Discovery scans are open for pilot groups

One platform for every AI agent, wherever it runs.

Surface watches AI on every device and browser. Radar connects to the AI platforms in your cloud. Both feed one inventory, one risk score and one policy.

Book a demo Take a tour
01Two sensors

Surface on the device. Radar in the cloud. Together they cover where agents actually run.

Surface

Device sensor

A lightweight agent on every managed device, plus a managed browser extension. It sees AI where it runs, including AI that never leaves the laptop.

macOS · Windows · Linux · browser extension
  • Local models, MCP servers, skills, CLI and IDE agentscursor-agent → mcp:postgres-prod
  • Prompts, uploads and paste into gen-AI apps in the browserchat upload · finance_q3.xlsx
  • File, identity and process context for every eventcustomers_q3.csv · m.chen · WX-204
  • Policy enforced on the device, offline includedverdict in under 25ms

Radar

Cloud sensor

Connects to the AI platforms in your cloud and pulls in the agents built there, with their telemetry. Nothing to install on devices.

Agentforce · Copilot Studio · ServiceNow · Databricks · Bedrock
  • Agents built on AI platforms, inventoriedsupport-triage · Agentforce
  • Each agent and what it connects tosupport-triage → CRM, knowledge base
  • Agent telemetry, pulled into the same streamsession · 14 actions · 2 tool calls
  • New agents surface as soon as they’re createdhr-assistant · first seen 12:04
<25msSurface verdict, scored on the device, offline included
15 minFrom install to a fleet-wide AI inventory
2 sensorsDevices and cloud AI platforms in one inventory
02How it works

From signal to proof, in one place. Both sensors feed the same pipeline.

SurfaceDevices and browsers
RadarAI platforms in the cloud

Both sensors write the same event shape, so everything after this point is shared.

01InventoryOne listEvery agent, skill, MCP server and model, mapped to where it runs.
02ScoreAIRiskDB · 0–10Each asset scored by what it can reach.
03EnforceAllow · warn · blockPolicy at any step, with approval for risky ones.
04ProveIncidents + replayEvery match explained, every session replayable.
03Telemetry

Every event, resolved down to the action. Not a domain and a timestamp.

Device and cloud events share one shape, so a session reads the same wherever the agent ran. AIRiskDB pre-scores each asset involved.

Device eventSurface
Prompt“Export the payments schema”
Toolsmcp:payments · query
Filesschema.sql PCI
Identitym.chen · WX-204
VerdictWarned
Cloud agent eventRadar
Agentsupport-triage
PlatformAgentforce
Actioncase.update · 3 records
DataCustomer records
VerdictNeeds approval
04Deployment

Live in minutes, with the tools you already run. Push Surface through MDM. Connect Radar to your AI platforms.

Surface

Through your MDM
macOSApple silicon and IntelNotarized agent
Windows10, 11 and ServerMSI / Intune
LinuxDebian, RHEL, Ubuntudeb / rpm
Browser extensionChrome, Edge, FirefoxManaged force-install

Radar

Connect in the cloud

Connect each AI platform once. Radar pulls in its agents and their telemetry. There’s nothing to install on devices.

AgentforceCopilot StudioServiceNowDatabricksBedrock

Fully custom agents built in-house (LangGraph, CrewAI, AutoGen) aren’t covered today.

Push via MDMJamf, Intune, Workspace ONE, Kandji: silent, signed install.
Works offlineDetection and enforcement run locally; events sync when reconnected.
Staged rolloutMonitor only, then warn, then block, by group, on your timeline.
05Integrations

Fits the SOC you already run. AI incidents flow into the tools your team lives in.

SIEM and observabilityStream AI events
Splunk · Microsoft Sentinel · Elastic · Chronicle · Datadog
SOAR and ticketingDrive response
Tines · Torq · ServiceNow · Jira · PagerDuty
MDM and deploymentPush Surface
Jamf · Intune · Workspace ONE · Kandji
IdentityResolve who
Okta · Entra ID · Google Workspace · SCIM
06Security and privacy

Detection runs where the data lives. Prompts are scored on the device and don’t need to leave it.

On-device processing

Surface evaluates prompts locally with small models; raw content stays on the endpoint by default.

Configurable retention

You set what is stored, where, and for how long.

Evidence for audits

Evidence mapped to frameworks such as SOC 2, ISO/IEC 42001 and the EU AI Act.

Redaction-aware capture

Sensitive values can be masked at the source before anything syncs.

07Why two sensors

Coverage depends on where you sit. Agents run on devices and inside vendors’ clouds. A gateway sees neither fully.

CoverageSuperAlign · Surface + RadarNetwork gateway / SASESDK in your code
Local models, MCP servers, skillsComplete · SurfaceNever leaves the deviceNot in scope
Browser and IDE AI assistantsComplete · SurfacePartial: URL filteringNot in scope
Agents built on AI platformsComplete · RadarNot visible: runs in the vendor’s cloudOnly AI you build
Off-network and remote devicesAlways on · SurfaceOnly when routed throughNot applicable
Third-party AI your people useCore of the productEgress slice onlyOnly AI you build

Category comparison: positions in the AI security landscape, not specific vendors.

08Customer outcomes

What teams do with the platform.

01 · Discover

Find the AI no one declared

Surface inventories every agent, model and MCP server on the fleet within the first day. Radar adds the agents built on your AI platforms.

02 · Govern

Stop regulated data reaching ungoverned AI

Policy blocks PCI and PII flows to unsanctioned tools at the source, with the incident sealed for audit.

03 · Prove

Answer “what did the AI do?” in minutes

Replayable sessions from devices and cloud platforms give auditors one system of record.

09FAQ

Platform questions. How the sensors work, where data lives and how rollout goes.

What is the difference between Surface and Radar?

Surface is the device sensor: a lightweight agent on every managed device, plus a managed browser extension, that sees AI where it runs, including AI that never leaves the laptop. Radar is the cloud sensor: it connects to AI platforms such as Agentforce, Copilot Studio, ServiceNow, Databricks and Bedrock and pulls in the agents built there and their telemetry.

How does runtime security work on the device?

Surface inspects prompts, uploads and agent actions where they happen and applies policy on the device itself, returning a verdict in under 25 ms, offline included. Allowed steps carry on, warned steps show the person why, blocked steps stop, and steps that need approval wait for a reviewer. Agents on cloud AI platforms, seen through Radar, fall under the same policy and incidents.

Does prompt data leave the device?

Not by default. Surface evaluates prompts locally with small models, and raw content stays on the endpoint. You choose what is stored, where and for how long, and sensitive values can be masked before anything syncs.

Does SuperAlign work offline?

Yes. Detection and enforcement run on the device, and events sync when it reconnects.

Which tools does SuperAlign integrate with?

SIEM and observability tools (Splunk, Microsoft Sentinel, Elastic, Chronicle, Datadog), SOAR and ticketing (Tines, Torq, ServiceNow, Jira, PagerDuty), MDM (Jamf, Intune, Workspace ONE, Kandji) and identity providers (Okta, Entra ID, Google Workspace, SCIM).

How quickly can SuperAlign be rolled out?

About 15 minutes from install to a fleet-wide AI inventory. Rollout can be staged: monitor only, then warn, then block, by group, on your timeline.

Give us two weeks.
We’ll show you what’s running.

Deploy on your MDM across 25–100 users. Keep the inventory, scored risk view, and a full session record—whether you buy or not.

Book a discovery call Contact us
Day 1Endpoint sensor and browser extension pushed through Jamf or Intune. First results within the hour.
Week 1Full inventory with risk scores, plus one session reconstructed end to end.
Week 2Findings review against criteria you set before we started.
CostNothing. The findings are yours either way.