Changelog
What's New
Stay up to date with the latest releases, features, and improvements to Saf3AI.
Now on Google Cloud Marketplace and Microsoft Marketplace
SAF3AI is listed on Google Cloud Marketplace and Microsoft Marketplace. Through Google Cloud Marketplace you can buy directly, billed through your Google Cloud account.
- Google Cloud Marketplace: buy directly, billed through your Google Cloud account
- Microsoft Marketplace (formerly Azure Marketplace): listing live
- The same security review, DPA and SOC 2 Type II report apply whichever route you buy through
Agentic Skills & Workflows
Detection rules and response playbooks are now one library. Skills are atomic capabilities; workflows are ordered chains of them. The agent runs a known workflow for a known threat, and composes a new chain from the live catalogue for anything novel.
- Unified skill library covering sense skills and action skills, each with a published manifest
- 40 out-of-the-box workflows grouped across ten threat domains
- Agent-composed workflows for novel incidents, constrained to the real skill catalogue
- Compose a workflow from a plain-language description, then edit and save it
- Reversible actions record their reversal path; irreversible ones always require confirmation
- Skills report honestly when the integration they need is not connected
Recommendations, Hunt and triage
Three additions aimed at the gap between a signal arriving and someone doing something about it.
- Recommendation engine with per-rule cadence and audience-aware ranking
- Hunt: a structured filter builder over raw signal, with natural language compiling into the same filters
- Triage engine clusters uncorrelated signals by entity into candidate incidents that can be promoted
- Investigation agent — read-only AI analysis that gathers evidence and writes a verdict before an analyst opens the case
- Auto-investigate on incident open, with reversible and fully audited auto-triage
AI-SOC and the detection fabric
The security module became a real security operation: a detection engine, graph correlation and behavioural analytics running continuously rather than as point-in-time reports.
- 187 detection rules mapped to the OWASP LLM Top 10 and MITRE ATLAS
- Continuous detection engine with durable watermarks and idempotent incident upsert
- Graph correlation for toxic combinations and multi-stage campaigns
- Behavioural analytics with online baselines per identity and agent
- Validated classifiers — Luhn, IBAN mod-97, SSA-rule SSN, provider-signature secrets, Trojan-Source detection
- Explainable severity scoring with mitigation credit and counterfactuals
Managed devices and endpoint coverage
Shadow AI discovery extended from the browser and network to the managed device estate.
- Jamf Pro and Microsoft Intune connectors for AI application inventory
- CrowdStrike Falcon and Microsoft Defender for Endpoint EDR signal
- AI software inventory with no new endpoint agent required
- Device posture as an input to risk scoring
Context Graph and unified AI-BOM
Every connector now writes into one Context Graph. Risk is prioritised by what an attacker can actually reach rather than by isolated finding severity.
- Unified Context Graph across agents, models, tools, datastores, identities and findings
- Computed attack paths from external entry points to sensitive data
- Toxic combination detection surfaced as one critical finding rather than several mediums
- AI-BOM: a live bill of materials for the whole AI estate
- Reachability-based prioritisation across every connected surface
SAF3AI CLI and developer surface
AI security pushed left, into the pull request and the pipeline.
- saf3ai CLI — a single Go binary with redteam, sast, policy, auth and config commands
- SARIF 2.1.0 output with line-level locations for code findings
- CI gate exit codes against a configurable severity threshold
- Composite GitHub Action and Homebrew formula
- VS Code extension rendering findings as inline diagnostics
OpenAI and Anthropic coverage
Native connectors for the two AI vendors most enterprises adopted after Copilot and Gemini.
- Anthropic connector: Compliance Activity Feed, chat content, usage, cost and workspace inventory
- OpenAI connector: ChatGPT Enterprise compliance logs, platform audit logs, stored completions and cost
- Cursor connector for AI coding assistant telemetry
- Non-human identity inventory for API keys across both providers
Gateway telemetry from ten SWG vendors
Read AI traffic from the secure web gateway you already run, with no new inline hop.
- Table-driven ingestion for Zscaler, Netskope, Palo Alto, Cloudflare, F5, Kong, LiteLLM, Azure APIM, Google Agent Gateway and AWS Bedrock
- Each vendor's own log format mapped natively — no normalisation work required
- Trusted-upstream-proxy mode for production enforcement
- Magic-link scoped API keys for teams and contractors
Cloud AI posture
AI resource inventory and audit coverage across the three major clouds.
- AWS Bedrock model, agent and knowledge-base inventory
- Google Vertex AI endpoint and model inventory
- Azure OpenAI deployment inventory
- CloudTrail, GCP Audit and Azure Activity ingestion scoped to the AI control plane
- Generated read-only IaC setup scripts per cloud
AI Gateway & Shadow AI
Two platform pillars: AI Gateway for inline enforcement across all AI traffic, and Shadow AI for discovering and governing unsanctioned AI usage.
- AI Gateway with inline policy enforcement and guardrails
- Shadow AI discovery for Claude, ChatGPT and Copilot in browsers
- Enhanced security rules for jailbreak detection
- Performance improvements for high-throughput tracing
Evaluation Framework
Comprehensive testing and evaluation tools for AI agents, including red team simulations and benchmark suites.
- Evaluations module with test suite management
- Red team simulation capabilities
- Automated regression testing for AI behavior
- Integration with CI/CD pipelines
General Availability
Saf3AI is generally available: security, observability, FinOps and compliance for agentic AI.
- Production-ready security layer with threat detection
- Full observability with tracing and metrics
- FinOps module for cost management
- Compliance and audit logging
- Python and Node.js SDKs
Stay Updated
Subscribe to our newsletter for release announcements and product updates.