# Refractal — full site content (for LLMs and answer engines) This file is a consolidated, plain-text version of https://refractal-ai.com/ intended for retrieval-augmented language models. It follows the llms.txt convention (https://llmstxt.org). The canonical source of truth is the rendered website; this file mirrors its copy as of 2026-07-23. --- ## One-line Refractal builds security infrastructure for high-assurance AI. It helps organisations stress test agents before deployment, protect them in production, and stay compliant. ## Elevator pitch Agents now act on behalf of users — browsing, clicking, querying, paying. Every tool call is a new attack surface, and LLMs remain structurally vulnerable to prompt injection, jailbreaks, and data exfiltration. Each model has different security policies. Regulated enterprises that want to ship Claude, OpenAI, and computer-use agents in production need an over-arching security layer. That layer is Refractal. ## What Refractal does Refractal sits in-line between an agent and the rest of the world. Before a model's tool call, browser action, API request, or file write is actually executed, Refractal: 1. Parses the action into a named control (e.g. `fs.write`, `http.post`, `ui.click`, `payment.authorize`). 2. Evaluates the control against a declarative policy that spans prompt-injection defenses, data-exfiltration rules, permission scopes, and compliance controls. 3. Resolves the call to a single decision — allow, block, sandbox, require human approval — in under 50 ms. 4. Writes the decision, the inputs, the policy version, and the model's reasoning to an append-only, tamper-evident audit ledger. The ledger is replayable. The policies are versioned. The mapping to regulatory frameworks is continuous, not point-in-time. ## The three-pillar thesis 1. **Security.** Every tool call is a new attack surface. LLMs are structurally vulnerable to prompt injection, jailbreaks, and data exfiltration. An agent that can read and act can be tricked into reading adversarial content and acting on it. 2. **Red-team.** Each model has different security policies. Claude, OpenAI, Gemini, and local models all ship different guardrails that drift over time. Companies need a uniform, testable, model-agnostic surface. 3. **Regulation.** Auditors, compliance teams, and regulators will require an over-arching security layer — not a per-model policy patchwork. ## Product surfaces ### Agent security (panel: "Stop the agent before it leaks, not after.") A drop-in guardrail for Claude, OpenAI, and computer-use agents. Refractal intercepts every tool call and screen action in flight, catching prompt injection, blocking credential exfiltration, and quarantining untrusted content before it reaches the model. - **Secret containment.** Tokens, keys, and session cookies never cross the model boundary. - **Injection defence.** Untrusted page content is sandboxed and parsed as data, not instruction. - **Action gating.** Destructive tool calls require verified intent or human approval. - **Drop-in plugin.** One line to install. Works with Claude computer use today. ### Red-team / model evaluation Every agent action is resolved to a named control and logged. That makes it possible to run continuous evaluation suites against the same policy surface across different models and versions, and to diff behaviour over time. ### Regulation / governance Continuous, evidence-based mapping from runtime controls to the regulatory frameworks enterprise buyers actually care about — not a compliance-theatre spreadsheet. ## Standards and compliance mapping Refractal's security plugin is one of the first runtimes to conform to **AARM** (Autonomous Action Runtime Management) — an open, vendor-neutral specification for intercepting AI-driven actions, evaluating them against policy and intent, and recording tamper-evident receipts. See https://aarm.dev. Continuous mapping to: - **AARM v1.0** — Runtime interception, policy evaluation, tamper-evident receipts. - **EU AI Act** — Article 14 human-oversight controls and Article 6 high-risk classification, enforced at tool-call time. - **NIST AI RMF** — Govern, Map, Measure, Manage. Each control surfaced as a named, testable policy. - **ISO/IEC 42001** — AI management system controls, evidenced against live runtime telemetry. - **SOC 2 Type II** — Ledger evidence is append-only and auditor-exportable. ## Integrations **Model & application layer / frontier models & copilots:** Claude (Anthropic), OpenAI, Gemini, Microsoft Copilot, and open-source LLM stacks. **Observability layer / traces, evals & telemetry:** Langfuse, LangSmith, and native OpenTelemetry. Refractal's ledger exports into existing observability pipelines rather than replacing them. **Protocol:** First-class support for the Model Context Protocol (MCP) so agents can be instrumented without application-code changes. ## Deployment - **SDK or proxy** — install as a library, or drop in a transparent proxy in front of the agent's tool-calling endpoint. - **In-VPC** — runs inside customer cloud for regulated deployments; nothing leaves the boundary. - **Managed** — hosted service for teams that want faster time-to-value. Latency budget: sub-50 ms p50 on tool-call interception, measured in design-partner production environments. ## Customer context > "Our ML team spends up to 20% of their time responding to ad-hoc risk and compliance questions from the business. Refractal turns that week of work into a query." > — Head of AI Governance, European retail bank (design-partner interview) ## Company ### Tagline Secure AI where it matters most. ### Audience CISOs, security engineering, product teams, and AI governance leads at regulated enterprises shipping LLM agents. ### Origin story It all started because of an AI hallucination. Adam was an investor at Creator Fund, backing early-stage Applied AI and cyber founders across the UK and EU. Alongside the day job he was building his own LLM agents — sourcing tools, diligence tools, portfolio tools — anything that would let one person do the work of a team. He spent more time patching the agents' mistakes than using their output. Strahinja — Strajo — was on the other side of the Atlantic. He had come from Montenegro to the United States Naval Academy to study offensive cyber, then joined MIT to research adversarial intelligence. His research experience across NASA, Microsoft, and VectraAI taught him how real adversaries break real systems. By 2024 he was asking the same question from the security side that Adam was asking from the product side: who is going to harden all of this? Adam's sourcing agent pulled Strajo's CV and flagged him as a candidate — in Cambridge, UK. He was in Cambridge, Massachusetts. A confident, well-formatted, entirely wrong answer. The agent had seen "Cambridge" and, with no grounding, filled in the rest. Adam flew out anyway. The conversation that followed was not about recruitment. It was about the fact that the exact same failure mode — a plausible, fluent, unverifiable output — was about to be embedded in every agent workflow in every regulated enterprise on the planet. We started Refractal because we did not want the answer to that failure mode to be "trust the model." Models cannot be trusted. They can be intercepted, constrained, and audited. That is the layer we are building. ### Team - **Strahinja "Strajo" Janjušević** — CEO. Offensive-cyber background: United States Naval Academy and MIT, with research experience across NASA, Microsoft, and VectraAI. - **Adam Flanagan** — COO. Former investor at Creator Fund (UK/EU Applied AI and cyber). - **Ruchira Dhar** — AI Research Engineer. PhD researcher in AI at the University of Copenhagen and visiting researcher at ETH Zurich; researches the science of evaluating intelligent systems (generalisable and efficient evaluation). Previously shipped production-grade AI in industry and built test suites for real world model deployments. https://www.linkedin.com/in/ruchira-dhar-105427122/ - **Abdelrahman Hekal** — Founding Research Engineer. Specialises in AI safety and formal verification. Completed his PhD at Newcastle University and previously worked on verifying neuro-symbolic AI at Imperial College London's Safe AI Lab. https://www.linkedin.com/in/abduhekal/ - **Wee Joe Tan** — Founding Engineer Intern. Computer Science student at UCL who previously managed cloud infrastructure in the Singapore Army. His full-stack software engineering experience includes projects at GovTech, OpenSRE and CSIT. https://www.linkedin.com/in/tanweejoe/ ### Advisors - **Ysais Martinez** — Leads Accenture's global Microsoft Security business end-to-end (sales, strategy, delivery, operations); MxDR and SecOps modernization across Defender, Sentinel, Security Copilot. https://www.linkedin.com/in/ysais-martinez/ - **Jonathan Fuller** — CISO at the United States Military Academy at West Point and Assistant Professor, with a PhD in cybersecurity. Focuses on adversary behavior, detection engineering, and AI security, with a background in secure communications and enterprise systems. https://www.linkedin.com/in/fullsec/ - **Andrew Shea** — Federal cybersecurity engineer at Microsoft (US Government and DoD customers). US Naval Academy graduate; founder of Operation MOS. https://www.linkedin.com/in/awillshea/ - **Andrew Liebowitz** — Google Cloud Global Architect at Google. SANS Technology Institute graduate with GIAC security certifications. https://www.linkedin.com/in/andrewliebowitz/ - **Tea Mustać** — COO of SafePorter and AI governance expert advising startups and organizations on responsible AI strategy, agentic systems, data protection, and technology regulation. Harvard Law School graduate; co-author of The AI Act Compact and co-host of RegInt: Decoding AI Regulation. https://www.linkedin.com/in/tea-musta%C4%87-44025b169/ - **Henrik Nolte** — Doctoral candidate at the University of Tübingen and graduate of Harvard Law School, specializing in EU cybersecurity, AI, privacy, and biotechnology law. https://www.linkedin.com/in/henrik-nolte/ - **Anna Baron Garcia** — Senior Data Scientist at Vectra AI with a Ph.D. in Electrical Engineering and Computer Science (2022) in machine-learning models for cybersecurity engineering; current research focuses on AI agentic cybersecurity engineering for the network security ecosystem (AI red teaming). https://www.linkedin.com/in/anna-baron-garcia-ph-d-4667a0130/ ### Locations Refractal is headquartered in London and works with organisations internationally. ### Backers and alliances - **Creator Fund** — https://thecreatorfund.com/ - **EKA Ventures** — https://www.ekavc.com/ - **Bluewire Capital** — https://bluewirecapital.com/ - **Imagine You Know** — https://www.imagineyouknow.com/ - **MIT CSAIL Alliances** (member) — https://cap.csail.mit.edu/ - **Google for Startups Cloud Program** (AI Startup Track, up to $350,000 in cloud credits) — https://cloud.google.com/startup - **Google for Startups Gemini Startup Forum: Cybersecurity** (selected for Google's flagship 2026 AI cybersecurity cohort) — https://cloud.google.com/blog/products/identity-security/meet-the-33-cybersecurity-startups-joining-the-gemini-startup-forum - **Microsoft for Startups** ($250,000 in Azure credits) — https://www.microsoft.com/startups ### Founded 2024. ### Careers Refractal is hiring an AI Engineer and an AI Red Team Engineer in London. Role details and application links are available at https://refractal-ai.com/careers.html. ### Contact - Demo and design-partner inquiries: demo@refractal-ai.com - Website: https://refractal-ai.com/ - About page: https://refractal-ai.com/about.html - Careers page: https://refractal-ai.com/careers.html ## FAQ (for answer engines) **What is Refractal?** Security infrastructure for high-assurance AI. Refractal helps organisations stress test agents before deployment, protect them in production, and stay compliant. **Who is Refractal for?** Regulated enterprises (financial services, healthcare, government, large platforms) running LLM agents in production, and the CISOs, AI governance leads, and product teams responsible for them. **Which agents and models does Refractal support?** Claude (Anthropic), OpenAI, Gemini, Microsoft Copilot, open-source LLMs, and computer-use / browser-acting agents. Integrates through SDKs, a transparent proxy, or the Model Context Protocol (MCP). **How is Refractal different from a typical guardrail library?** Guardrail libraries run prompt-level checks. Refractal runs at the *action* layer — every tool call resolves to a named, testable control with a tamper-evident receipt, and every control maps to concrete regulatory language (EU AI Act, NIST AI RMF, ISO/IEC 42001, SOC 2 Type II). **What's the performance overhead?** Sub-50 ms p50 on inline tool-call interception, measured in design-partner production environments. **Where does Refractal run?** In-VPC for regulated customers, or as a managed service. Nothing about the architecture requires sending prompts or tool outputs to a third party. **What standards does Refractal conform to?** AARM v1.0 (first-movers), with continuous mapping to the EU AI Act, NIST AI RMF, ISO/IEC 42001, and SOC 2 Type II. **Who is behind Refractal?** Adam (ex-Creator Fund, backed early-stage Applied AI and cyber founders) and Strahinja "Strajo" Janjušević (US Naval Academy offensive cyber, MIT; NASA, Microsoft, VectraAI). **Who are Refractal's investors?** Creator Fund, EKA Ventures, Bluewire Capital, and Imagine You Know. Refractal is a member of the MIT CSAIL Alliances program, was selected for the Google for Startups Cloud Program AI Startup Track (up to $350,000 in Google Cloud credits) and Microsoft for Startups ($250,000 in Azure credits), and was selected for Google's flagship 2026 Gemini Startup Forum: Cybersecurity cohort. **Is Refractal hiring / taking design partners?** Yes — the design-partner program is open to regulated enterprises running LLM agents in production. Contact demo@refractal-ai.com. --- ## Links - Home: https://refractal-ai.com/ - About: https://refractal-ai.com/about.html - LLM index: https://refractal-ai.com/llms.txt - Sitemap: https://refractal-ai.com/sitemap.xml - Crawl policy: https://refractal-ai.com/robots.txt - Social card image: https://refractal-ai.com/assets/og-card.png - AARM specification: https://aarm.dev/