Capability · Coverage
See coverage. Find the gaps.
Prove it to auditors.
The Console shows guard-version distribution and enrollment coverage across the fleet — which agents the guard is actually wired into, on which devices, and exactly where it isn't yet.
FLEET COVERAGE 42 devices · updated 17:38 enrolled 38 / 42 ▇▇▇▇▇▇▇▇▇░ 90% behind version 3 v1.6.0 → v1.7.0 not reporting 1 last seen 6d unprotected 4 GAPS dev-09 cursor not wired dev-21 codex pending trust dev-33 claude-code not wired wired into N of M agents · per device
The risk
A control you can't prove isn't a control
Deploying a guard isn't the same as covering the fleet. Without coverage data you can't tell a protected developer from an unprotected one — and neither can your auditor.
Silent gaps
A new laptop, a freshly-installed agent, or a developer who skipped the install is an unguarded path — invisible until something goes wrong.
Version drift
When devices run different guard versions, the policy you think is enforced may not be the policy actually running everywhere.
No evidence
“We have an AI policy” isn't enough for SOC 2 or ISO 27001 — auditors want to see the coverage, per device, with the gaps.
Mechanics
How coverage is measured
Enrollment detection
On each device the guard determines which coding agents are present and which of them it is actually hooked into — “wired into N of M agents.”
Report version & status
Each device reports its guard version and per-agent enrollment status to the Console as part of its heartbeat.
Roll up the fleet
The Console aggregates into a fleet view: version distribution, enrolled vs not-reporting vs unprotected devices.
Expose the gaps
The devices and agents the guard isn't on are listed explicitly — a worklist, not just a percentage.
Inside the capability
What the fleet view shows
The coverage picture a security team needs to operate the guard and prove it works.
Enrollment coverage
Per developer and device, which agents the guard is wired into — the literal “N of M agents” signal.
Version distribution
Which guard versions are running where, so you can spot lagging devices and confirm a rollout landed.
Reporting status
Enrolled, behind, not-reporting and unprotected devices, each called out distinctly.
Gap worklist
The exact devices and agents still missing the guard — so closing coverage is a concrete task.
Audit evidence
A coverage baseline you can hand an auditor as proof the control is actually deployed, not just bought.
Inventory-correlated
Built on shadow-AI discovery, so coverage is measured against the agents that actually exist on each device.
Outcomes
What you get
- A clear answer to “what fraction of the fleet is actually guarded?”
- Per-device, per-agent enrollment — not a vague rollout estimate
- Version distribution to confirm policy is uniform
- An explicit gap list to drive coverage to 100%
- Audit-ready coverage evidence for SOC 2 and ISO 27001
- A baseline to leave a pilot with on day one
Ready to see your graph?
Connect a cloud account in under 30 minutes. See every finding rooted in identity, asset, and blast radius — with a fix path attached.
Book a Demo