Northstar · Trondheim, Norway · 63.43°N 10.40°E
Your walls stop the knock.
We hear the footsteps inside.
A credential leaks, a staging dump walks out, an AI agent gets steered somewhere it shouldn't. Perimeter tools watched the door. These ten products watch what the intruder does next — and fire the moment stolen bait is used.
The rule
Nothing phones home.
No telemetry isn't a setting we ship switched off. It's the rule every product — and this website — is built to.
- The products
- Self-hosted. They run on your infrastructure and make no calls to ours. No usage reporting, no licence ping, no vendor cloud in the path.
- This website
- No analytics, no trackers, no third-party requests. Fonts come from this domain, and the page's own security policy forbids connecting anywhere else.
- The opt-ins
- A few optional features touch the network when you switch them on — the injection classifier's one-time model download, for instance. Each is off until you enable it, and its own page says exactly what it contacts.
The actual problem
What tried the door is well covered. What already walked through isn't.
Firewalls, EDR and WAFs stop or log an attempt at the boundary. That's real, and every vendor already sells it.
They have almost nothing to say once something is inside, leaked, or trusted: whether a stolen credential was actually used, which staging dump left the building, whether an agent's tool call was quietly manipulated. Most teams learn it from a customer, a breach report, or never.
That gap — the hours or months between got in and found out — is the only thing these products exist to close.
How the platform works
Deception and proof, not another log pipeline.
Leviathan Platform is the flagship. Three ideas run through all ten products.
- Bait that trips on use
- Fake credentials, API keys and staging data, planted so that using them — not just finding them — triggers the alert. Health-tested entropy and canary tokens throughout.
- A record you can hand an auditor
- Every trip lands on a tamper-evident, hash-chained evidence trail — not a line in an aggregator someone could have edited after the fact.
- Your infrastructure, never ours
- Self-hosted by design.
docker composeor a real Kubernetes manifest gets you running today, and nothing leaves your network.
The full roster
Ten products. Buy one, or buy all ten.
Each stands on its own — its own price, its own trial, its own test suite. They share one lineage: self-hosted only, and the same honest-disclosure format on every page.
Deception and detection: health-tested entropy, canary honeytokens, hash-chained evidence, policy-gated automation, and one server that watches a whole network's AI agents. Entirely on your infrastructure.
Deterministic PII masking for staging databases, with a honeytoken tripwire built into the fake data itself. Relational integrity survives; a stolen dump doesn't stay quiet.
LLM output safety scanner. Screens tool responses, scraped pages and pasted content for prompt injection, jailbreaks, encoding tricks and glitch tokens before they reach your model — and checks what leaves.
Honeytoken deployment suite: 20 traps — SSH keys, cloud metadata endpoints, router CGI traps, fake admin endpoints. Deploy deceptive assets across your infrastructure and get alerted the moment one is touched.
Real forensic capture the instant a honeytoken trips: process-tree freeze, memory and socket capture, an Ed25519-signed evidence bundle. Linux-only by design, no Windows fallback.
Admission, argument and result scanning for MCP tool calls, hash-based drift pinning and safe STDIO launch, plus guards for unauthenticated servers, memory-write poisoning and credentials that persist across hops. One guard object in your dispatch loop.
37 validated social-engineering probes run against your own agent, with deliberation-aware resistance scoring and a hash-chained, tamper-evident evidence log.
A tiered support-chatbot pipeline: draft, real prompt-injection and exfiltration filter, fail-closed escalation, Ed25519-signed responses. Code and tests are real; a live network demo is still pending.
A self-hosted, file-backed kill switch and webhook broadcast for stopping agent tooling org-wide. Wired into MCP Gateway, Agent Guardrails, Probe Kit and Decoy Kit. One JSON file is the whole state, zero dependencies.
Bait for the thing that reads everything: wires Decoy Kit's traps to Agent Guardrails' injection scanner for coding-agent workflows, plus a narration signal neither has alone. Add-on; needs both underneath.
Governed autonomous penetration testing against your own in-scope target. A signed scope, typed consent and a kill switch you control gate every run; only re-proven findings count. Added to a self-hosted Leviathan Platform on request.
The Leviathan idea sized for one household: device-to-device SSH and WireGuard pairing, a real honeytoken trap layer, a tamper-evident local event log, anomaly detection over it, and a dead-man's-switch heartbeat. Source on request.
Checks an AI-agent codebase for the code and dependency patterns behind 68 published CVEs across AutoGPT, CrewAI, Flowise, Google ADK, LangChain, LangGraph, LlamaIndex, n8n, Semantic Kernel and MCP client/server code. GitHub Action, pre-commit hook, SARIF output. Python, no dependencies, sends nothing anywhere. pip install agent-cve-scanners
One full module of Decoy Kit, not a crippled demo: a real SSH-key honeytoken trap. No signup, no time limit. pip install decoy-kit-free
Watch it work
One ordinary day, eight kinds of organisation.
A compressed-time simulation on a fictional company running the real Leviathan stack. Pick a sector and watch the traps fire, the kill switch hold, and the evidence trail fill — in real operating conditions, not a slideshow.
Bank — fraud-flagged credit agent, blocked supplier-redirection email, paused agents under an uploaded-document injection.
How we actually test this
Two adversarial systems run against our own guarded agents, continuously.
Stikkprøver
74 adversarial probes across 33 angles, fired continuously at our own guarded agents.
Norwegian for "spot checks": a red-cell daemon that sends social-engineering and protocol-confusion probes at agents running our own guardrails, logging every compliance or resistance to a hash-chained evidence trail. A compromised-looking agent's next move is watched through Lokkedue ("decoy pigeon"), a fake covert channel it believes is real — every check-in recorded, nothing reaching a real destination. The record, failures included, is on the evidence page.
The Lab
A deliberately vulnerable app we break ourselves before you have to.
A round-based cyber-range: a deterministic red agent injects one named vulnerability at a time — SQL injection, XSS, IDOR, exposed config, verbose errors, CSRF, open redirect, missing HttpOnly, path traversal, missing clickjacking protection — into a live Flask app. A fix counts only after an automated exploit test verifies it, never a self-graded checklist.
How you deploy
One command, or a hand to hold.
Both are real. Pick by how much you want to do yourself.
- Self-serve
./install.shchecks Docker, Compose v2, openssl, git and free disk before touching anything, then fails with a clear reason instead of a half-built stack. It generates your.env, tags every image with the exact commit it built from, and waits for a real healthcheck before calling it done. Old tags are never auto-pruned, so a rollback is a genuine one-command undo.- White-glove
- The founder flies in, racks it, runs the wizard and stays until it's green — then leaves, because the point is proving how simple ongoing operation is. One-time, in person, not a support contract. Travel plus a day rate, on request: talk to us.
Try it, then scale
A low-cost way in, with skin in the game on both sides.
Self-hosted on your own infrastructure — no per-seat or per-node fees. Every paid platform plan includes Entropy, Defense, Control and Scout, the self-audit.
The cheapest way in: a one-week hands-on review of one AI agent — prompt-injection testing, MCP tool-call review, decoy traps, and a signed tamper-evident report you can hand an auditor. Normally $1,500.
The full platform, your whole team, on your own infrastructure for 30 days, with hands-on help standing it up. The $500 is credited in full toward your subscription if you continue — and every pilot includes 12 months of Bait-Mask at no charge.
Keep it, and you get the whole platform maintained: every component, unlimited environments and seats in your org, product updates and the security-intel feed, next-business-day support, and a quarterly red-team refresh against your agents. Your $500 pilot credits toward month one; annual is $35,000/yr (two months free). Cancel anytime on monthly.
Annual billing ($35,000/yr, two months free) isn't self-serve yet — talk to us for that. Want a done-for-you rollout with hands-on deployment and tuning? That's a one-time guided engagement — talk to us and we'll scope it. Harpoon can be added to the platform on request; see how it's governed.
Trust & release state
Real, and pre-release. Both true at once.
We won't blur those two facts for a better pitch. Here's exactly where things stand — every figure re-run on 2026-10-06.
See the probe-by-probe evidence, failures included → · Or watch one incident play out: Stop Leeroy →
The blog
Write-ups from the field. And an open door.
The blog is open — no account, anyone can post. Teardown of a real agent incident, a trap you built, a CVE you traced. If it's honest and technical, it belongs here.
Get in touch
Tell us what you're trying to catch.
A pilot of the full platform, or a single product. You'll hear back from the person who built it — not a queue.
Talk to us