Shield makes one decision per request. Every time. Before anything happens
Shield judges every request — allow, monitor, challenge or block — across web forms, AI chat and MCP tools, in real time. One decision per request, not per session. Adopt one layer or all three.
Shield sits inline — in front of your web forms, your login, your checkout, your AI chat, your MCP tools, your file uploads, your APIs.
Every request that arrives gets evaluated. Not sampled. Not batched for review later. Evaluated now, before it reaches anything sensitive.
Four possible outcomes
- Allow — the request looks clean; let it through.
- Monitor — something is slightly off; let it through, flag it.
- Challenge — risk is elevated; require proof before continuing.
- Block — risk is unacceptable; stop it here.
That decision is made per request — not per session, not per user, not per IP. Because the threat is almost never the account. It's the interaction.
Three protection layers
L1 — Web, forms and application inputs
A JS widget and backend SDK collect security signals — device and browser properties, request patterns — and attach a signed token before any request reaches your application logic. Credential stuffing is detected from repeated failed sign-ins across accounts from one IP or device. SQL-injection payloads are validated via AST, not regex.
L2 — AI chat and LLM proxy
Every prompt and response passes through Shield before it reaches your model and before it reaches your user. Shield detects known prompt-injection patterns, blocks system-prompt extraction, and can anonymize sensitive data inline — in front of the AI chat you already run.
L3 — MCP tools and agent actions
When an AI agent calls a tool through the MCP gateway, Shield evaluates that call by the risk class of the action — bulk sends, deletions, financial writes — and a call that matches a blocking rule does not execute.
The dashboard exists to help you tune protection, not to give you logs to read. Decisions and events are operational signal, not an audit archive.
Shield is not a SIEM. It doesn't replace your WAF or CDN. It protects the layer those tools don't reach — in real time.
Shield is available as a managed installation, priced to your scope. Request a quote.
Want a live walkthrough for your team? We run it with our expert partner Avenue78.