A watcher on every machine. A record in one place.
SILO.RED has two parts. An endpoint agent on each laptop and server watches what AI agents do there. Cortex, the control plane you host yourself, brings the estate together, decides what to do and keeps the evidence.
Watches agents where they act: on the machine.
A small agent on each macOS, Linux and Windows host. It uses each platform’s own instrumentation (eBPF on Linux, Event Tracing on Windows, Endpoint Security on macOS) to see what agents do, not just what they were asked.
Recognises every agent
Known agents such as Claude Code, Cursor, Copilot and Aider by signature. Anything else that calls a model and then spawns, writes or connects within a minute is treated as an agent too.
Learns each agent’s normal
A baseline per agent, trained on the machine it runs on. Drift from that baseline raises the score; behaviour alone can reach Observe but never more, so a busy day does not cut anyone off.
Notices credentials and data leaving
Sensitive files opened, decoy credentials touched, unusual volumes sent out, and guardrails such as “this agent may only write here and talk to there”.
Protects itself
An agent that can run commands can try to stop its watcher. SILO records what stopped it, keeps a copy of the program responsible, restarts itself and uses kernel-level protection where the platform allows.
Catches ransomware patterns
Bursts of near-random writes and renames, decoy files that nothing legitimate opens, and policies set per host, group or operating system.
Keys held in hardware
Each agent’s identity key lives in the TPM or Secure Enclave where the machine has one, and can be attested before Cortex will trust it.
It says what it cannot see.
A security tool that reports “all clear” when it is not looking is worse than none. SILO separates four states everywhere: nothing happened, nothing is watching, not available on this platform, and failed.
- Every capability reports whether it is active or limited, and why.
- A missing number is shown as missing, never as zero.
- An alert that cannot name the process responsible says so and moves nobody’s score.
- A stopped collector is reported as stopped, not as a quiet machine.
From a real alert
A decoy file was modified. A decoy exists only to be left alone; nothing legitimate opens it by name. Check what has been writing in that directory.
SILO cannot say which process did it: this is a hash comparison run on a timer, not an observed write, so no agent’s trust deficit has moved.
The control plane, in your own estate.
Cortex runs on your servers or in your own cloud account. It scores findings from every host, decides on a response, routes the serious ones to an operator and keeps the record.
Correlation across the estate
Findings from many hosts are joined by agent and by host, so the same pid on two machines is never mistaken for one process, and one agent’s activity is never scored against another.
Operators in the loop
Three modes, from advisory to autonomous. In the default, isolation and termination wait in an approval queue, and every decision is recorded with who made it.
Policy where it applies
Guardrails, agent rights and ransomware policy set for the whole estate, an operating system, a group or a single host. Each host reports which policy it holds.
Federation
A child Cortex for a subsidiary, region or managed-service client reports its fleet to a parent, each separately licensed, over mutual TLS.
Sign-in your security team will accept
Single sign-on through OIDC with multi-factor enforcement and group-to-role mapping, and passkeys held in the device’s security chip.
A model, if you want one
Cortex can ask a language model to explain an agent’s timeline. It uses a model on your own hardware unless you choose otherwise, and its view is advisory: it never acts by itself.
Agents in containers and cloud accounts, not only on desktops.
Many agents run as pods or on cloud instances. SILO watches them there and responds with the controls those platforms already have.
Kubernetes operator
A native operator with its own resources for agents, policies and tenants. It watches pods through Falco and eBPF, finds agents running in containers, and reports to Cortex like any other host. Responses use Kubernetes’ own tools: a network policy to cut a pod off, eviction, or cordoning a node.
AWS, Azure and Google Cloud connectors
Cortex reads flow logs from your cloud accounts to see where agents’ traffic goes, and can isolate an instance or block a source at the edge, using your provider’s own controls and your own credentials.
From one developer’s laptop to a federated estate.
Cortex and endpoint agents
For organisations putting agents into production. Self-hosted control plane, agents across the estate, the governance record and report. Sized by the number of agents watched.
Ask about a trial →Child Cortex for providers
For managed-service and cloud partners who look after many smaller clients: a Cortex per client, federated to the partner’s own.
Become a partner →For developers
SILO on a single Mac, Linux or Windows machine, with its own local console: see what your coding agents spawn, touch and call, and stop one that misbehaves.
Register interest →The same discipline on a single machine.
The standalone edition carries its own console: every agent on the machine, a map of what each one calls, spawns and touches, guardrails and alerts. Settings are sealed with the device’s hardware key.
A security product has to be harder to attack than what it watches.
Mutual TLS throughout
Agents enrol with a certificate Cortex issues and an administrator approves. A revoked certificate is refused at once.
No switches left open
Customer builds cannot be put into a development mode from a setting: no anonymous access, no plaintext, no skipped checks.
Signed updates
Updates are verified against a key compiled into each build before they are staged. An operator can decline one, not redirect it.
Tamper-evident record
Events, scores and responses are chained with a keyed hash, so a deleted or edited row is detected and named.
See it against your own agents.
We will run SILO beside your existing tools on a handful of machines and show you what your agents actually do.