Koi AI Platform™
The world's first agentic endpoint security platform — complete visibility, risk intelligence, and policy enforcement across every piece of software before it ever reaches an endpoint

Universal Software Discovery

Track every application, code package, OS package, extension, AI model, AI agent, and MCP the moment it appears — across macOS, Windows, and Linux. Binary and non-binary alike, with no blind spots and no manual cataloguing.

• Full coverage across binary apps, browser extensions, npm/pip packages, AI models, MCPs, and containers.
• Agentless discovery across macOS, Windows, and Linux.
• Real-time inventory updated the moment software appears or changes.
• No manual cataloguing or scripting required.

Continuous Risk Assessment

Wings™ continuously evaluates code, behaviour, ownership changes, and update channels — adjusting risk scores in real time. Every version change triggers a full re-score automatically, with no manual intervention required.

• LLM-powered code analysis comparing claimed versus actual behaviour.
• Behavioural sandboxing before software reaches any endpoint.
• Publisher reputation and ownership history tracked across all marketplaces.
• Automatic re-score on every version release, ownership change, or new CVE disclosure.

Granular Policy Engine

Apply policy by user, group, risk level, or software type. Auto-approve what is safe, block what is not, and remediate in one click — with scoped, time-bound exceptions and a full audit trail on every decision.

• Allow/block lists configurable by user, group, or software category.
• Scoped, time-bound exceptions with full justification and audit trail.
• Cooldown periods for newly released software.
• Every allow, block, and approval decision logged for compliance reporting.

One-Click Remediation

Quarantine or remove risky items, roll back versions, open tickets, and notify owners — completely agentlessly, across hundreds of thousands of endpoints simultaneously.

• Automated remediation triggered when risk scores cross defined thresholds.
• Version rollback for previously approved software that has changed.
• Bulk removal across the entire endpoint fleet without agents.
• Owner alerts and ticketing integration for IT review workflows.

Koidex™ — Proprietary Threat Intelligence Database

Every risk score Wings™ produces is backed by Koidex™ data — publisher reputation history, cross-marketplace signals, version lineage, and behavioural baselines built from millions of scans.

• Dozens of marketplaces tracked including Chrome Web Store, npm, PyPI, VS Code Marketplace, HuggingFace, and more.
• Full database refresh completed every hour.
• Millions of packages indexed with dynamic risk scores.
• Cross-marketplace publisher reputation signals unavailable in any traditional security tool.

Internal Software Distribution

Publish and distribute approved software internally — so employees can discover and install approved tools without leaving Koi's governance perimeter. Reduces shadow IT while keeping teams productive.

• Curated internal software catalogue for approved tools.
• Employees request software through the governed approval flow.
• Approved installs distributed without bypassing policy.
• Reduces shadow IT without blocking discovery.

Agentless Deployment

Koi deploys at the network layer via PAC files, SWG integration, or user-mode agents — covering every endpoint without touching individual machines. Most organisations are fully deployed and discovering software within 60 minutes.

• Network-based deployment via PAC files or SWG integration.
• No endpoint agents required for full platform coverage.
• Up and running in under 60 minutes.
• Works alongside existing EDR, MDM, and SWG deployments.

API-First Platform

Every feature available in the Koi dashboard is also available via REST API — enabling full automation, custom workflows, and deep integration with your existing security tooling. When Koi says API-first, every feature is included.

• Full REST API coverage for every dashboard feature.
• Enables custom automation and workflow integration.
• Webhooks for real-time event-driven workflows.
• Documented API with SDK support.

Integrations

Koi works seamlessly alongside your existing security stack — SWG, EDR, MDM, PAC files, SIEM, SOAR, and ticketing systems. It is designed to complement, not replace, the tools you already use.

• Palo Alto Networks Prisma AIRS and Cortex XDR
• CrowdStrike Falcon
• Zscaler and Netskope (SWG)
• Microsoft Intune and Jamf (MDM)
• Splunk and Microsoft Sentinel (SIEM)
• ServiceNow, Jira, and Slack (ticketing and notifications)

What Koi Adds to Your Existing Stack

Traditional endpoint security tools were not built for software marketplaces. The following capabilities are unique to Koi and absent from EDR, SWG, and MDM platforms:

• Non-binary software discovery (extensions, packages, AI models, MCPs) — not available in EDR, SWG, or MDM.
• LLM-based code analysis — not available in any traditional endpoint tool.
• Hourly marketplace scanning — not available in EDR, SWG, or MDM.
• Publisher reputation tracking across all marketplaces — not available in traditional tools.
• Dynamic risk score per version — not available in EDR, SWG, or MDM.
• AI model and MCP tool coverage — not available in any traditional endpoint category.
• Pre-install network-layer governance — not available in EDR or MDM.

Koi AI Platform™ Specifications: