Every AI agent in your estate, watched as it runs.
SILO.RED finds the AI agents on your laptops and servers, learns how each one normally behaves and responds in proportion when one drifts. Every decision is recorded, so you can show the board and the regulator that your agents are under control.
Agents now act with your people’s permissions.
Coding assistants, customer-service agents and finance bots no longer just answer. They read files, run commands and call out to the network, with the rights of whoever started them.
They act on the machine
An agent with a shell can open credentials, start other programs and send data out. Nothing about that is unusual for the user it runs as, which is why it passes unnoticed.
The usual controls look elsewhere
Prompt filters and API gateways see what an agent was asked. Endpoint tools see processes, each inside its own vendor’s platform. Few see what an agent then did, across a mixed estate.
Nobody can show the evidence
Boards, auditors and regulators now ask for proof that AI policy is followed. Most organisations cannot say which agents are running, never mind what each one did last Tuesday.
The first agent collective to break in, and what it teaches.
In July 2026, agents under evaluation escaped a sandbox through a trusted package server and reached Hugging Face’s production systems. We set out what happened, why every step looked permitted, and what SILO does about it, stage by stage, including what it does not.
The five questions a board asks, answered from one screen.
Which agents are running?
An inventory of every agent, on every host, recognised by what it is and how it behaves.
What may each one do?
Rights and guardrails per agent, set centrally and pushed to each host.
Is it staying within that?
A compliance status per agent, with every breach recorded.
Who approved the serious actions?
Isolation and termination can be made to wait for a named operator.
Can we prove it?
A tamper-evident record, and a report for the board in one click.
Recognise. Measure. Respond in proportion.
A small agent on each machine watches what AI agents do. A control plane you host yourself brings the estate together and keeps the record.
Find every agent
Known agents by signature, and unknown ones by behaviour: a process that calls a model and then acts on the answer is treated as an agent, whatever it is called.
Score the drift
Each agent learns its own normal. A Trust Deficit Score rises with evidence across several dimensions (files, network, processes, credentials, intent) and falls again when the agent behaves.
Act, and write it down
The response matches the evidence, from recording to stopping the agent. Every finding, decision and approval lands in a hash-chained record.
Earned by evidence, never by one detector firing.
Agents climb and fall on what they do. A rung is reached by evidence across several dimensions, and the response is never harsher than the narrowest action that would contain the agent.
Thresholds are the defaults and can be set per estate.
Observe
Recorded and watched more closely.
Restrict
Network or rights narrowed; the agent keeps running.
Isolate
Paused and cut off, reversibly.
Terminate
Stopped, with its executable kept for analysis.
One view of every agent, for the SOC and for the board.
The Cortex console, running against our lab estate of simulated hosts.
The estate at a glance
A wall display for the security operations centre: every host and agent, the score across the estate, breaches and what is waiting for approval.
- Agents grouped by platform and cloud
- Risk heat map by agent
- Governance figures read from the record, not estimated
Posture for the people who answer for it
The executive view: how many agents, how far the riskiest has drifted, what is awaiting a decision and which MITRE ATT&CK tactics have been seen.
- Highest trust deficit, by agent and host
- Response posture by band
- Exportable report
Every event, searchable
Analysts can follow an agent from a guardrail breach to the file it opened and the connection it made, filtered by tactic, agent or event type.
- Findings separated from routine telemetry
- Quick hunts for credentials, exfiltration and anti-tamper
- Export for your own tools
The report the board reads
Compliance rate, management signals and the inventory of running agents by vendor and operating system, over the window you choose, with a PDF one click away.
- Breaches counted from the record
- Hosts without a current policy named
- Daily snapshots show the trend
Bought by the people who answer for AI risk.
IT runs SILO. Risk, compliance and operations are the reason it is there.
Prove to the regulator and the board that your AI agents are under control.
An inventory, the rules each agent runs under, every breach and who approved what.
Move AI agents into production without carrying a risk you cannot measure.
Claims, finance operations, customer service and bid handling, watched as they run.
Approve agents onto your estate with a control that runs itself and records everything.
Self-hosted in your own cloud account, alongside the tools you already run.
Your infrastructure, your data, your SIEM.
Sees model traffic at the gateway
Model requests passing through your API gateway are joined to the host and agent that made them. Kong, with adapters for Azure API Management, Google Apigee and AWS. Bodies are dropped; only metadata is kept.
Holds tool calls for approval
For agents that use MCP tools, each call can be checked against policy before it runs, with sensitive tools held until an operator approves them once.
Why SILO.RED exists.
The idea behind SILO: AI agents are a new kind of insider, and someone has to watch what they do once they are let in.
Put your AI agents under governance before the regulator asks.
SILO.RED runs today. We are working with a small number of design partners ahead of general availability, and there is room for a few more.