Platform capabilities

A plain, factual reference for what the Wingback Security platform does. Wingback delivers Agent Detection & Response across four areas: discovery, runtime defense, red teaming, and governance.

Discovery (AI Surface Intelligence)

• Agentless discovery of agents, models, MCP servers, and inference paths across cloud, SaaS, code, and endpoints.
• 30+ AI surface categories; 40+ cloud misconfiguration checks; each asset scored 0 to 100 on configuration, exposure, change history, and ownership.
• Cloud and SaaS coverage: AWS Bedrock and AgentCore (models, agents, knowledge bases, guardrails, flows), Azure OpenAI and AI Foundry, Microsoft Copilot Studio, Salesforce Agentforce, RAG indexes and vector stores. GCP/Vertex is on the roadmap.
• CycloneDX 1.6 AI bill of materials (AIBOM) per model and agent, versioned and exportable.

Runtime defense (Agent Detection & Response)

• Inline enforcement: block, sanitise, throttle, terminate, or alert on agent actions, tool calls, and data flows.
• AI gateway across 12+ model providers (OpenAI, Anthropic, Google, Mistral, AWS Bedrock, Vertex, Gemini, Groq, Cohere, Ollama, OpenRouter, Perplexity) under one policy. Deploy as a drop-in proxy, a Kubernetes sidecar, or an SDK guard, with no agent code changes.
• Four-tier prompt defense: signatures, embeddings, a Prompt Guard classifier, and an LLM judge; resistant to base64 and homoglyph obfuscation.
• Data protection in both directions: 25+ PII entity types plus secrets, with detect, mask, or block.
• MCP gateway: stdio, SSE, and HTTP transports; per-tenant credential isolation; tool input/output scanning; a curated server catalog.
• Agent guardrails: per-agent tool and model allowlists, budget caps, recursion limits, handoff and intent tracing, and a kill switch. Every session is replayable.

Red teaming

• An adaptive, LLM-driven attacker that probes models, agents, and RAG pipelines.
• 800+ attack techniques (27 techniques across 36 vulnerability classes), refreshed continuously.
• Every finding is mapped to a framework and each validated finding compiles into a runtime guard, so the same attack cannot run twice.

Governance & compliance

• Continuous, audit-ready evidence mapped to 15+ frameworks.
• Plain-English policy compiled to runtime rules; 1-click audit binder export; retention configurable from 7 days to 7 years with tamper-evident audit trails.

Endpoint coverage

• Browser sensor for Chrome and Edge with purpose-built adapters for 15+ AI web apps; inline warn, mask, or block before a prompt submits.
• Native macOS and Windows agents that sweep on-disk AI tools, MCP servers, and skills every five minutes.
• 20+ endpoint posture checks mapped to the OWASP MCP Top 10; a live feed of detection rules and malicious-skill indicators.
• MDM rollout (Intune, Jamf, GPO); 60-second heartbeat; browser and native sensors merge into one device identity.

Frameworks & standards

OWASP LLM Top 10, OWASP Agentic Top 10, OWASP MCP Top 10, MITRE ATLAS, ISO/IEC 42001, NIST AI RMF, and the EU AI Act. Wingback is SOC 2 Type II certified and ISO 42001-mapped, with ISO 27001 in progress.

Integrations & deployment

• Agent frameworks: LangChain, LangGraph, CrewAI, AutoGen, LlamaIndex, OpenAI and Anthropic SDKs.
• SIEM and SOC: Splunk, Datadog, Snowflake, Chronicle, and standard SIEM webhooks; OpenTelemetry export.
• Deployment: managed SaaS, dedicated single-tenant, or self-hosted in your own VPC via Helm.