Is Vulnify an antivirus?

No. Vulnify does not scan machines. It governs what AI agents and automations can access and do, and decides on their actions.

Do agents have to route their traffic through Vulnify?

Today an agent calls Vulnify before a sensitive action (API or SDK) and obeys the decision. A transparent gateway is on the roadmap.

What happens if Vulnify is down?

You choose: fail closed (block, the default) or fail open (allow). The SDK reports when it used the fallback.

Vulnify stores action metadata (agent, action, resource, destination, counts), not the content of your records. See the Security page.

Early access

Control what your AI agents can access and do

Vulnify shows which agents can reach which data, scores every action with an explainable risk engine, and blocks or escalates the dangerous ones before they happen.

Get started Read the docs

SalesBot → EXPORT_DATA → Customer DatabaseBLOCKED

Risk score

100 / 100

Export operation
Customer PII
External destination
12,000 records

The problem

Agents move fast. Access shouldn't.

Agents inherit OAuth scopes and API keys, work at machine speed and can export thousands of records in seconds. Most teams cannot answer "what can our agents do right now?". Vulnify can.

Connect

Score

Every action goes through the Risk Engine: action type, data sensitivity, destination and volume.

Enforce

Policies turn the score into ALLOW, REVIEW or BLOCK, and everything lands in the audit log.

For developers

One call before every sensitive action

Wrap the tool call. Vulnify answers in milliseconds with a decision, a score and the reasons, so your agent knows whether to proceed, wait for a human or stop.

Quickstart

curl -X POST https://YOUR_API_HOST/v1/events \
  -H "Authorization: Bearer $VULNIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"agent":"SalesBot","action":"EXPORT_DATA","resource":"Customer Database","destination":"EXTERNAL_EMAIL","recordsAffected":12000}'

Platform

Everything you need to govern agents

Agent inventory

See every AI agent, the integrations it uses and the permissions it holds, in one place.

Explainable risk scoring

Every action gets a 0-100 score from simple, auditable rules. Each score lists its reasons. No black box.

Human review queue

Risky actions wait for approval. Your agent polls or waits for the answer, and every decision is audited.

Monitor mode

Roll out safely: record what would be blocked without blocking anything, then switch enforcement on.

Audit trail

A complete history of what each agent tried to do, what Vulnify decided and who approved it.

Built for developers

One API call before an action, a Node SDK, and clear fail-open or fail-closed behavior.

Frequently asked questions

Is Vulnify an antivirus?: No. Vulnify does not scan machines. It governs what AI agents and automations can access and do, and decides on their actions.
Do agents have to route their traffic through Vulnify?: Today an agent calls Vulnify before a sensitive action (API or SDK) and obeys the decision. A transparent gateway is on the roadmap.
What happens if Vulnify is down?: You choose: fail closed (block, the default) or fail open (allow). The SDK reports when it used the fallback.
Is my data safe?: Vulnify stores action metadata (agent, action, resource, destination, counts), not the content of your records. See the Security page.

See it block a 12,000-record export

Create a free workspace, open the demo sandbox and run the Attack Simulator in under two minutes.

Get started