Products / 02 · NativeAI Guard Agent DLP & Firewall
Real-time protection for the AI you run: internal agents and RAG pipelines, autonomous workflows, customer-facing chatbots and voice agents. Every prompt and every response is inspected before the agent acts on the input or delivers the output.
NativeAI Guard inspectsAPI PROXY · CHCapabilities
Web pages, documents and emails your RAG pipeline ingests can contain hidden adversarial instructions the agent would otherwise execute. NativeAI Guard detects and blocks them before the agent acts.
Callers and external users probe your agents to bypass their rules, extract data, trigger unauthorized actions or pull out system prompts. NativeAI Guard stops the bypass attempt, not just the known pattern.
Every agent output is inspected before delivery. A response that contains another customer's data, a system prompt or sensitive internal content is withheld, data exfiltration prevented at the last line.
Harmful, abusive or legally risky content is filtered out of customer-facing agents before it reaches a customer, with continuously updated detection models, without disrupting live workflows.
Seen in the field
A caller talks your customer-service voice agent into reading out another customer's details. No exploit, no malware, just a conversation. Voice agents in banking and insurance are the most rewarding target.
Your RAG pipeline ingests a web page (or a supplier PDF) with instructions hidden in the content. The agent obediently redirects, leaks context or rewrites its own rules. This is XPIA, and it is invisible to traditional tools.
Air Canada's chatbot was talked into promising an unauthorized discount, and a court held the airline to it. A customer-facing agent that can be talked into commitments is a commercial risk, not just a security risk.
AI-to-AI interaction without a human in the loop is my biggest concern.
CISO · Swiss cantonal administration
Compliance mapping
Policy engine
An agent is one more actor sending data to a model, only faster and with nobody to pause and think first. It reads from your systems, calls a model, acts on the answer. The rule that stops an employee pasting a customer file into ChatGPT is the same rule that stops an agent putting the same record into a prompt. You only have to define it once, in plain language.
Your policies live in a single console. You do not maintain one rulebook for employees and a second, quietly diverging one for your automation.
The browser extension covers your employees, the API proxy covers your agents. Same detection engine, same policy language, same actions.
Human and agent activity land in the same log, so the question of who sent which data to which model has one answer instead of two systems to reconcile.
The obligations under the Swiss DSG, GDPR and the EU AI Act that apply to everyone are covered from day one. Written by us, reviewed with security and compliance practitioners, and not left as an exercise for the customer.
Banking secrecy, medical secrecy, insurance secrecy, plus public-sector and critical-infrastructure duties. The industry-specific cases are already modeled, so you start from a working set rather than a blank page.
When a regulation changes, we update the standard policies and you receive them. Keeping up with the law is our job, not another item on your security team's list. It is included in the subscription.
Everything above concerns data leakage: what your agents may send, and to which model. Traffic in the other direction is inspected too, and that part is entirely ours to run. Prompt injection blocking, jailbreak protection and filtering of harmful outputs are built in, tuned by us, and adapted as the attacks change. We follow the research coming out of academia and from other vendors continuously, because this field moves in weeks rather than years, and improvements reach you as part of the service. There is nothing here for your team to configure and no rulebook of your own to maintain.
Hand us your data protection regulations, your information classification policy, your internal AI directive, plus a few examples of how your data is structured and which systems your agents are allowed to reach. We turn them into customer-specific policies alongside the standard set and tune the detection to your systems, so you start from a working configuration rather than an empty one. That is the groundwork, and it is where our work ends and yours begins: every policy we deliver can be edited in your admin interface, and you write new ones there yourself, in the same plain language, without waiting on us.
Deployment
Most customers start on our Swiss infrastructure because it is faster to prove the value. Regulated environments that cannot send anything outside their own network run NativeAI Guard on their own hardware.
Our servers, our datacenter, Lausanne
Best for: proving the value quickly, and for organizations for whom processing in Switzerland is already sufficient.
Your hardware, your network, your keys
Best for: classified data, air-gapped networks and policies that prohibit any external processing.
Common questions
Yes, and this is exactly the case the browser extension is not built for. NativeAI Guard runs as a drop-in API proxy between your systems and the model providers. You point the agent at the proxy instead of the provider endpoint, and inspection starts, with no change to the agent logic. This is the channel that most commonly has no controls on it at all, because neither your proxy nor your CASB sees it, and this information never flows through a browser.
Both directions. Inbound, we inspect what reaches the model, including indirect injection carried in retrieved documents and web content that an agent ingests without a human ever reading it. Outbound, we inspect what the model produces before it acts or is returned. For an autonomous agent the input is as dangerous as the output, which is why we treat neither as trusted.
Through API keys today, scoped per agent, with the full audit trail attached to the key. Registry-based agent identity and governance, where each agent carries a verifiable identity independent of its access key, is on the roadmap. It got there because a cybersecurity architect at a large industrial company walked us through what agent identity has to look like at their scale, and that is exactly the kind of input that shapes what we build next.
Inspection runs in the low hundreds of milliseconds and happens inside Switzerland, so no round trip leaves the country to perform it. For an interactive agent that is generally not perceptible against model response times, but the honest answer is that it depends on your policy set and payload size, and it is one of the things a pilot phase measures on your own traffic rather than on ours.
Into the tools your SOC already runs. Events stream out to your SIEM, and one-way export into Microsoft Sentinel is the pattern most Swiss customers ask for, because they build their own alert rules there. Incident routing into ticketing systems such as Jira and ServiceNow is on the roadmap. We do ship dashboards of our own, but if you prefer other tools, you can stream the audit log data into the tool of your choice. Our dashboards cover two things a SIEM will not show you on its own: AI governance, meaning which tools are in use, by which parts of the organization and what is being sent to them, and the AI-specific threats, meaning prompt injection and jailbreak attempts, blocked exfiltration, and policy overrides with the justifications given. That is the view management, a data protection officer or an auditor usually asks for.
A 45-minute session with the founders, online. We run an injection attempt against an agent and show you what stops it. In the pilot phase that follows, you test NativeAI Guard with your own agents, your own traffic and your own use cases.