RuntimeX ShieldAGELAI Governance & Enforcement Layer
Available now  ·  macOS  ·  Windows June 1  ·  Linux coming soon

AI governance for the enterprise endpoint.

Sensitive information governed before it reaches AI tools. Employee privacy maintained by design. No vendor cloud. No blind spots.

Browser AI governance
PCI DSS, HIPAA, credentials — blocked before submission
Self-learning domain discovery
New AI tools detected automatically — no manual updates
SIEM integration
Splunk HEC, Sentinel, syslog/CEF — events in real time
RuntimeX  ·  Coming soon

For decades everyone asked: are your vulnerabilities patched? We ask a different question.

Is this vulnerability being actively exploited — on this endpoint — by this identity?
RuntimeX answers at the moment of execution. Before the exploit completes.

"No patch required. RuntimeX prevents exploitation at runtime — protecting your endpoints whether or not the vulnerability has been patched."

98.5%
Detection accuracy — adversarial test suite
<200ms
Time to decision — on-endpoint
384
MITRE ATT&CK techniques covered
50K+
Training variations and counting

AI tools are in every organization. Governance isn't.

In 2026, the average knowledge worker uses multiple AI tools at work — most without IT's knowledge, nearly all without governance. Customer records, financial projections, patient data, source code and legal documents flow into these tools every day.

The question is no longer whether your data is being shared with AI. It is what you are going to do about it before the next incident.

"84% of developers are using or planning to use AI coding assistants — each one sending code context, credentials and intellectual property to external AI APIs with no governance in place."

Stack Overflow Developer Survey 2025 · IDEsaster Security Research, Dec 2025
Developers using AI coding tools
84%Stack Overflow 2025
AI IDE tools with confirmed CVEs
100%IDEsaster 2025
Secret leakage increase with AI coding tools
+40%MintMCP 2026
Enterprise orgs with AI governance
~12%Gartner 2026
Available now — macOS · Windows ETA June 1, 2026

RuntimeX Shield

AI Governance & Enforcement Layer — AGEL

Shield does not just monitor what your employees share with AI tools — it enforces. Sensitive data is identified and blocked in real time, before it leaves your organization. Your security team sets the rules. Shield makes sure they are followed — across every AI tool, every application, every endpoint.

Built with employee privacy by design. Shield governs AI traffic only — not general internet browsing. An employee accessing their bank, personal email, or any non-AI website is completely outside Shield's scope. No personal browsing is captured, monitored or stored. What you gain is full visibility and control over your organization's sensitive data flowing to AI tools — not surveillance of your employees.

Policy in your hands.
Enforcement on every endpoint.
BLOCKED — Payment card number detected before submission to ChatGPT · pan_visa · PCI DSS 4.0.1
BLOCKED — AWS access key in file attached to Claude · aws_access_key · CRITICAL
BLOCKED — Medical record number in Cursor IDE request to api.openai.com · mrn · HIPAA PHI
WARNED — Salary data detected in document — employee advised before proceeding
ALLOWED — General query, no sensitive data detected — 0.4ms decision
All decisions on-endpoint. Nothing sent to The Alphans or any third-party cloud.
Identity-aware interception
Every governance event carries the full identity of who triggered it — user, device, application and time. Different policy for contractors, employees and privileged accounts.
Self-learning domain discovery
New AI tools emerge weekly. Shield detects and flags them automatically as they appear — no IT team manually updating an allowlist. Your governance evolves with the market.
65 compliance frameworks covered
PCI DSS 4.0.1, HIPAA 18 PHI, GDPR, SOC 2, ISO 27001 and 60+ more — coverage across 11 jurisdictions. Audit evidence generated continuously and forwarded to your SIEM in real time.
SIEM integration
Splunk HEC, Microsoft Sentinel and syslog/CEF. Every governance event forwarded in real time. 90-day hot data on-endpoint. Long-term retention and compliance archiving via your SIEM.
01
Available now

AI Governance for the browser — and everything beyond it

Your employees don't just use AI in the browser. Developers call AI APIs from their IDE, their scripts and their terminal. Shield governs all of it — applying the same policy everywhere sensitive data could leave.

  • Financial compliance, enforced automatically. PCI DSS 4.0.1 — payment card numbers, CVV codes and track data blocked before submission to any AI tool. Your next PCI audit has one fewer concern.
  • Patient data stays protected. All 18 HIPAA PHI identifiers recognised and governed in real time. Medical record numbers, patient IDs, NPI codes, dates of birth — none reach an AI tool uninvited.
  • Credentials and secrets never leave. AWS keys, GCP credentials, private keys, database connection strings, JWT tokens caught the moment an employee or developer submits them to any AI assistant.
  • Documents and files governed before upload. Board minutes, M&A documents, HR records attached to AI chat sessions scanned and blocked before upload. The file must be removed before the conversation continues.
  • Your security team controls policy — no code, no vendor call required. Decide what is blocked, warned and allowed per data type, per team, per context — in minutes. Policy changes reach every endpoint in seconds.
  • Incognito mode is not a bypass. Protection is endpoint-level — it follows the device, not the browser session. Private windows offer no escape from governance.
Financial — PCI DSS 4.0.1
Visa · Mastercard · Amex card numbers · CVV codes · Expiry dates · Track data
Healthcare — HIPAA 18 PHI
Medical record numbers · NPI · SSN · Dates of birth · Health plan IDs · Patient identifiers
Credentials & secrets
AWS keys · GCP keys · Private keys · JWT tokens · API secrets · DB connection strings
Personal data — 11 jurisdictions
Passports · Driving licences · National IDs · Phone numbers · ABN · NI numbers · IBAN
CapabilityNetwork & cloud proxy
e.g. Zscaler, Netskope, Palo Alto
Endpoint DLP
e.g. Purview, Symantec, Forcepoint
RuntimeX Shield
Governs text typed into AI chat✕ Encrypted payload — not inspectable without full SSL interceptPartial — possible with deep packet inspection, not AI-native✓ AI-native — intercepts before submission, understands AI context
Scans file content before AI uploadPartial — inspects after upload begins, not beforePartial — generic upload policies, not tuned for AI chat interfaces✓ Full content scan before submission — file must be removed to continue
Governs AI API calls from code & IDEs✓ Yes — but all traffic routed through vendor cloud, latency addedPartial — requires custom rules per AI endpoint, complex setup✓ On-endpoint — zero latency, no cloud routing, 42+ AI APIs pre-configured
Protection follows device, not session✓ Yes — network layer is browser-mode independentPartial — depends on agent scope and configuration✓ Endpoint-level — browser mode, VPN and network topology irrelevant
Decisions made on your infrastructure✕ All traffic routed through vendor data centrePartial — some local decisions, policy often cloud-dependent✓ 100% on-endpoint — no vendor sees your data, air-gap supported
Employee privacy — personal browsing untouched✕ All internet traffic inspected — banking, personal email, everythingPartial — scope depends on policy; broad monitoring common✓ AI traffic only — architectural guarantee, not a configurable policy
Pre-configured for AI tools on day onePartial — AI categories exist, proxy deployment and tuning requiredPartial — improving but custom AI rules typically needed✓ 42+ AI tools governed immediately, self-learning discovery adds more
SIEM integration — Splunk, Sentinel, syslog✓ Yes — core capability of cloud proxy tools✓ Yes — standard enterprise DLP feature✓ Available — Splunk HEC, Microsoft Sentinel, syslog/CEF
02
Available now

Shadow AI discovery — you cannot govern what you cannot see

Before you can govern AI usage, you need to know where it exists. AI today is not just standalone tools — it is embedded in the platforms your organization already uses. Shield maps all of it.

Where AI data leakage is happening outside the browser
VS Code + GitHub Copilot
Sends code context and file contents to api.github.com/copilot on every completion. Secret leakage rates 40% higher in repos using Copilot.
Cursor IDE
Sends entire repository context to api.openai.com. CVE-2025-49150, CVE-2025-54130, CVE-2025-61590 — all confirmed data leakage vectors.
Python / Node AI SDKs
Scripts using openai, anthropic, langchain libraries send data directly to AI APIs — no browser involved, no extension intercepts them.
Salesforce Einstein & platform AI
Enterprise platforms with embedded AI call ml.salesforce.com and other AI endpoints from within existing workflows — invisible to browser-only governance.
CLI tools (aider, sgpt, Claude Code)
Terminal-based AI assistants with no browser involvement whatsoever. Governed only at the network/proxy layer.
Electron apps with AI
Applications with internal browsers that bypass Chrome extensions entirely. Only a system-level proxy catches these.
Sources: MintMCP Security Analysis 2026 · IDEsaster Research (Hacker News, Dec 2025) · Witness.ai Cursor Security Analysis 2026 · Netrix Global Copilot Security Guide 2025 · Prompt Security GitHub Copilot Vulnerabilities 2025
  • Complete AI inventory on first install. Every AI tool your IT team does and does not know about — mapped and classified before your next security review.
  • Self-learning domain discovery. New AI tools emerge weekly. Shield detects and flags new AI domains automatically — no manual list maintenance, no IT ticket required.
  • Enterprise platform AI coverage. Salesforce Einstein, Microsoft Copilot integrations, SAP AI — if it calls an AI API, Shield finds it and governs it.
  • Personal AI accounts on corporate devices. Employees using personal accounts on work machines bypass corporate data retention entirely. Shield identifies and flags these sessions.
  • Browser extension risk scoring. Every AI extension catalogued, permissions scored, high-risk extensions surfaced for your security team to act on.
  • Delta updates only. Once the initial inventory is built, Shield tracks changes — new installs, new extensions, new AI domains — without rescanning the entire estate.
03
Available now

AI traffic governance — developers and automated pipelines included

AI governance that only covers the browser misses the fastest-growing risk. Shield's AI traffic layer governs every outbound AI API call from every application on the endpoint — browser, IDE, script or pipeline.

  • Complete coverage across every AI channel. VS Code, Cursor, Python scripts, Jupyter notebooks, CLI tools — governed by the same policy as browser interactions.
  • Invisible to developers. No workflow changes required. Governance happens transparently — developers work normally, sensitive data does not leave.
  • Identity extraction from every AI API call. Who triggered it, which application, which AI service, at what time — full attribution on every event.
  • Single audit trail across all channels. Browser AI events and desktop API calls in one dashboard, one event schema, one compliance report.
04
Expanded capability — roadmap

Vulnerability protection + Runtime exploit prevention

Extend the same endpoint agent with AI-specific CVE exposure scanning, outdated package risk, and full runtime exploit prevention. One agent, expanded capability — no patch required, no additional overhead. RuntimeX is available as a standalone deployment today.

05
Roadmap

Identity risk — who is using AI, and should they be?

Human vs non-human identity governance, contractor access policy, MFA posture across AI tools, stale account detection. Different rules for different identities.


Visibility centre

Every AI interaction. One view. Your infrastructure.

Real-time governance events, fleet status, policy management and compliance reporting — in a single console that runs entirely on your endpoints. 90-day rolling hot data with daily aggregates retained indefinitely. The Alphans never sees your data.

Real-time event stream
Every BLOCK, WARN and ALLOW event across your fleet — who, what tool, what data type, when. Searchable, filterable, exportable for compliance review.
Policy management
Your team sets policy with a few clicks — no code, no vendor call. Changes propagate to all endpoints in seconds. Immutable audit trail of every policy change — visible to your security leadership.
Compliance evidence & reporting
PCI DSS, HIPAA, GDPR and sector-specific frameworks documented continuously. Audit-ready PDF reports on demand — exported in seconds, not assembled under pressure.
Shadow AI inventory
Every AI tool across your fleet in one view. New tools flagged automatically. Security team review queue for unknown AI domains. Browser extension risk scores.
Fleet health
Every endpoint's governance status, patterns loaded, last activity. Offline or unhealthy endpoints surfaced immediately. No blind spots in your fleet.
Zero vendor dependency
Every decision, every event, every policy lives on your infrastructure. Air-gapped deployment fully supported. The Alphans never sees your telemetry.
SIEM integration
Forward all governance events to your existing SIEM in real time. Splunk HEC, Microsoft Sentinel and syslog/CEF output — events arrive as they happen. Shield handles 90-day operational visibility on-endpoint. Your SIEM handles long-term retention, cross-system correlation and compliance archiving.
RuntimeX Shield AGEL — Available today   ·   RuntimeX — Coming soon
RuntimeX — coming soon · integrating with Shield AGEL

For decades everyone asked: are your vulnerabilities patched? We ask a different question.

Is this vulnerability being actively exploited — on this endpoint — by this identity?
RuntimeX answers at the moment of execution. Before the exploit completes.

The enterprise security industry has spent two decades building tools that detect attacks after they execute. RuntimeX was built on a different belief.

"Is this vulnerability being actively exploited right now — on this endpoint — by this identity?"
RuntimeX answers this question at the moment of execution. Not after. Not by correlation. Before the exploit completes.

Did we say no patch required?

Yes. RuntimeX prevents exploitation at runtime — protecting your endpoints whether or not the underlying vulnerability has been patched. In 2025, 48,185 new CVEs were disclosed — 131 every single day. The median time to exploit dropped to negative seven days, meaning attackers exploit vulnerabilities before patches even exist. The average enterprise carries hundreds of unpatched critical vulnerabilities at any given time, many in systems that cannot be patched without downtime, regulatory approval or production risk.

Stingrai Vulnerability Statistics 2026 · Mandiant M-Trends 2026 · Maze HQ Security Wrap 2026 · CISA KEV Catalogue 2025
98.5%
Detection accuracy — fine-tuned neural engine, Round 2
<200ms
Time to decision — identity + lineage + 220 rules + LLM, on-endpoint
384
MITRE ATT&CK techniques covered — all 13 in-scope tactics at 100%
50K+
Training examples across 10 fine-tuning rounds
The reality across every industry
Financial services
A major European bank carried over 1,400 unpatched critical CVEs at the time of a significant breach — not because patches were unavailable, but because applying them required application re-certification across hundreds of dependent systems. Runtime prevention is the only option when patching is blocked by process.
Based on industry post-breach analysis · Orange Cyberdefense Security Navigator 2025
Healthcare
83% of connected imaging devices in healthcare environments run unsupported operating systems that cannot be patched without FDA re-approval — a process that takes years. Each device represents a permanently open exploitation path that RuntimeX closes without requiring a single patch or regulatory filing.
Claroty State of CPS Security Report 2024 · Palo Alto Networks Unit 42 IR Report 2024
Critical infrastructure
ICS and SCADA environments report average patch cycles of 200+ days — and many systems are permanently unpatched due to zero-downtime requirements and vendor support constraints. RuntimeX covers all 79 ICS ATT&CK techniques — the only endpoint agent with full ICS/OT matrix coverage at runtime.
Dragos ICS/OT Cybersecurity Year in Review 2024 · CISA ICS Advisory Programme 2025
Coming to the platform

Beyond the endpoint — every device on your network.

RuntimeX is extending beyond endpoint agents. The next phase brings network-level threat prevention to the devices traditional security products have never been able to reach — OT systems, industrial controllers, medical devices, IoT equipment, and network infrastructure. No agent installation. No new hardware. No blind spots.

OT / ICS / SCADA systems Medical & clinical devices IoT & connected infrastructure Network switches & routers Any device that cannot run an agent

Part of the RuntimeX platform roadmap. Organizations in manufacturing, healthcare, energy and critical infrastructure — contact us to discuss early access.

About The Alphans

We build the security products that should have existed a decade ago.

The Alphans was founded on a single belief: the most important moment in security is the one before the damage is done. Not detection. Not response. Prevention — at the moment of execution, with the full context of who is acting and what they are doing.

We started with a question the entire industry had stopped asking: what if you knew, in real time, whether a vulnerability was being exploited — on this endpoint — by this specific identity? The answer became RuntimeX.

When AI tools became the new shadow IT, we asked the same question again: what if every organization had full visibility and control over what their people share with AI — without compromising employee privacy, without slowing anyone down? The answer became RuntimeX Shield.

We are a pre-seed company building enterprise security infrastructure. Every detection rule, every training example, every governance pattern exists because organizations deserve tools that prevent damage — not tools that generate alerts about damage that has already been done.

Mission

Protect what matters most to every organization

Every organization has something worth protecting — patient records, customer trust, intellectual property, financial integrity. We build the tools that defend those things at the moment they are at risk. Not after.

Vision

Security that acts. Not security that alerts.

For the first time in enterprise security, your SOC team does not have to chase every alert and trace every step of an attack. RuntimeX prevents it, records it, and delivers the evidence — so your team can investigate from a position of strength, not panic.

Principle

Prevention over detection. Always.

Detection tells you what happened. Prevention stops it from happening. Every product we build acts at the moment of risk — before the data leaves, before the exploit completes.

Commitment

Your data never leaves your infrastructure

RuntimeX and RuntimeX Shield run entirely on your endpoints. The Alphans never sees your telemetry, your events or your governance decisions. That is not a marketing claim — it is the architecture.

Investors

Building the AI security layer the enterprise market does not have yet.

The shift to AI tools in the enterprise has outpaced every governance framework in existence. We built RuntimeX Shield to fill that gap — and we are building the broader platform that will define enterprise AI and endpoint security posture for the next decade.

Market position

An unoccupied position in a $98B+ market

Endpoint security, identity management, vulnerability management and cyber insurance represent over $98B in combined annual spend. No existing vendor addresses the AI governance gap and the runtime prevention gap simultaneously. We do.

Mordor Intelligence · Fortune Business Insights · Precedence Research · 2026
Traction

Working product. Filed patent. Real deployment telemetry.

RuntimeX Shield is in production deployment. 700+ governance events recorded. Patent pending. RuntimeX neural engine at 98.5% accuracy, validated across 384 MITRE ATT&CK techniques.

Production deployment · Patent pending
Opportunity

First-mover in AI governance infrastructure

Every enterprise in every regulated industry needs AI governance. Most have no solution today. The window to establish the category-defining product is open now. We are building it.

Pre-seed · Seeking strategic early-stage investment partners
Stage
Pre-seed
Seeking early-stage investment partners
Shield — macOS
Live now
Windows ETA June 1, 2026
Patent
Patent pending
 
Neural engine
98.5% accuracy
50,000+ examples · 10 rounds · 384-technique adversarial test suite
Governance events
700+ logged
Real deployment telemetry
MITRE coverage
384 techniques
All in-scope tactics 100% · ICS ATT&CK coverage included
Get in touch

Let's talk.

Whether you are an enterprise looking to govern AI usage, an investor interested in the AI security category, or a potential design partner — we want to hear from you.

We review every enquiry personally.

48 business hour response commitment
Investor enquiries
investor@thealphans.com
Investment enquiries, term sheets, partnership discussions and white paper requests.
Product demos & pilots
demo@thealphans.com
Request a live demo or design partner pilot for your organization.

All fields required · Strictly confidential · 48 business hour response

Thank you for reaching out.

Your message has been received. We review every enquiry personally and will respond within 48 business hours.

— The Alphans Team