Frequently asked questions

EndSecure is an AI security and AI governance platform for Windows endpoints. It finds the AI tools people use, recognises sensitive data before it reaches them, applies the policy you set, and records what happened in a Security Console your team can investigate.

Security teams who need to see and control AI use, IT administrators who deploy and look after endpoints, and compliance or privacy leads who need evidence of how AI is governed. It works for a single office as well as a larger organisation with several teams.

Shadow AI is AI used at work without the security team knowing about it: a chatbot in a browser tab, a desktop AI app, or a local model someone installed. EndSecure is how you find it and decide what is allowed.

Installed AI software, AI apps starting and stopping, local LLM runtimes such as Ollama, LM Studio, AnythingLLM, LocalAI, Jan and llama.cpp, and supported AI websites through the browser extension. On those sites it checks pasted text, typed text when you press Send, and file uploads. For desktop AI apps, Clipboard Guard checks pasted text.

No. EndSecure inspects content only where the application and endpoint integration make it possible. Text typed by hand into a desktop AI app is not inspected. Each AI application shows its telemetry coverage (full, partial, metadata only or process only), so you always know what is and is not observed.

FULL means content was inspected before it was submitted (a prompt, paste or file). PARTIAL means only the AI destination was observed. METADATA ONLY means a local model service reported metadata. PROCESS ONLY means only the running process was seen. UNKNOWN means no telemetry has been received for that application yet.

Secrets such as API keys and credentials, personal and customer identifiers, financial identifiers such as PAN, Aadhaar and IBAN, and other patterns your policies care about. Detection runs on the device and the findings that leave it are masked.

The EndSecure AI Sensor is a Windows service. The browser extension works in Chrome and Edge on supported AI sites. Other platforms are not supported today.

The DLP engine produces masked findings and a risk level on the device. The Policy Engine then applies the action you configured: Allow, Warn, Block or Redact, or send the event for Review or Route it to an approved tool. The event is recorded, and an incident opens where your policy requires it. You can test a change with the What-if simulator first.

No. Setup offers three templates. Balanced discovers AI use, warns on sensitive data and blocks critical exposure such as secrets. Strict blocks sensitive data sent to AI tools that are not approved. Monitor only discovers and reports without blocking anything. Every rule can be changed later, and changes are recorded in the audit log.

Yes. The What-if simulator shows what a rule would have done to recent events before you turn it on, and Monitor only mode evaluates policies without enforcing them, so each event shows what it would have done.

On supported AI sites the browser extension explains why the submission was stopped and which kind of data it found, with the value masked. A warning lets the person decide to continue. For desktop AI apps, Clipboard Guard checks pasted text against the same policy.

Detection runs on the device and only masked findings reach the platform. The sensor, platform and console talk over encrypted channels, each sensor authenticates as its own device, access is role-based, and policy changes and decisions are written to audit logs. No credentials are hardcoded in the product.

EndSecure is designed around masked evidence. The console shows what kind of data was found and where, with the sensitive value masked, rather than keeping raw prompts for people to read.

Access is role-based: Owner, Admin, Security Analyst and Viewer each see and do only what their role allows. Two-factor authentication is available for every account.

Wazuh is optional. If you run it, the EndSecure AI Sensor works alongside the Wazuh agent and its decisions appear as Wazuh alerts (for example rule 100711 for blocked submissions). EndSecure adds AI discovery, DLP and policy enforcement; it does not replace Wazuh.

Download EndSecure-AI-Sensor.msi from the console and run it as administrator on the Windows endpoint, or use the silent install command the console shows you. Each install uses a single-use enrollment token, which the setup screen shows only once.

Setup is six short steps: name your workspace, optionally connect Wazuh, install the sensor, choose a policy template, verify the endpoint and open the console. Once a sensor reports, AI discovery starts on that endpoint.

EndSecure is a multi-tenant SaaS platform, so each organisation has its own workspace. The Enterprise plan adds a dedicated database option; talk to us about deployment requirements.

Uninstall “EndSecure AI Sensor” from Windows Settings, or run msiexec /x with the EndSecure-AI-Sensor.msi package. The Wazuh agent is not affected.

QBOM, the Quantum Bill of Materials, is a post-quantum readiness assessment. It builds an inventory of the cryptography found in an uploaded codebase, a dependency inventory or an imported CycloneDX CBOM, classifies each asset, explains its risk score and turns the results into a prioritised migration plan.

No. QBOM points out potential quantum-vulnerable cryptographic usage and helps you plan and track the migration. Your teams make the changes, and the readiness figures are a planning aid, not a certification.

It reads source code, dependency manifests and lockfiles, or a CycloneDX CBOM you import, and records algorithms, certificates, protocols and crypto libraries with where they appear. Keys are identified by fingerprint only; key material is not kept in the inventory.

Not automatically. Symmetric algorithms are generally less exposed than public-key algorithms, so QBOM marks them Review required rather than ready: key size, mode and how the keys are exchanged still deserve a look.

DPDP Saf, the DPDP Compliance & Consent Audit, helps you assess privacy controls against the Digital Personal Data Protection Act, 2023. Import an application data map as JSON or CSV, or start from the demo map. It maps personal-data flows, audits consent, purpose, retention, Data Principal rights, sharing, security and governance, and produces a DPDP control assessment with a prioritised remediation plan.

No tool can do that on its own, and DPDP Saf does not claim to. It is audit support: it shows potential gaps and items that need review, based on the evidence you provide. It is not legal advice, so confirm conclusions with your legal or privacy counsel.

From evidence. For each area, coverage is the number of controls with supporting evidence divided by the controls assessed. A control without evidence is never counted as met; it shows as a potential gap or as review required, and missing details are named plainly, for example "retention period not documented".

Yes. Imports, finding updates and remediation changes are recorded in the EndSecure audit logs, and the assessment can be exported as a report for your privacy team or auditors.

EndSecure is onboarding early customers now. Join the waitlist and we will contact you about early access, including an evaluation in your own environment.

Pricing is revealed at launch. Join the waitlist and you will see early-access pricing first.

A Windows device with the EndSecure AI Sensor installed.