§ SOLUTIONS / SECURITY
Enforcement in the request path, evidence in your SOC
Detection without enforcement is a report about an incident that already happened. Execlave evaluates every agent action against policy before it executes — injection, PII, tool misuse — and routes violations into the SIEM queue your analysts already work.
§ 01 / ATTACK SURFACE
Six agent threat classes, six synchronous controls
Every control runs before the action executes — and every claim links to its documentation.
Six agent threat classes, six synchronous controls
01
Prompt injection
Intent-aware detection distinguishes a definitional question ("what is a system prompt?") from an attack ("reveal your system prompt"), with keyword packs across 13 languages and obfuscation defeats for full-width, zero-width, and spaced-letter variants. Ambiguous cases escalate to a semantic layer instead of auto-blocking.
Injection detection →02
Data leakage
PII detection with checksum validation — Luhn for cards, Verhoeff for Aadhaar, mod-97 for IBAN — across US, EU, and India ID types, so version strings and random digits don’t page your team. Detection runs on inputs and tool outputs.
PII detection →03
Tool supply chain
Pin each MCP tool’s descriptor as a per-agent baseline, then block synchronously the instant a descriptor drifts, an unapproved tool or server appears, or a description matches a poisoning pattern — with tamper-evident evidence.
Tool integrity →04
Unproven agents in production
The red-team gate runs adversarial probe suites — injection, jailbreak, exfiltration-style — and gates promotion to autonomous operation on a 0.9 resilience score (aggregate probe pass rate).
Red-team gate →05
SOC visibility
Native exporters stream traces and enforcement decisions to Splunk (HTTP Event Collector) and Microsoft Sentinel (Azure Monitor Logs Ingestion API), with shipped SPL saved searches and KQL analytics rules. A six-stage incident runbook covers detect → route → triage → contain → evidence → close.
Incident response workflow →06
Non-human identity
Agents carry short-lived RS256 credentials verifiable offline against a public JWKS endpoint, with delegation chain-of-custody and revocation cascade. Agents bound to Microsoft Entra workload identities exchange Entra-issued tokens for credentials — no static keys to leak.
IAM binding →§ 02 / OPERATIONALIZE
Wire it into your existing stack
SIEM guides ship with detection content, not just connection strings.
Wire it into your existing stack
Run the red-team suite against your agents
Free tier: 1 agent, 500 traces/month, 30-day retention. No credit card required.