AI is joining every team, every workflow, every decision. We believe that should be a source of peace of mind, not anxiety: AI should increase human capability without ever taking away human control. CyberArmor exists to make that control enforceable, observable, and provable, in real time.
The thesis under everything we build: nothing untrusted should reach a model unchecked, nothing sensitive should leave unchecked, nothing insecure should ship unchecked, and consequential decisions should leave evidence. Not promises: enforcement that runs before the model reads and after it responds, and evidence that survives scrutiny.
Stop untrusted content before it influences AI.
Hidden instructions, hostile pages, and poisoned context are evaluated before ingestion, for every consumer: human or AI.
Prevent sensitive information from leaving.
Secrets, credentials, and regulated data are redacted according to your policy before a prompt leaves the protected surface.
Control what AI can return and do.
Insecure and policy-violating output is blocked on the way back, with evidence recorded for the documented enforcement paths.
Gate In. Govern Throughout. Prove What Happened.
Three controls, one loop. The Pre-ingestion Trust Gate filters harmful, poisonous, and untrustworthy content before a model ingests it. Smart redaction catches sensitive data on its way into a prompt. And on proxy surfaces, model responses are inspected on the way back: insecure output is redacted or blocked according to your policy. Input, output, and everything between, under one rulebook.
01Gate in
URLs and external content evaluated before any consumer ingests them: person, app, agent, or model context
02Detect
Prompt injection, hidden instructions, secrets, PII, dangerous output
03Enforce
Allow · warn · redact · sandbox · block · isolate, by tenant policy
04Redact out
Secrets and sensitive data removed before a prompt leaves the building
05Prove
Recorded decisions sealed into a hash-chained, tamper-evident ledger
Redaction, before the prompt leaves
BEFORE
Summarize this log: OPENAI_API_KEY=sk-EXAMPLE-not-a-real-key and password=example-password-123AFTER
Summarize this log: OPENAI_API_KEY=[REDACTED-OPENAI-KEY] and password=[REDACTED-PASSWORD]Evidence: decision=ALLOW_WITH_REDACTION, policy=redact-secrets, findings=OPENAI_API_KEY/PASSWORD, raw secret preview suppressed.
Illustrative sample: the credential shown is deliberately fake.
Output is governed, not just observed
Most tools only inspect what users send. CyberArmor also inspects what the model returns: shell-execution patterns, script injection, browser-data exfiltration sinks, and ransomware-shaped generated code (OWASP LLM02). Response inspection ships on the proxy surfaces; the browser extension, SDK, and RASP surfaces carry request context only today — stated up front on the status page, not buried in a footnote.
Evidence bound to enforcement
Recorded policy decisions, allows included, are sealed with the evidence that produced them into a hash-chained, tamper-evident ledger; the register says which enforcement paths write to it. When an examiner asks how a control operated, the answer is a record, not a recollection.
Two Directions. One Duty.
Almost every AI security product defends the enterprise from the model. We believe that is half the job. AI systems are attacked through what they read, so CyberArmor guards both directions: the Pre-ingestion Trust Gate evaluates content before any consumer ingests it, human or AI, and on the way out 30 redaction classes, model-response inspection on the proxy surfaces, and seven graded policy actions govern what leaves. Trustworthy data in. Safe output out. Humans in command throughout.
Read the full thesis
AI-generated illustration: content presses the boundary from both directions. The boundary holds. Content Credentials (C2PA) embedded.
Source: IBM / Ponemon Cost of a Data Breach Report 2026 →
Traditional URL filters were built for human browsing.
Safe Browsing, SmartScreen, and VirusTotal answer “is this site malicious for a human?”, not “is this content safe for an AI to ingest?” A page can look harmless while hiding instructions where only an AI will read them: CSS-hidden text, zero-width encoding, metadata payloads. That is the attack class the OWASP GenAI Security Project catalogues as indirect prompt injection.
How the gate closes itDon't Take the Deck's Word for It.
The URL Trust Gate runs end-to-end today. Your reviewers can verify the behavior directly on a laptop, from a public repo, in about 15 minutes. No sales call required.
The 15-minute local PoC
- Full gate stack on any developer laptop: detection, policy, evidence
- Four crafted attack pages: benign, CSS-hidden promptware, zero-width injection, credential-harvest
- Live verdicts under 120 ms: allow, warn, redact, sandbox, block, isolate
- Hostile pages detonated in a sandbox, never fetched blind, with reputation feeds layered on top
Verdict latency is a live spot measurement against app.cyberarmor.ai, not a percentile benchmark.
The 2-minute overview
The missing security layer, explained in two minutes: what CyberArmor gates, what it redacts, and what it can prove.
Flagship Proof — ROS 2 Robotics
We don't just flag prompts. We stopped an actuator.
A 9.0 m/s velocity command against a 2.0 m/s policy reached the wire as 2.0 m/s, and 0.0 under emergency stop. Verbatim transcripts from the Raspberry Pi 5 validation session.
Infrastructure Gets Inspected.
Nobody audits a marketing site. Everybody audits infrastructure. So we publish the audit surface ourselves: 68 capabilities in a public register, each carrying its honest label, with limits written into the entry rather than discovered in month three of a deployment. The Windows kernel minifilter driver is not yet code-signed and does not ship; SOC 2 certification is planned, not attained. Everything else is on the register.
68 capabilities, each labeled honestly
Full register →Peace of mind is not a feeling we ask you to have. It is a ledger you can check.
Available Today
- The policy engine and detection: prompt injection, 30 redaction classes, dangerous output, toxicity
- The compliance engine: 17 framework policy packs with persisted, tenant-scoped evidence
- Hash-chained audit ledger, agent identity with delegation and revocation, AI provider routing
- Enterprise single sign-on and MFA, with every event resolved to a real named user via your directory (Entra ID, Okta, Ping, AWS)
- Document and image inspection with offline OCR (PDF, DOCX, XLSX, PPTX)
- Every AI component inventoried and scanned for vulnerabilities, prioritized by known-exploitation and exploit-prediction data
In Pilot / Design Partner Phase
- Endpoint agents on Windows, macOS, and Linux, with policy-gated patch remediation
- The URL Trust Gate with detonation sandbox, the same stack the local PoC runs
- Browser, VS Code, and Office extensions
- RASP and SDKs in 9 languages
- SIEM forwarding: 6 connectors (Splunk, Microsoft Sentinel, IBM QRadar, Elastic, Google SecOps, syslog/CEF)
- The ROS 2 robotics agent, validated on physical hardware
Media authenticity and deepfake-enabled wire fraud are addressed on their own terms: the media & transaction integrity position →
Compliance as a shipped product, not a badge.
17 framework policy packs across 18 registered frameworks and 290 controls run in the production compliance engine, with examiner-ready exports. Four of them are the packs regulated financial buyers ask about first.
SEC Cybersecurity
Shipped policy pack
FINRA Cybersecurity
Shipped policy pack
NYDFS 500
Shipped policy pack
ISO/IEC 42001
Shipped policy pack
Deploys self-hosted (Docker Compose or Kubernetes), in your own cloud, or hosted, including fully offline / air-gapped operation with no vendor egress. SOC 2 certification itself is on the roadmap, not attained.
See the full capability statusWhy I built CyberArmor.
A career across application, data, cloud, identity, and AI security, on both the enterprise and vendor sides of the table, taught me one thing: security policy matters only when it becomes enforceable. And AI changed the thing security has to protect. Trust itself.
AI systems act on information they did not create and cannot verify. People are asked to tell authentic communications from synthetic ones. Organizations adopt AI faster than governance can follow, and autonomous agents read, decide, and act at machine speed. I did not believe another dashboard was the answer.
So I did not start with a pitch deck. I started writing code: infrastructure that governs what AI can trust, what it can access, what it may disclose, and what it can send back, with recorded decisions sealed to a tamper-evident ledger. Keep humans in control of AI, and make that control provable.
Conviction is easy to claim. I turned mine into working software, and made the evidence public.
Patrick M. Kelly Jr. · Founder, Chairman & CEO
Book a working sessionSecurity practitioner
Built from application, data, cloud, endpoint, identity, and AI security operating problems.
Hands-on builder
Rooted in working controls, tests, demos, runbooks, and deployment paths instead of slideware.
Enterprise lens
Designed for regulated environments, uneven ownership, legacy systems, and real security-team workflows.