Find the AI already in use
ProblemUnapproved tools are difficult to govern when they are invisible.
CortegaDiscover AI activity on macOS and set application policies.
Endpoint Guard
Discover and govern employee AI use
Bring employee AI use on macOS under control. Discover activity, prevent accidental data leakage, and govern approved applications. Enable Cortega Agents on selected endpoint traffic to add AI Signals and response verification.
Local data protectionApp & device policyOpt-in AI Signals
Why Endpoint Guard
The problem
Employees already use AI across desktop applications. Sensitive information can leave a device before central teams know which tools are in use.
Today
Unmanaged AI on employee devices
- Employee applications
- Unreviewed prompts and data
- Hosted AI services
With Endpoint Guard
Policy at the employee device
- Employee applications
- Endpoint Guard checks local traffic
- Policy-governed AI access
What you get
Catch accidental sharing
ProblemA prompt can include client information, credentials, or other sensitive data.
CortegaRun local checks and observe, mask, or reject matching traffic.
Roll out with clear controls
ProblemFleet deployments need device enrollment and consistent settings.
CortegaManage enrolled devices and application policies, with opt-in analysis for selected traffic.
How it works
Endpoint Guard architecture
A native agent applies application policies and local guardrails on employee devices. Supported assistants can also be configured to send model calls through AIBG.
Inspection, recording, and optional analysis
Observe and police modes inspect configured app domains. Police mode adds local guardrails; each guardrail can log, mask, or reject content on requests, responses, or both. Domains outside inspection scope remain encrypted.
Set recording and data-handling policies for endpoint observability. AI Verifier and Cortega Agents are enabled separately for selected traffic; they are not part of the local guardrail execution path.
AI Data Protection
Inspect sensitive data before transmission.
An employee pastes a customer record, an internal identifier, or a credential into an AI assistant. Endpoint Guard applies local checks to governed requests and responses so your policy can determine what happens next.
01
Detect sensitive information
Use detectors for identifiers such as Social Security numbers, payment cards, phone numbers, addresses, medical identifiers, and credentials. Add custom patterns for organization-specific terms.
02
Observe, mask, or reject
Choose the action for each guardrail: log a finding, mask sensitive content, or reject the interaction. Apply checks to the request, response, or both for applications selected for inspection.
03
Tune protection to the work
Start with an industry guardrail pack, then enable the detectors and actions your teams need. Device guardrails are configured independently from AIBG and can run without a cloud call.
Explore AI Data Protection →Employee AI governance
See the use. Set the policy.
A native device agent covers supported, configured AI applications on macOS. Connect employee activity to an enrolled device instead of relying only on traffic that reaches a central gateway.
01
Discover and govern shadow AI
Bring supported browser and desktop AI use into view, including assistants such as ChatGPT, Claude, Copilot, and Gemini. Select which application domains are observed or policed.
02
App-level controls
Set observe, police, or block rules by application. Police mode adds local guardrails. Domains outside the configured inspection scope remain encrypted and are not captured or checked.
03
Route through AIBG
Route AI agent traffic from ChatGPT, Claude, Cursor, and others through AIBG over API. Control models and budgets, and observe every call, with all AIBG features available. Budgets apply only to routed traffic.
Explore Budget Management →In the console
Manage applications, guardrails, and enrolled devices.
From the Cortega console.
AI Signals on Endpoint Guard
Employee AI activity and analysis
Cortega Agents can analyze traffic recorded by Endpoint Guard, by AIBG, or both. Enable each analysis agent independently and opt in endpoint traffic or specific applications to turn employee AI activity into signals for administrators and analysts.
01
Sentiment and escalation
Identify frustration spikes and conversations that may need review or intervention.
02
Brand and policy compliance
Assess conversations against your rubric. Score quality and adherence to the rules your team defines; Compliance analysis requires a rubric.
03
Topics, intent, and workload
Group recurring needs and classify exchanges by workload. Pair Workload Analyzer with Model Intelligence to inform model recommendations from actual use.
04
Cost and efficiency
Find patterns in resource consumption and opportunities to use models more efficiently. Bring those findings into budget and model decisions.
05
Agent trajectory
Spot repeated loops, wrong-tool choices, or agents giving up. Review where a supported agent workflow went off course.
06
Traffic anomalies
Use Aegis to watch for unusual traffic patterns and raise notifications, with an interactive chat agent for your team’s investigation.
Explore AI Signals →You choose the scope
Local checks and recorded analysis are separate choices.
Local detection does not require a cloud call. AI Signals works on recorded traffic that an administrator explicitly makes available to Cortega Agents.
01
Control application inspection
Select the applications and domains to observe or police. Only configured domains are decrypted for inspection; traffic outside that scope remains tunneled.
02
Control analysis access
Most Cortega Agents are off by default. Choose the traffic sources each enabled agent may read and configure recording, data handling, and retention for your deployment.
Read about Cortega Agents →AI Verifier on endpoint traffic
Help employees recognize unreliable answers.
Add AI Verifier to the governed workflow so employees can receive verification findings while using their AI assistants.
01
Check the response in context
Check policy violations and legal citations, and improve factual relevancy and contextual accuracy using information available in the interaction. No plugin, file upload, or preloaded context is required for the primary workflow.
Explore AI Verifier →02
Bring findings to the employee
When AI Verifier reviews Endpoint Guard device traffic, its desktop app can send a native notification to the person who received a flagged answer. Other Cortega Agents provide analysis for administrators and analysts.
Deploy and operate
Roll out to a team, then your fleet.
Enroll devices, choose application policies, configure local data protection, and enable the analysis sources your organization needs.
01
macOS
Install a native agent that runs as a system service before login, with no per-user setup. Manage enrolled devices by user, hostname, and device identity.
02
Fleet or pilot enrollment
Use an MDM rollout with per-device certificates for managed fleets, or self-service enrollment for an administrator-managed pilot. Review the deployment guide for your environment.
Read the deployment guide →03
Connection-loss behavior
Local guardrails continue to run if the device cannot reach Cortega. AI traffic continues by default; a stricter block-on-failure posture is available when required.
04
Coding tools and the gateway
For supported coding tools, Endpoint Guard can configure approved clients to use AIBG with governed credentials. Model routing, centralized provider keys, and gateway controls then apply to those calls.
Explore Coding Tools →Endpoint Guard + AIBG
One view across employee and production AI.
Endpoint Guard covers configured employee applications on the device. AIBG governs application and agent calls routed through the gateway. Pair them for shared visibility and analysis across both sources.
01
Extend beyond the computer
Use AIBG for model routing, MCP server and tool authorization, application-specific inspection, and customer or tenant operations.
Explore AI Border Gateway →02
Start with a clear policy
Choose the applications to govern and the information to protect first. Then enable the Cortega Agents and verification capabilities that address your team’s review needs.
Endpoint Guard documentation →MAKE YOUR NEXT MOVE
Book a demo
Explore how Cortega fits your AI environment.