Sensor Modes
Choose your deployment profile
Recommended
Light Mode
30MB
<0.15ms detection latency
Pattern matching and structural detection. Minimal resource footprint for high-throughput environments.
Full Mode
Full Engine
Complete detection engine
ML classifiers for known threats plus energy-based scoring for novel behaviour. The complete on-device detection stack in one runtime.
Relay Mode
Audit
Log-only, zero blocking
Observe and log without enforcement. Ideal for shadow AI discovery and initial deployment.
Deployment
Production-ready from day one
| Pattern | Use Case | Coverage |
|---|---|---|
| K8s DaemonSet [host] | Cluster-wide AI workload protection | Full cluster |
| Docker Sidecar [host] | Per-pod deployment alongside AI services | Per pod |
| Systemd Service [host] | Standalone host agent for VM-based infra | Per host |
| Embedded Library [sdk] | In-application integration via Python SDK | Per app |
Detection
Known threats. Novel behaviour. One runtime verdict.
ML Classifiers
Supervised ensemble trained on labelled attack data. Gives precise, explainable verdicts on known threat families and techniques.
Energy-Based Scoring
Measures how far an input sits from normal traffic patterns. Adds signal when something looks materially different from what the system has learned, even if it doesn't match a known class.
Why both matter
Classifiers give you precision on known threats. Energy scoring gives you coverage when something new appears. The classifier tells you what it is. The energy scorer tells you something is off. Together, your detection doesn't drop to zero on the first novel attack.
Reliability Guarantee
Fail-open by design. The Sensor uses a 3-state supervisor that guarantees traffic continuity even if the detection engine encounters an error. Your AI workloads never stop because of a security component failure.