Zero trust agent runtime
Every agent gets an identity and every tool call a policy decision. Revoke, contain or hold for human approval from one place.
Learn more360° security for your AI factory.
Every model, dataset, prompt and agent, checked from intake to production runtime.
Traditional security was not built for the AI factory
Models, datasets, prompts and agents now run across the enterprise, and each one holds keys to your data. Most run with no control in front of them.
13%
of organisations reported a breach of their AI models or applications.
97%
of those breached had no proper AI access controls in place.
63%
have no AI governance policy, or are still writing one.
Intake
Your model came off the internet or out of your own training run. Your data came from everywhere. Nobody has checked either.
kronos lab checks both before they serve. Every gate is a rule. Every decision is on record.
Serving
Models, data, prompts and agents. One security layer wraps the whole AI factory, from intake to production runtime.
Most AI security covers one stage, or only watches
Each kind of tool, placed by what it covers and what it does about what it finds. Pick one to see where it stops.
Point controlsWhole-factory enforcementPoint visibilityWide visibility
Kronos Lab
- Covers
- Models, data, prompts and agents, from intake to production runtime.
- Does
- Enforces policy at every gate, fails closed, and records every decision.
- So
- Nothing reaches a GPU, an index or a tool without a policy decision on record.
Kronos Lab secures every model, dataset, prompt and agent in your AI factory, from intake to runtime.
Model supply chain
Scan, describe and sign every model, adapter and dataset. Nothing unsigned or unscanned is promoted to serve.
Learn more
Red teaming
Probe every model in a sandbox for hidden backdoors and injection paths before it is promoted, and keep attacking once it serves.
Learn more
Data ingestion
Clean, de-identify and encrypt every document before it reaches the vector store. Poisoned context never gets indexed.
Learn more
Observability and audit
Every scan, gate decision and served response in one append-only record, streamed into the SIEM you already run.
Learn moreThe full fabric
Models, data, prompts and agents come in through four bands, into one policy plane and one audit trail. The same gates apply whichever platform you serve on, and every control writes back to the same telemetry stream.
intake bandsSupply chainscan · ml-bom · sign · registerpromotion gate: signed onlyDatamalware · pii · provenancevector gate: clean content onlyPrompts & agentsauthorize · guardrails · red teamallow or block, per callAuditledger · drift · casesforwarded to your SIEM
Policy planeone policy · one audit trail
- Policy and governance
- Identity and access
- Audit and compliance
- Encryption and signing
- Integrated workflows
deployment targets
Model serving
Applications
APIs and services
Agentic systems
Edge and on-prem
Any model, any source
Same gates, wherever the model comes from
Open weights from Hugging Face, a fine-tune your team trained or a commercial API: Kronos runs the same four bands over every one of them.
- 01
Register the model
Point Kronos at any artifact: a local file, an S3 bucket, a Hugging Face repo or an OCI registry. Supply chain starts on intake.
- 02
Scan and sign
Malware, unsafe pickles and CVEs are checked, the ML-BOM is built, Cosign signs it and OPA decides whether it may serve.
- 03
Attach guardrails
Runtime policy is set once per model class and follows the model wherever it serves, whatever the runtime.
- 04
Keep the record
Every inference, policy decision and drift signal streams to the audit trail and your SIEM, from first request to retirement.
Supported model sources
Hugging Face Hub
Any public or gated model. Kronos fetches, scans and signs it before it reaches your cluster.
Your own fine-tunes
Models your team trained, in GGUF, ONNX, Safetensors or PyTorch format.
OCI and container registries
Pull from any OCI-compliant registry. Cosign signatures are verified on every pull.
NVIDIA NIM
Optimised inference containers from NVIDIA, with runtime guardrails bound at the serving layer.
Meta Llama
Every Llama generation and variant. The ML-BOM tracks the base model and each fine-tune made from it.
Commercial APIs
GPT, Claude and Gemini over their APIs. Guardrails wrap the call, inbound and outbound.
Also integrates with
Works with the tools you already have
Kronos extends your security stack to cover AI rather than replacing it. Telemetry flows to your SIEM, findings land in your tracker and policy lives where your team already works.
Security, analytics and DevOps
Splunk
SIEM telemetry over the HTTP Event Collector, in CEF.
Microsoft Sentinel
Log Analytics workspace ingestion through the CEF connector.
IBM QRadar
AI security events forwarded in LEEF format.
Elastic
Audit logs shipped to Elasticsearch for custom SIEM builds.
Jira
Red-team findings and policy violations opened as issues.
AI infrastructure
Milvus
The vector store behind the data band, holding ciphertext, not content.
NVIDIA NIM and Triton
Model serving with runtime guardrails attached at creation.
Open Policy Agent
Policy as code, enforced at every gate in every band.
Sigstore and Cosign
Keyless signing and verification for model artifacts.
Five gate decisions
Nothing serves unsigned
A model is promoted only when its scan, its ML-BOM and its signature all check out. Miss one and the registry fails closed.
Learn moreNothing serves unsigned
A model is promoted only when its scan, its ML-BOM and its signature all check out. Miss one and the registry fails closed.
Learn moreNothing embeds unchecked
Every document is scanned for malware and PII and traced to its source before it reaches your vector store.
Learn moreEvery prompt is a policy decision
Authorization first, then injection detection. A prompt that tries to override its instructions gets a refusal, not a GPU.
Learn moreClean requests go straight through
An entitled tenant, a clean prompt and a signed corpus get their answer, with the response filter still attached.
Learn moreAgents act inside a fence
Each tool call is checked against the agent's allow-list, so even a benign prompt can't make an agent read the host.
Learn more
What Kronos secures
Five controls around everything your AI factory takes in and puts out, one policy plane. Each one fails closed, and each one writes down what it decided.
Supply chain
Nothing serves unsigned
Every model, adapter and dataset is scanned, described in an ML-BOM, signed and registered before it can be promoted. Unsigned or unscanned, the gate fails closed.
Cryptography
Signatures that outlive the attack
Weights and audit records stolen today are worth breaking years from now. Kronos seals both with ML-KEM and ML-DSA, hybrid with the classical curves, so what you sign this year still verifies long after the machine that could break it exists.
Runtime
Every prompt is a policy decision
Authorization first, injection detection on the way in, filtering on the way out. The answer can be no.
Data
Nothing embeds unchecked
Malware, PII and provenance are settled before a document reaches your vector store. Poisoned context never gets indexed.
Audit
A control you claim is a control you can show
Every scan, gate decision and served response lands in one append-only, hash-chained record, streamed into whichever SIEM you already run.
Six checks before your model goes live.
Bring it from Hugging Face, NVIDIA NGC or your own team. Until it is checked, it is just a file. These six steps turn it into something you can safely run in production.
Record where the model came from, who published it and what it claims to be. Nothing runs yet.
Check the file for malware and unsafe code, then list every layer, weight and dependency inside it.
Attach the results to this exact file and sign them. The record travels with the model from here on.
Check the signature against your rules before anything reaches production. No record, no release.
Run the model with checks on who is allowed to call it, what goes in to it and what comes back out.
Keep a record of every check and every decision, and stream it to the tools your team already runs.
Mapped to the frameworks you answer to
See the compliance mappingBring your whole AI factory. We'll secure it.
Put the gate in front of every model, dataset, prompt and agent, on the infrastructure you already run, and keep the record that proves it held.
Book a demo