Architects should not have to reconstruct our architecture from paragraphs. Here are the four diagrams that matter — the data pipeline, the enterprise AI attack path we defend against, the trust boundary, and the separation between observation and enforcement.
1 · Platform data pipeline
Endpoint to response. The sensor is read-only; secrets are masked and command lines scrubbed before anything leaves the endpoint; classification can run on an in-VPC model; and every finding is scored, attributed and routed to your SIEM/SOAR and ticketing.
2 · Enterprise AI attack path
What we test and defend against. Modern AI systems chain an app, a retrieval layer, a vector store, an agent, and MCP tool servers — each hop is an attack surface. The red callouts are the failure modes our Full AI Red Team and continuous testing target.
3 · Trust boundary
What stays, what leaves, what's encrypted. Raw files and secret values never leave the endpoint. Only masked metadata crosses the wire over TLS. Console data is encrypted at rest — or, with the in-VPC option, never leaves your AWS account at all.
4 · Response architecture
The boundary CISOs ask about. Observation and response are separate by design — the discovery sensor cannot act. Today, response runs through the content-DLP policy engine, remote-pause and device revocation (a stolen/rogue device is cut off server-side and can't re-enroll), device attestation against the published sensor releases, and your SIEM/SOAR and ticketing — all operator-authorised. Deeper endpoint enforcement (killing a rogue agent process, inline browser DLP that blocks a prompt before it sends) is on the roadmap and will run through that same separate, opt-in channel — so a read-only sensor and a real response path stay separate, without contradiction.