Research
We publish measured results and original analysis. Everything here is reproducible: we give you the method, then the numbers.
Detection-accuracy benchmark
Security tools are only as good as what they actually catch. We benchmark our own detection the honest way: plant a fixture of known issues alongside clean controls, run the real collector/adapter against it, and measure recall (planted issues detected) and false positives (findings in clean files). No estimates.
| Capability | What’s measured | Recall | False positives |
|---|---|---|---|
| Endpoint sensor — discovery | API keys, MCP configs, AI CLIs/SDKs, local skills across a planted $HOME | 100% | 0 |
| Source Code Analysis (SAST) | Planted vulnerabilities vs clean controls | 100% | 0 |
| Secret & Credential Scan | AWS/GitHub/Slack/Stripe/OpenAI keys + private keys | 100% | 0 |
| Dependency / Supply-chain (SBOM) | Vulnerable + typosquatted packages vs safe pins | 100% | 0 |
| Container & IaC posture | Misconfigurations vs hardened baselines | 100% | 0 |
| AIBOM & License/Provenance | Model files, pickles, copyleft licenses, unpinned revisions | 100% | 0 |
| Agent skill content | Planted SKILL.md files with shell execution, elevated-privilege steps, hard-coded credentials and embedded scripts vs benign skills | 100% | 0 |
| AI runtime stack | RAG apps, vector databases and orchestrators identified, including in-house components, vs unrelated services | 100% | 0 |
Each capability was tuned iteratively (baseline → measure → fix → re-measure) and the benchmark caught real bugs along the way. Skill content is analyzed on the host: only boolean flags are recorded, never the raw file, so a planted hard-coded key is detected without the secret ever leaving the machine.
These are fixture-harness results: planted issues against clean controls. They are a regression test, not a field-accuracy claim. The Detection quality page in the product reports the result for each detector against a labeled corpus, versioned to the detection content: currently 91% overall recall and 100% precision on 69 samples, with the known misses listed.
The Shadow AI Risk Index
A repeatable way to score an organization’s agentic exposure. The Index combines five weighted surfaces into a 0–100 score, so posture is comparable over time and across business units:
| Surface | What it captures |
|---|---|
| Unsanctioned AI | Agents, CLIs, SDKs and apps running without approval, weighted by reach. |
| MCP & tool exposure | MCP servers and the blast-radius of the tools they expose (file, network, credential access). |
| Secret exposure | API keys and tokens reachable by AI processes, weighted by provider and scope. |
| Egress & data flow | Sensitive data paths to external AI endpoints; DLP coverage. |
| Governance gap | Attribution, offboarding, and framework-control failures (OWASP LLM / NIST AI RMF / EU AI Act). |
The Index is a framework we are publishing for comparing agentic exposure; it is separate from the platform’s posture score, which is a severity-weighted number (open risks by severity, normalized per host). Roadmap Offering the Index as a second score in the product. The full specification ships with the flagship report below.
The State of MCP Security 2026
Our flagship landscape report covers the MCP threat taxonomy (tool poisoning, confused deputy, slopsquatting, over-scoped tools, tool-output injection), what the public advisory record shows, the Shadow AI Risk Index specification, and our measured detection results. It draws on published advisories, incident reports and our own benchmarks: no invented telemetry.
Our benchmark fixtures and method are documented: request them with an assessment enquiry and we’ll walk your team through the harness.
See the AI on your fleet in about a week.
Run the sensor across your estate and receive an AI risk report and an AI Bill of Materials. The assessment is free and carries no commitment.