What is the difference between monitoring and containment for AI agents?

Monitoring and detection watch agent traffic and raise an alert when something looks like an attack; that is the smoke alarm, and it is valuable. Containment acts on it. At Observe, the default, Crawdad freezes an agent that goes out of bounds and stops secrets (credentials and clear attempts to send data out) from leaving. The Enforce egress lock, which lets a governed agent reach only the Crawdad proxy path on macOS when agents run as a separate user, is opt-in; the Isolate sealed workspace (a VM on Apple silicon) comes in a later release. For an MSSP, that is the difference between reselling an alert and operating a control that acts on a compromised agent.

Can one MSSP manage AI agent security for many clients from a single console?

Yes. The self-hosted Fleet Console models each client as an isolated scope subtree with role-based access, so an analyst sees only the clients they are granted. Provision a client, roll out to its fleet with one enrollment key, distribute charter templates that govern at the wire, and roll every client up into one view with per-client threats, open holds, and metered cost.

Does one client's content stay isolated from another's?

Raw content, prompts, responses, and documents never leave the client's machine by default; what reaches the console is metadata only, per the red-team-tested telemetry chokepoint. Per-client tenancy and isolation are enforced by the scope model and verified end to end. No client's prompt or response content is aggregated centrally.

Enforce mode

Your SOC watches for the attack. Crawdad also acts on it.

1.8.2: Enforce is available. Isolate is coming in a later release: its sealed workspace isn't ready yet.

Detection and monitoring are how the category watches for trouble, the smoke alarm, and it earns its place. Crawdad adds the control that acts on the alert: at Observe it freezes an agent that goes out of bounds and stops secrets (credentials and clear attempts to send data out) from leaving; Enforce adds an operating-system egress lock on macOS when agents run as a separate user; and Isolate, in a later release, adds sealed-VM containment. For an MSSP, that is the difference between reselling an alert and operating a control that contains the incident. Multi-tenant, content on-device, one console for every client.

Become a Partner → Download the Partner Brief

Crawdad Fleet Console, multi-tenant AI agent containment across your client base

Fleet Console, per-client tenancy and enforcement posture across every client

Response authority

The market already knows the axis buyers evaluate on. Monitoring, or active containment.

Nearly everything in the AI-security aisle today watches: it inspects traffic and raises an alert. That is real value and Crawdad does it well. But an alert is not a control. When a client asks what actually happens to a compromised agent, an MSSP wants an answer that ends in contained, not flagged.

What everyone resells

Monitoring & detection

Watching for smoke

Inspects agent traffic and scores it for attack patterns
Raises an alert, a verdict, a dashboard entry
Tells you an agent was targeted, after the request is on the wire
Response authority stops at notification, the next move is a human's

What Crawdad adds

Active containment

Putting out the fire

Everything monitoring does, plus freezing an agent that goes out of bounds
Enforce adds an OS default-deny egress lock on macOS when agents run as a separate user, so the agent reaches only the Crawdad path
In a later release, Isolate will seal the agent in a VM whose only network interface routes through Crawdad
Response authority reaches frozen, at the operating system, not by asking the agent nicely; sealed containment comes in a later release

Detection is the foundation, and Crawdad's is benchmarked in the open. Containment is the control you can point to in an incident review. Selling both, from one platform, is the differentiated MSSP offer. See detection and blocking, attack by attack →

The enforcement boundary

A control your analysts operate. Stated plainly.

Observe is the default; a stock device is byte-for-byte unchanged. Enforce, which leaves no path off the machine except through Crawdad on macOS when agents run as a separate user, is opt-in. Crawdad 1.8.2 has no OS network lock on Linux. The macOS pf lock loads its signed anchor and validates its rules, not yet proven at the packet level on hardware. On Linux, and when agents run as the person, Enforce works through Crawdad's own checks (the proxy, hooks and the secrets floor), and no network lock applies.

Enforce · the OS egress lock

Locked at the operating system, not by policy

On macOS, when agents run as a separate user, Enforce installs a persistent OS default-deny egress lock (pf on macOS). A governed agent reaches only the Crawdad proxy path; everything else, including UDP/QUIC, is denied by construction.

›The lock persists across a kill of the Crawdad process, so the boundary doesn't vanish if the enforcer dies.
›Crawdad 1.8.2 has no OS network lock on Linux. On macOS the pf anchor loads and validates its signed rules, not yet proven at the packet level on hardware.

Isolate · sealed-workspace containment

Containment by construction

The Isolate tier, coming in a later release, runs the agent inside a sealed workspace (a VM on Apple silicon, using Apple's Virtualization framework) whose only network interface routes through Crawdad. Escape is refused at the packet level, not by a deny rule.

›On real Apple-silicon hardware, an adversarial escape battery inside a live sealed VM was fully blocked, and the host filesystem was byte-identical after a guest destruction battery.
›Liveness-gated, fail-closed: with the VM capability absent it falls back to the Enforce network-lock floor and reports the configured vs in-force level honestly.

Break-glass · fail-closed

Recovery is deliberate

Where the lock is in place, it survives a kill, so there is a deliberate recovery path, and it is deliberately hard to reach, exactly the audit story a SOC wants. When agents run as the person, a program that person runs can still change or stop Crawdad.

›Break-glass requires root and a device-administrator token, is written to the tamper-evident audit chain, and auto-reverts to Enforce at expiry. An agent without root and that token cannot invoke it.
›Fail-closed by default: if Crawdad is alive but can't inspect a request, it blocks rather than forwards. There is no degraded fail-open path.

Platform, stated plainly. Every device runs Observe by default, so a stock device is byte-for-byte unchanged; Enforce is opt-in, and its network lock applies only on macOS, when agents run as a separate user. Crawdad 1.8.2 has no OS network lock on Linux. Read the Enforce mode guide →

Multi-tenant by construction

Every client, walled off. One console.

An MSSP lives or dies on isolation. In Crawdad, each client is its own scope subtree with role-based access, so an analyst sees only the clients they are granted. And because the architecture is local-first and on-device, the isolation is structural, not a filter: one client's prompts and responses never leave that client's machines, so they cannot mix in a shared store because there is no shared store of content.

Per-client tenancy and isolation enforced by the scope model, verified end to end
Raw content stays on each client's machines; the console holds metadata only
A regulated client (HIPAA-style, GLBA-style) can be walled off from the rest of the book
Governance, threats, and enforcement posture roll up per client and across clients
Charter templates authored once, distributed to a client's devices, governing at the wire

We prove this the honest way: a repeatable, clearly-labelled synthetic environment stands up several fictional customer orgs across real verticals and shows the isolation, posture spread, and rollup end to end. It is watermarked synthetic throughout, never presented as real customers.

Fleet Console, per-client tenancy and isolation for an MSSP book of business

Crawdad Dashboard, per-client detection trends and enforcement posture

Fits the SOC you already run

Provision, contain, prove, and stream to your stack.

The multi-tenant model, the enforcement rollout, the review queue, and the exports are part of the product, not services you assemble. Crawdad rides alongside the tools your analysts already live in.

Provision & roll out

A client, then its fleet

Create an isolated client scope, then roll out with one minted enrollment key and a ready-to-run package: the enroll command, the unattended installer invocations, and the CA fingerprint pin. Devices self-enroll with no per-device signing. Push it through the RMM or MDM you already run.

Contain & review

Set the posture, resolve the holds

Set protection per client and pin it fleet-wide (Observe or Enforce). A charter bounds what a client's agents are for, judged on the action taken, not the intent claimed; at Enforce, held actions surface in a cross-client review queue your analysts resolve from the console, releasing a session or keeping it gated.

Prove

A report you can hand the client

Every device event lands in a tamper-evident, hash-chained audit log, Ed25519-signed and offline-verifiable with a standalone tool, no network and no secrets from the machine. Verifiable forensics is the report you hand a client after an incident.

Stream & bill

Into your SIEM, onto your invoice

Export detection and governance events to your SIEM over Splunk HEC or OpenTelemetry, so agent-layer signal lands where your analysts already work. Bill per governed device at your own price. Usage is metered through Stripe usage records, counted from the real device inventory.

Trajectory reasoning watches the shape of a whole session and holds a staged compromise for review, the exfiltration whose every single step looked fine. No runtime check catches every composed harm; this catches the staging shape, at a very low false-positive cost in our testing on benign multi-step work. The whole model runs on your own self-hosted console, with each client's content staying on their machines.

Detection you can check

533 real attacks on a public, reproducible benchmark

The detection engine is measured on this public corpus, the local sidecar's full multi-layer ML pipeline running in-line on proxied traffic. Detection and blocking are separate: at Observe (the default) Crawdad records detections and blocks secrets (credentials and clear attempts to send data out) in chats that go through it, in agent tool calls, and on supported AI sites, and broader blocking comes with Enforce, which is opt-in. The corpus is open so you can run it yourself. Detection and blocking, explained →

533attacks tested

1,187benign samples

15attack categories

102held out

Every result is published, including every miss and false positive. Clone the corpus, run it against us or anyone, and compare. In a category full of unverifiable assertions, a reproducible benchmark is the point, not the footnote.

Multi-layer detection pipeline. Built in Rust. Over 5,100 automated tests across the workspace. Raw content stays on the client's machine by default, metadata-only telemetry by default (none at all when run fully offline).

AndrewSispoidis/contemporary-agent-attacks →

CC BY 4.0 · 533 attacks · 1,187 benign negatives · 15 categories

MSSP economics

A control you can price. A tier above the feed.

Containment is a higher-value service than a feed of alerts. Crawdad gives you something to charge for that your clients can feel.

Differentiate

Sell the control, not just the alert

Most of the market resells detection. An MSSP that can say "here is the agent we froze, and the record that proves it" has a story the alert-only competitor can't match, backed by proof, not adjectives. Enforce adds OS-level containment on macOS when agents run as a separate user.

Additive

Alongside your existing stack

Crawdad covers the agent layer that EDR, DLP, identity, and network tools don't see, and streams its signal into the SIEM your analysts already run. Additive to your SOC, not a rip-and-replace.

Timing

An early lead in agent containment

Agent security is nascent, and containment is the part many vendors haven't reached. The MSSPs who bring a real control now can lead their clients on it.