Prevent. Repair. Defend. Hunt.
Most AI security stops at prevention. When prevention fails, damage is not optional. Only accountability is. Vigil runs four modes simultaneously, with an emergency Kill Switch across every tier, and the only Execution Gate on the internet that can hold an AI action mid-flight.
Running in parallel
Pre-execution Gate
Local · OAuth · Network
Court and insurance
Defense has four failure modes. So does Vigil.
Any AI defense layer that ships only prevention has accepted that failure is permanent. Vigil rejects that premise. Each failure mode of defense gets a dedicated mode of response. They run in parallel. They share one engine.
Shield.
Prevent + Audit
Every AI interaction intercepted. Every action decomposed on two surfaces. Every decision logged to a tamper-evident chain. Shield is the baseline mode. It runs on every tier, from Guardian on day one, and its evidence is the substrate every other mode builds on.
Content injection, now measured.
Google DeepMind researchers documented commandeering of AI agents in up to 86 percent of tests with human-crafted prompts hidden in web content. Adversarial instructions embedded in HTML metadata and aria-label attributes altered agent outputs in 15 to 29 percent of cases. The surface is machine-parseable content the human never sees.
A research AI pulls a public page. Instructions buried in the markup exfiltrate calendar entries, contacts, and financial context, phrased as onboarding. The provider call looks identical to a legitimate one. The only evidence is the damage, weeks later, with no audit trail to trace.
Repair.
Correct + Rollback
When prevention fails, the question is no longer whether damage happened. It is how much damage is still reversible. Repair holds high-risk actions pre-execution via the Execution Gate, rolls back where providers allow, and seals court-admissible evidence either way.
Memory poisoning, now costed.
Google DeepMind researchers document RAG knowledge-base poisoning with attack success rates exceeding 80 percent at less than 0.1 percent corpus contamination. A handful of planted documents. The agent treats attacker-controlled content as verified fact, across every downstream query that touches the poisoned entries.
An advisor AI reads a planted filing and rebalances $340K on tax logic that does not exist. Compliance flags it 47 days later, long after the window to reverse. The carrier asks for the decision path. There is none. Claim denied. The loss is final.
The Execution Gate. Hold an AI action mid-flight.
The only place on the internet that can stop an AI agent between decision and action. No provider ships this because no provider can hold their own outbound request. Vigil sits outside every provider. That is the reason the Gate exists at all.
Detect
- Agency category scored
- Scope class evaluated
- Baseline drift measured
- Cross-surface correlation checked
Hold
- Action held at proxy
- Mobile push dispatched
- Diff surfaced to user
- Countdown to auto-cancel
Resolve
- Approve: action released
- Deny: action cancelled
- Timeout: auto-cancel
- VOAF sealed either way
Every frontier lab can detect agent anomalies. None of them can hold an outbound request from their own model. The action is already on the wire by the time their model has decided.
Vigil sits at the TLS boundary between the user's device and the provider. That single architectural fact is what makes the Gate possible. The patent protects how we use that position to decompose, score, hold, and resolve a live action without breaking the provider contract.
This is not a feature any frontier lab can replicate from inside their own API. It is the reason the defense layer must come from the outside.
Sentinel.
Defend + Deter
Persistent adversaries do not fire once. They probe, iterate, and adapt to your baseline. Sentinel assumes the adversary is learning and responds by doing the same thing first. Continuous behavioral monitoring. Adversary fingerprinting. Honeypot endpoints that make every attack expensive for the attacker and evidence for the defender.
Probe, adapt, succeed.
A threat actor targets a finance executive. First attempt is flagged and blocked. Second attempt learns from the block and slips past. Third attempt is inside the baseline.
Static defense is perfect the first time, adequate the second, blind the third. The adversary wins by patience. You do not get a second chance to notice the pattern.
Warden.
Hunt + Reclaim
A threat to one user is a rehearsal for a thousand. Warden turns every Vigil deployment into a sensor for the network. Anonymized attack signatures feed a shared intel layer. When one user is attacked, every other user is pre-defended. Every new user makes every existing user safer. That is the moat.
Systemic trap, cascading.
Google DeepMind's fifth trap category covers systemic attacks that weaponize multi-agent dynamics. Coordinated environmental signals push one compromised agent into cascading failure across an ecosystem. The paper also documents behavioral-control exfiltration against Microsoft M365 Copilot succeeding in 10 of 10 tested scenarios. Attack kits are reproducible. Defense is not, unless it is shared.
An adversary refines one trap against one user, succeeds, and sells the kit. It hits the next user the same week. Then the next. Each defender meets it as novel. The attacker's work compounds. The defender's does not.
One tap. Every AI. Every provider. Every token.
When containment is not enough, revocation is. The Kill Switch is three layers of cryptographic cutoff that can be triggered from the mobile app, the desktop app, the mobile approval notification, or automatically by policy. No other AI security product ships this.
Three layers. Sub-second to Layer 1. One hour to last trust expiry.
Layer 1 takes effect locally in under a second. Layer 2 cascades OAuth and API keys across every connected provider in parallel. Layer 3 revokes network trust with 1-hour certificate expiry and a dead-man switch if Vigil itself goes offline.
- Proxy halted
- In-flight calls killed
- Local TAP invalidated
- Engine cold-start required
- OAuth tokens revoked
- API keys rotated
- Delegated creds pulled
- Provider confirmations logged
- VARP broadcast initiated
- TAP cert 1-hour TTL
- Dead-man switch armed
- Network trust withdrawn
The Kill Switch is not a feature. It is the contract that says you can always get out. No provider, no insurer, no regulator gives you that. Vigil does.
The same attack. Side by side.
Two attack patterns reconstructed from documented incidents. The left column shows what happens without an independent defense layer. The right column shows what Vigil does when the same attack starts.
Reconstructed from documented incidents. Outcomes modeled, not customer-reported.
Reconstructed from documented incidents. Outcomes modeled, not customer-reported.
Four modes. One Gate. Your move.
Every mode ships today. The Gate is live. The Kill Switch is wired. Install on your Mac or route your cloud agents through Gateway today.