Security tools
- One signed-in endpoint in front of your security vendors' tools
- People see only the tools they're allowed to use, and anything else is refused
- Turn off a vendor connection and its tool calls stop straight away
Omni | AI gateway
Give AI the access. Keep the keys.
Omni sits between your analysts and AI agents on one side and your security tools and AI models on the other. Each person and each agent reaches only what they're allowed to, vendor and model credentials never leave Omni, and every call is recorded.
Investigation agent asks for access
Requested on behalf of the analyst who owns case #2187.
| Tool | Kind | Decision |
|---|---|---|
| edr.get_device | Read | Approved automatically |
| siem.search_events | Read | Approved automatically |
| edr.isolate_device | Contain | Needs a second person |
Recent calls
siem.search_eventsAllowed, recorded
idp.reset_mfaRefused, not granted
Case#2187
EndsToday, 18:00
Call limit40 calls
Can hand onNarrower only
ApproveDeny
Vendor keys shownNone
RecordedEvery call
Deny
By default, for every tool a person or agent hasn't been granted
0
Vendor or model keys shown to the caller
2
People needed for any containment action
Every
Tool and model call recorded, on a log that can be added to but not changed
Omni at work
See Omni work one case.
From a suspicious sign-in to the audit trail.
What the video shows
- It starts with a suspicious login. Your analyst asks an AI assistant to look into it. To be useful, the assistant needs your security tools: detections, identity and EDR.
- Handing it an API key is the easy part. The hard part is how much access it should have, who approves a risky action, and when that access ends.
- Introducing Omni. Give AI the access. Keep the keys.
- Your team signs in, and your keys stay put. Analysts work in Claude Code, Claude Desktop or Codex, each signed in as themselves. Vendor credentials stay in Omni. It connects to Rapid7 and SentinelOne, and any vendor's tool server can be added under the same controls.
- Each analyst sees only their tools. Access follows the roles and groups you assign, including Google Workspace groups, and an explicit denial always wins. A Tier 1 analyst who tries to isolate a device is refused because it isn't in her role.
- Access for one case, not for every case. A session grant names the tools, ties them to one case, and sets an expiry and a call limit. Containment always needs a second person.
- Permission to gather evidence never quietly becomes permission to take a machine off the network.
- Hand off less, revoke once. An agent can pass a smaller grant to another agent, with fewer tools and no more time. Revoke the first grant and every grant made from it stops.
- Pick the model and cap the spend. Models come from a catalog your admins approved, and budget is reserved before every request, so parallel agents never spend the same balance twice.
- See the AI apps your team runs. The optional inventory shows which AI apps are installed and flags the ones you haven't approved. It never reads prompts, conversations or files.
- Trace any call back to a case. Every call links to a person or agent, a grant and an investigation. The trail is append-only, and a call doesn't run unless its audit record is written.
- Connecting AI to your security tools? Bring a case and we'll walk it through Omni. We host a separate Omni for each customer, with its own database and encryption key, and enterprise customers can run it in their own cloud account.
How it fits together
Everything that asks goes through one place.
Who asks
- Your analysts
- AI assistants like Claude Code and Codex
- Your own agents
- Steward and Automaton
Omni
- Checks who is asking and what they hold
- Applies your rules and approvals
- Keeps the vendor and model keys
- Records every call
What it reaches
- Your security tools
- The AI models you approved
- On each computerAn optional small helper sends AI traffic from that computer through Omni, so the same rules cover the rest of the company. More below.
- Where it runsWe host a separate Omni for each customer, or enterprise customers run it in their own cloud account.
What it controls
Two ways out, one set of rules.
AI assistants and agents reach your security tools and your models through the same gateway, under the same identities, roles and audit trail.
AI models
- A catalog of models your admins approved, with no provider key in sight
- No model is used until your administrator approves it, after checking the provider's terms on training and retention
- Spending is reserved before each call, so parallel agents can't overspend
Access per case
Access for one investigation, and then it ends.
An agent working a case gets a short-lived grant instead of a standing key: the exact tools it may use, for one investigation, for a limited time.
Scope
A grant names the case, the exact tools, an expiry and an optional call limit. Ask for one tool you don't hold yourself and the whole request is refused.
Approve
A second person approves each grant by default. Whoever asked can't approve it, unless an admin marked all of its tools as safe to approve automatically.
Contain
Containment, like isolating a device, can never be approved automatically. It always waits for that second person.
Revoke
An agent can pass a smaller part of its grant to another agent. Revoke the first and everything handed on from it stops too.
Controls and evidence
For the people who have to answer for it.
Security and compliance teams decide who holds which rights, and can show afterwards exactly what happened.
The record comes first
Every call is recorded with the person or agent, the grant and the case. The record can't be edited, and if it can't be written, the call doesn't happen.
Usage, not conversations
Hosted Omni records each model call by tokens and cost, without the prompt or the reply. Self-hosted, you can keep full messages in your own environment.
Rights you can check
Roles and groups grant access, and a deny always wins. Nobody can hand out a right they don't hold, and you can see where each person's access came from.
Your single sign-on
People sign in the way they already do. With Google Workspace, the groups you already manage decide each person's role.
Rules that watch usage
Rate rules block a caller who goes over a limit, and alert rules email the right people when activity looks unusual.
Signed and scanned
Omni ships as signed images, each with a software bill of materials, and every release is scanned for known vulnerabilities before it ships.
AI across the company
See how the rest of the company uses AI too.
AI use doesn't stop at the security team. Omni can show which AI apps people have installed and where they send requests, and lets you decide which AI services are allowed.
Usage, policy and alerts cover the computers and AI clients you route through Omni or its small helper on each computer. Someone who goes straight to an AI service from an unmanaged device is outside that view, so your existing device and network controls still matter. The app inventory is optional and off until you turn it on.
Which AI apps are in use
Each computer reports the AI apps installed on it. People see a notice when it reports, and turning it off deletes what was collected.
Where requests go
Which AI service and model was called, and when. What people typed stays out of the record by default.
Allow what you trust
Block AI services you haven't approved. A blocked request stops on the computer with a message naming your policy.
Know when someone goes around it
A request to an unapproved service raises an alert for your team.
Works with
The clients, models and tools you already use.
- AI clientsClaude Code, Claude Desktop and Codex, set up by Omni's setup tool, plus your own agents on the same endpoint.
- ModelsOpenAI-compatible endpoints, Anthropic, Amazon Bedrock and Gemini on Google Vertex AI. Bedrock and Vertex AI use your cloud identity, so no long-lived key is stored in Omni.
- Security toolsEndpoint, identity, email, SIEM, cloud and vulnerability tools, including Rapid7 InsightIDR, SentinelOne, CrowdStrike Falcon, Sophos Central, Microsoft Defender, Microsoft Sentinel, Google Workspace, Cloudflare, Qualys and Lumu. Any other vendor tool server you add sits behind the same controls.
- DeploymentEach customer gets their own Omni, with its own database, encryption key and tool connections. Enterprise customers can run it in their own cloud account.
- Steward and AutomatonBoth reach your tools through your Omni, so neither ever holds a vendor key. Read the launch post.