Stop the attacker the moment they’re caught.
Deception detects and Investigation decides. Kandaro Protection will be the product that acts: it will stop a hijacked AI agent’s session, isolate a machine or disable an account, through the tools you already run. You decide whether Kandaro alerts, asks first or acts on its own.
Agent session · support-assistant
- 01tickets.searchok
- 02docs.readok
- 03web.fetchok · page contained hidden instructions
- 04vault.read_secretdecoy tool
Session stopped. No real tool was reached after the decoy.
Illustration of planned functionality; details may change before launch.
What we’re building
What Kandaro Protection will do
Stop an AI agent’s session
When one of your agents uses a decoy tool or credential, its session will be ended through the gateway or agent hooks you already run.
Isolate a machine
A machine that touched a decoy will be cut off from the network through your own EDR or firewall, and released again with one action.
Disable an account
An account that used a decoy credential will be disabled and its sessions revoked through your identity provider.
Three modes, set per trigger
Alert only, ask for approval, or act automatically. Your own scanners and monitoring tools go on an allow-list, so they never trigger an action.
Two triggers, both certain
Protection will act on a decoy hit from Deception, which has no innocent explanation, or on a response you approved in Investigation. It never acts on a guess.
Every action on record
What was stopped, why, on whose approval and how to undo it, kept in the audit log. Actions stay inside your own environment.
Part of the Kandaro platform
One job each. Protection is the one that acts.
Deception plants every decoy and raises the alarm. Investigation weighs the alerts and recommends a response. Protection carries it out, and Emulation will prove that the stop works. Protection is an add-on: it needs Deception or Investigation to tell it when to act.
- Every finding explained in plain English
- Same account, same MFA, same Console
- Same alert channels and webhooks
Early access
Be first in line.
Kandaro Protection is in development. Join the waitlist and we’ll invite you to early access, and tell you about pricing before launch.
Need protection today? Kandaro Deception is live.