AI Detection & Response (AIDR)

An LLM chat request is easy to secure: one prompt in, one answer out. An AI agent is a different problem. It chooses its own tools, reads content it was never meant to trust, holds credentials, calls MCP servers and APIs, touches the file system, and chains all of that into actions — often dozens of steps deep, with no human watching each one. Inspecting any single request in that chain tells you almost nothing; the risk lives in the sequence.

AI Detection & Response (AIDR) is Netzilo's answer. Instead of sitting on one connection, it stays with the agent for its whole run — recording what the agent does, understanding it in context, and enforcing policy across the entire chain of activity rather than one call at a time. Three ideas make that practical.

Solution architecture

Click the diagram to open it full-size.

How Netzilo AIDR works

1. Micro-container

Security travels with the agent instead of living on a box it has to be routed through. Netzilo runs the agent inside a lightweight micro-container that carries the whole enforcement stack — traffic interception and isolation, data-loss prevention, malware scanning, and zero-trust access — right up against the runtime. Because it's the runtime that's wrapped, the same approach fits almost anywhere an agent runs: a browser session, a desktop assistant like Claude or ChatGPT, a mobile app, a Kubernetes workload, or a serverless agent (the demos below wrap an AWS Bedrock AgentCore agent). Nothing about the agent's own code has to change.

2. Behavior Graph

Everything the agent does inside the micro-container is recorded as a connected Behavior Graph — model calls, tool and MCP invocations, API requests, prompts and responses, the identities acting and the data they reach, and the file, process, and network activity each step sets off. Every node carries the security signals Netzilo derived for it: whether a prompt looked like an injection attempt, whether a payload was malicious, how sensitive the data flowing through it is.

Representing activity this way is what makes agentic threats detectable at all. A single credential read or a single upload is unremarkable on its own; a skill pulled from an untrusted source followed by a credential read followed by an upload to an unsanctioned destination is an attack. Because the graph keeps those steps linked, Netzilo can judge the pattern, not just the pieces.

3. Governance as Code

Policy in Netzilo is expressed as code that runs against the Behavior Graph — rules that ask questions of the recorded activity and decide what to allow, redact, or block. They range from single-signal checks to behavioral rules only a graph makes possible: a prompt-injection detector, a malware-download detector, a data-exfiltration detector, an excessive-tool-usage detector, and so on. Writing governance this way means it can be reviewed, version-controlled, and tested like any other code, and shared between teams instead of locked in a console.

Netzilo maintains an open, community-usable library of AIDR rules at github.com/netzilo/aidr-sigma, and ships an AI skill that turns a plain-language description of a threat into a working rule — so extending coverage doesn't require learning a rule DSL first.

For example, a rule can trace a full kill chain across the graph — linking the individual steps of an attack into a single detection:

What this gives you

• Full-fidelity visibility — every action is captured with the context around it, closing the blind spot between what the model said and what the agent actually did.
• Higher-confidence detections — judging each step against the whole graph rather than in isolation produces stronger signals and fewer false positives than payload-by-payload filtering.
• Runtime-agnostic — the same protection wraps any agent wherever it runs, so coverage never depends on which framework, cloud, or model a team chose.
• Built for SecOps — the workflow runs from detection engineering through to response, in the rules-as-code patterns security teams already use.

Demos