. Covers raw pickle streams (.pkl/.pickle/.p, gzipped, joblib/dill), torch ZIP checkpoints including deflated members, and a narrow Lambda and marshalled-bytecode check for Keras .h5/.hdf5/.keras. Emulating the pickle stack and memo catches memoized module names reaching STACK_GLOBAL. |
| MCP server config inspection + shadow-AI inventory | Pilot-ready | Reads Claude Desktop, Claude Code, Cursor, and VS Code configs plus plugin-bundled .mcp.json files hourly, and the file monitor catches any config written under a watched path. Severity tracks how unambiguous the finding is, from inline shell (critical) to unpinned npx or a non-localhost endpoint (medium). Every configured server is inventoried — command, args, URL, and env key names only; env values never leave the endpoint. |
| NSRL known-good allowlist and large binary hash corpora | Configurable | An operator builds each corpus with tools/build_hash_corpus.py from an NSRL RDSv3 SQLite release and pushes it; the agent runs normally with or without one. Once present, corpora are sorted fixed-width digest files (MD5/SHA-1/SHA-256) searched in place by bisect over an mmap, with a file-size index that skips files no entry could match. A known-good hit suppresses content scanning of those exact bytes only, never behavioural judgement. |
| Captive-portal resilience watchdog | Pilot-ready | Detects captive portals and safely toggles the local proxy so the agent survives cafe, hotel, and airport Wi-Fi. |
| Chromium browser extension | Pilot-ready | |
| VS Code extension | Pilot-ready | |
| Office add-in (Word, Excel, PowerPoint, OneNote, Outlook) | Pilot-ready | |
| Python RASP | Pilot-ready | |
| Go RASP | Pilot-ready | |
| Java RASP | Pilot-ready | |
| Node.js RASP | Pilot-ready | |
| .NET RASP | Pilot-ready | |
| Ruby RASP | Pilot-ready | |
| Rust RASP | Pilot-ready | |
| PHP RASP | Pilot-ready | |
| C / C++ RASP | Pilot-ready | |
| Client SDKs — 9 languages (Python, Go, Java, Node.js, .NET, C/C++, PHP, Ruby, Rust) | Pilot-ready | Drop-in client libraries mirroring the platform API across all nine languages. |
| LangChain SDK wrapper | Pilot-ready | Routes LangChain LLM calls through the CyberArmor policy client. |
| LlamaIndex SDK wrapper | Pilot-ready | Routes LlamaIndex calls through the CyberArmor policy client. |
| iOS endpoint app (on-device DNS filtering of AI traffic) | Configurable | Native Swift app with a NEPacketTunnelProvider that observes and governs AI-bound DNS on the device, using the same enrollment, tenant policy set, and evidence path as the desktop agent. Running on physical hardware and distributed to testers via TestFlight. Governs domains only — prompt content is never inspected on iOS, and policies that require content render as advisory rather than enforced. Shadow-AI app inventory needs supervised devices under MDM and is not possible on unmanaged iPhones. |
| Android endpoint app (VpnService filtering, work-profile inventory) | Roadmap | Will provide VpnService-based filtering and work-profile inventory, following the iOS build and sharing the same policy, verdict, and evidence path as the desktop endpoint agent. Design brief written; no code yet. Android governs traffic at the domain level only — TLS payload inspection of third-party apps is not possible on Android in any deployment mode, managed or not. |
| macOS kernel sensor | Pilot-ready | Ships with the macOS endpoint agent. |
| Windows kernel minifilter driver | Roadmap | A kernel minifilter driver that adds file and process visibility once code-signed and loaded by its usermode bridge. File, process, detection, and policy enforcement run independently of the bridge. |
| OpenAI tool-use URL wrapper | Pilot-ready | Applies the URL Trust Gate to URLs surfaced by OpenAI tool use. |
| Anthropic tool-use URL wrapper | Pilot-ready | Applies the URL Trust Gate to URLs surfaced by Anthropic tool use. |
Robotics & Autonomous Systems (ROS 2)
9Pilot-ready3Roadmap
| Capability | Status | Notes |
|---|---|---|
| ROS 2 security agent | Pilot-ready | A standard ament_python node, running on a Raspberry Pi 5 with Ubuntu 26.04 and ROS 2 Lyrical Luth. |
| Topic graph monitoring and discovery | Pilot-ready | Discovers new topics, tracks publisher and subscriber membership changes, and checks per-topic publish rates against expected bounds. |
| Service guard | Pilot-ready | Flags security-relevant service exposure as it appears on the graph; parameter-mutation services such as /set_parameters are raised as CRITICAL. |
| DDS participant inspection | Pilot-ready | Watches the DDS discovery layer for participants joining and leaving, independently of topic-level monitoring, so an unrecognised node on a command topic is visible from both. |
| Actuator policy — observe mode | Pilot-ready | Evaluates every velocity command against speed, acceleration, rate, geofence and safety-zone policy and reports violations without altering what the robot receives. This is the default: the agent only observes, leaving robot motion untouched. |
| Actuator policy — interpose (enforcing) mode | Pilot-ready | Opt-in. The agent republishes the sanitised command on a separate topic that the motor driver reads, so a 9.0 m/s command against a 2.0 m/s limit reaches the driver as 2.0 m/s. |
| Latching emergency stop | Pilot-ready | Asserted over a dedicated topic, it zeroes every subsequent command regardless of magnitude until explicitly released. Rejected commands publish an explicit zero rather than being dropped, because most motor drivers latch the last velocity they received. |
| Sensor integrity monitoring | Pilot-ready | Checks LaserScan, Imu, Range, BatteryState and Float64 topics for out-of-range values, excessive rate of change, staleness, frequency drift, replayed sequences and — opt-in — a frozen sensor. A steady reading is not treated as an attack: a lidar facing a static scene or a battery at rest raises nothing. |
| Incident-based alerting with recovery | Pilot-ready | Repeat alerts back off in escalating intervals (tuned per surface — e.g. 5s → 30s → 5min for sensor faults, 1s → 10s → 60s for actuator events) and close with a recovery event, so a persistent fault is one bounded incident with a full count. Suppressed repeats are counted, never discarded. |
| ROS 2 policy sync from the control plane | Roadmap | Will pull control-plane policy down to the ROS agent's enforcing submodules. Enrolment and policy fetch work today; the install command exports CYBERARMOR_CONTROL_PLANE_URL, CYBERARMOR_TENANT_ID and CYBERARMOR_BOOTSTRAP_TOKEN, which the node reads as defaults while an explicit launch-file parameter still wins. |
| Launch-file and node provenance guard | Roadmap | Will validate launch files and node provenance against policy. The module ships in the package, pending validation on robot hardware. |
| Physical sensor and drive-train integrations | Roadmap | Exercised against synthetic and self-published topics; end-to-end integration with lidar, chassis and AI-accelerator hardware is planned. |
Status reflects the current codebase and hosted deployment as of 28 August 2026. Pilot-ready capabilities are available to design partners through a controlled onboarding. Configurable capabilities are implemented and tested — activate them with the noted API keys or operator configuration steps in the hosted SaaS stack or your own deployment. Contact us to request access or discuss deployment scope.