Agents can spend faster than expected.

Alterion is priced per deployment. Alterion is one control plane, so there is no per-product price list. The quote is built from the size of the estate, the use cases in scope and the support level, and it sets out the billing basis, contract length and invoicing terms.

Yes. Alterion is one control plane with one intelligence layer that supports the entire estate. You can start with a slice of the estate, such as one team or one cloud, and a subset of use cases, such as shadow agent discovery. We tailor the deployment to those use cases, and the quote covers how it expands from there.

No. Alterion deploys lightweight, runtime-level sensors across the infrastructure—monitoring network flows, container behavior, endpoint activity, and application logs—to build a continuously updated map of every agent and their behaviors. There are no code changes, no SDK integrations, and no modifications to how agents are built or deployed.

Alterion goes live in the enterprise environment in under a week, with no code changes or SDKs.

Alterion supports agents deployed on any cloud including AWS, Azure and GCP. We are agent agnostic and support agents built through any agent development framework including Langchain, CrewAI etc.

No. Alterion deploys runtime-level sensors across the infrastructure. There are no code changes, no SDK integrations and no changes to how agents are built or deployed.

Alterion's policy engine lets enterprises define rules once and enforce them everywhere. Import existing compliance policies in plain language or CSV format—Alterion's Small Language Models translates them into actionable rules and applies them to the right agents and boundaries across every cloud, automatically.

Inside your infrastructure: in your cloud account on AWS, Azure or Google Cloud, on your own Kubernetes on-premises, or fully air-gapped. The product is identical in each.

Yes. Discovery runs continuously rather than just at deployment. New agents appear in the inventory the first time they act, and a default guardrails applies to unregistered agents until someone takes ownership.

In a customer-hosted deployment, Alterion the company sees nothing. The control plane inspects agent traffic inside the customer environment: prompts, tool calls, responses, and the spans between them. Every artifact it produces stays in customer-owned storage.

Optional product telemetry is off by default, is limited to aggregate health metrics with no payload content, and can be disabled permanently at install time.

We believe that detecting every agent in the enterprise, especially unsanctioned or shadow agents, requires detection at the runtime (malicious actors will not use an SDK!). Additionally, we believe engineering and business teams should focus on launching agents and driving business value quickly, not being slowed down by SDK integrations and dev time assessments. Enabling governance at the runtime enables the business to move fast and stay competitive, while providing governance at the only time that matters - when the agent is running autonomously with production data and systems.

Yes. Alterion revokes an agent in one place, across every cloud, framework and device it runs on. It sits at the end of a graduated ladder: flag, quarantine the session, block the user, block the agent, notify incident response. Most incidents resolve before the last rung, because Alterion blocks the offending action rather than the whole agent, so the rest of its work keeps running.

In your environment. Everything the control plane captures and produces stays in customer-owned storage. Nothing crosses your perimeter or returns to Alterion.

Yes, Alterion runs entirely in the environment, on-prem or air-gapped, with zero data egress. Enterprises control what leaves their walls, and what reaches external models.

No. Audit packs come from the runtime, eliminating the need for a separate team to conduct audits.

None, and no SDKs. It runs entirely in the stack.

None.

No. Alterion runs entirely in the stack.

Policy is enforced in the path, per action, so a single tool call or data transfer can be blocked while the rest runs. Every prompt, tool call and response gets a verdict in under 100 milliseconds, so engineering teams aren't slowed down. The agent kill switch is the last step, not the first.

Yes. Air-gapped installs are a first-class deployment model, not an exception path. Detection runs on locally served models, policy packs are imported as signed bundles, and licensing is validated offline. Outbound egress is blocked and verified at deploy time.

Traditional policy tools enforce rules based on access permissions (what an agent can do). Alterion's contextual boundaries enforce rules based on intent (what an agent should be doing). A finance agent can't talk to the customer support database not because of a hardcoded rule, but because the system understands the agent's purpose and baseline behavior, and prevents actions outside their intended scope.

No agent code changes or SDKs.

Alterion is air-gapped and runs in the stack, so residency is answered by the deployment itself.

97.5% classification accuracy, with a verdict in under 100 milliseconds.

In a VPC, models included, with no egress.

None, and no SDKs.

Teams decide, agent by agent: register it and assign an owner, allow it under a policy, restrict what it can reach, quarantine it, or pull the agent kill switch. Every action is taken from one place (Draco), which applies to the agent, wherever it is.

The customer's own deployment does, and nothing else. Our intelligence layer is built as a network of specialized small language models that reason together and draw on persistent enterprise memory, so the system learns the environment over time. That is the product working as designed. A control plane that cannot learn the baseline cannot tell normal from anomalous.

Sovereignty is part of that architecture, not a setting layered on top. The models, the memory, and the enterprise context all stay inside the security boundary they exist to protect. Nothing is returned to Alterion, pooled across customers, or used to improve what we ship.

Binding in our Enterprise Terms: no customer input, output, or captured span is ever used to train, fine-tune, or evaluate any third-party model or any model Alterion distributes out of the box.

Yes. Alterion monitors prompts flowing through agents in real time and flags injection patterns—including attempts to override system instructions or escalate permissions through text, files or images. When detected, we trigger remediation automatically.

Support levels and response times are set in the quote, from deployment through day-to-day operations.

Yes. Spend is attributable by team, agent and use case, so cost becomes a governed, provable line rather than an estimate.

Scoring is part of the full solution. As an agent's live risk score climbs, runtime governance tightens boundaries and blocks off-policy actions.

Yes. The MCP and function-calling step is judged across every prompt, response, tool call and payload.

Yes. Set policy once and apply it across every agent and environment.

Every prompt, tool call and commit is checked pre-execution on the device, so secrets and non-compliant code are stopped before they run.

Each agent is traced through the credentials, accounts and systems it uses back to a person or team. Anything that can’t be attributed is flagged as unowned. No agent sits in the inventory without a human accountable for it.

Access is role-based and scoped to a Boundary, so a team only sees the agents and sessions inside its own scope. Authentication is via the customer IdP over SAML with SCIM provisioning. Every privileged action writes to an append-only audit log that can be streamed to a SIEM.

Identity tools know who an agent is. Alterion knows what it's doing. Agents aren't users; they don't have job titles, org charts, or intent that can be read from a permission set. Alterion was built from first principles for non-deterministic, autonomous systems. That's a fundamentally different architecture than retrofitting an IAM tool.

Alterion is SOC 2 Type II. The report and our security documentation are available under NDA through the Trust Center.

The design rests on one idea: test every cost change before it reaches live traffic, then apply it at the gateway so the agent's code never changes.

Evidence is audit-ready, generated from runtime activity and mapped to SOC 2, ISO 42001, NIST AI RMF, HIPAA and the EU AI Act. It is produced live from the runtime.

Three types of controls: heuristic (matches known patterns) semantic (reads intent), and behavioral (tracks drift over time), judged in-path by purpose-built small language models.

Runtime enforcement covers the seams siloed tools leave, and discovery surfaces the shadow agents none of them can see.

Aquila checks browser AI and personal ChatGPT on the device, above encryption, before data leaves the browser, with no TLS termination.

Sensors across endpoints, SaaS and cloud observe activity at runtime, and agent traffic routes through a proxy deployed in the environment, so shadow and third-party agents surface next to instrumented ones.

TLS 1.2+ in transit and AES-256 at rest, with envelope encryption keyed by the customer's own KMS. Retention is customer-configured per Boundary, defaults to 90 days, and supports immediate hard deletion on request.

We believe agents are a new class of technology that require a different paradigm to managing, securing and governing, that does not fit in the existing enterprise IT stack. This is why we built Alterion, the intelligent runtime control plane for agents, providing comprehensive observability, security, governance and optimization for enterprises.

A member of our team follows up to scope your estate and your priority use cases, tailors the deployment to them, and prepares your quote.

Traffic runs through the Alterion gateway, where every request logs the route and model. Alterion prices those tokens at each model's current rate, tracked live as prices change. Each request is tied to its Session and Trace, so spend breaks down by person, agent, Boundary (team) and Session.

Alterion scores every agent from its past and live behavior, identity, permissions and blast radius, using a set of fine-tuned expert models. The alert stream becomes a ranked list.

Agent drift is when an AI agent gradually starts doing something different from what it was set up to do, even if no change was made on purpose.

No. Alterion interoperates as the central plane, pulling gateways, SWG, EDR and DLP into one policy and one view, and filling the gaps between them.

Yes. Author policy once in Draco and enforce through Aquila, Zscaler, EDR or DLP. It is not a rip-and-replace.

Any AI agent acting in the environment that security neither approved nor could see, such as a coding agent on a laptop, a serverless agent deployed in the cloud, or a third-party agent calling enterprise systems with a shared credential.

No. There are no SDKs to embed, no code changes, and no agent rewrites. Alterion sits between agents and enterprise infrastructure at the network layer, which is also why it catches shadow AI that was never registered.