About Refractal

We started Refractal because AI is being adopted faster than it can be governed. Employees bring their own AI tools to work. Agents run for weeks across real systems. The security stack was built before any of this existed.

We did not bolt AI onto a security product, and we did not bolt security onto an AI product. Securing AI takes two disciplines that rarely live in the same team: modern AI research and cyber operations. Refractal was built from day one to combine them, pairing AI safety and machine learning researchers with veterans of military cyber operations to build a team that’s native to AI security.

In our conversations with security teams and customers, the same problems come up again and again.

Employees adopt AI on their own: personal accounts, free tiers, unsanctioned tools. Without governance or defined data boundaries, company data can quietly leave the organisation. Security teams need to know which AI tools, agents and MCP servers are running in their environment. Controls built for a pre-AI world, like DLP and network filtering, were not designed to tell them.

AI agents now take multi-step actions across real systems, sometimes running for weeks. A violation has to be stopped while it happens, not found in a log review next quarter. AI-driven attacks are no longer hypothetical, and defences built for that earlier world were not designed for them.

We want to use models that are aligned with our organisation and are not refusing every defence inquiry we have. We need to own our defences.

Data

Proving that a detection catches what existing tools miss requires real data on how AI behaves in production. That data is scarce, sensitive and locked away. Even the largest security teams are bottlenecked by it.

Latency

Pointing one large model at another adds cost and latency, and depending on the model, it may not be allowed to run where regulated customers need it most: on their own infrastructure.

Long horizons

Agent behaviour is long-horizon. Agents run for days or weeks. Representing that memory, and defining what a trajectory, a session and an anomaly even are, is still open research territory.

Performance

In regulated sectors, a detection system earns trust when its false-positive rate can be analysed and defended, not guessed. Bounding that trade-off rigorously is an active research focus for our team.

Stochastic behaviour

It is hard to prove what the worst case is, and that is where our research comes in.

Refractal works alongside your existing security stack, such as your SIEM, EDR and NDR, and adds visibility into AI tools, agents and the MCP servers they call, from sources like OpenTelemetry, to understand how AI is being used and where it creates risk.

We combine model monitoring and small decision models with policies set for your environment to detect attacks and policy violations, and to enforce policy as agents act. Our research into efficient post-training, long-horizon compression, agent trajectories and the memory representation of that security context helps us look beyond individual prompts to behaviour that develops across a session.

Research and product feed each other. Our research team studies how AI agents behave and fail: how to define a trajectory, how agents remember over weeks, how an attack can be split into steps that each look benign on their own, and how that affects different organisations. What we learn decides what our detections look for, and what production teaches us decides where research looks next.

AI agents are running longer and doing more, and oversight has to grow with them. We are building the security infrastructure for that world: one where every organisation can adopt AI at full speed and still know what it is doing.