Not another EDR.
The AI layer your stack is missing.
See what staff use, stop what policy forbids, and close the loop in your portal — without storing prompts by default.
AI risk needs detection and response —
not another spreadsheet.
Unmanaged AI usage
ChatGPT, Claude, Copilot, and desktop AI apps run on consumer accounts — outside your allowlist and outside traditional security tooling.
Risk at the keyboard
Sensitive data and unsafe prompts reach AI tools in the browser and on the desktop — often before traditional controls see them.
No defensible posture
Auditors ask about LLM risk. You need a posture view tied to real usage — with evidence you can accept, remediate, and report on.
Four steps. Built to close.
Coverage, intel-backed detection, runtime policy, and response — in one product.
Monitor
Every AI tool, user, and gap in coverage — browser and macOS.
Detect
Prompt injection, jailbreak, data exfil, sensitive data, and suspicious AI hosts — backed by OWASP, MITRE, and synced phishing/CVE intel.
Enforce
Block, redact, or warn at the keyboard — policy decides, not a cloud delay.
Respond
High-signal alerts, MITRE-mapped context, Forensics, and board-ready reports.
Four layers. One job: secure employee AI.
Deploy, detect with intel, enforce at use, respond in the portal.
Spur AIDR · AI Detection & Response
Portal · API · Alerts · Forensics · Vulnerabilities · Reports
AIDR engine
Runtime detection
On-device classifiers at the keyboard — injection, jailbreak, exfil, PII, credentials, and research-approved patterns — before prompts leave by default.
Policies
Tool tiers, data rules, block · redact · warn · log — assign by user or email.
Threat intel
OWASP LLM, MITRE ATT&CK & ATLAS, phishing feeds, CVE snapshots — enriched on ingest.
Events & metadata pipeline · extension & endpoint sensor → cloud
What Lapwing protects
Employee use of third-party AI — web chatbots, copilots, and desktop clients. Approved tools and shadow AI, with sensitive data and abuse paths covered.
Pilot in a day — when you’re ready
Deploy
Roll out the Chrome, Edge, or Firefox extension and the optional macOS agent from Deployment. Enrol devices with a shared org code.
Detect & respond
Policies decide what happens at the keyboard; alerts and posture views give your team a queue to work.
Investigate
Forensics graph, audit log, and executive reports — evidence for SOC and compliance without exporting prompts.
Detection and response in the portal.
See AI tools in use across your estate
See which AI tools are in use, who is using them, and where you have gaps. The dashboard is your starting point for risk, alerts, and coverage.
- At-a-glance posture and open alert counts
- Approved vs shadow tool visibility
- Device and user enrolment status
- Registry of known AI services and risk bands
Investigate who connected to what
Usage context in the Forensics graph — users, devices, and AI destinations over time. Filter, search, and export SVG, PNG, or CSV for incident response.
- Interactive user · tool · destination graph
- Time-window controls and edge filtering
- Export to SVG, PNG, or CSV
- Drill-down from any node
Enforce where work happens
Policies turn your rules into action at the point of use — before sensitive content leaves the device. Violations flow into alerts and posture so patterns do not get lost in a spreadsheet.
- Block, redact, warn, or log per your rules
- Tool allowlists and tiered controls
- Alert queue for security triage
- Posture findings with remediation guidance
Triage alerts. Prove posture.
The alert queue is your response inbox. Reports and audit exports help compliance teams show progress — without exporting what employees typed into AI tools.
- Alert queue — unresolved alerts, oldest first
- Executive report with compliance framework scores
- Audit CSV export (ISO 27001, SOC 2, NIST, CIS, Cyber Essentials mapping)
- Print/PDF executive report for board and audit conversations
Prioritise AI security findings
Findings inferred from real usage — shadow tools, policy gaps, and data exposure — with severity, OWASP LLM tags, and accept or remediate workflow. Threat intel enriches events on ingest.
- Open findings ranked by severity and evidence
- OWASP LLM and MITRE-mapped context
- Disposition workflow — open, accepted, remediated
- Feeds the executive report and dashboard posture
Simple pricing, no surprises
Spur AIDR is in early access. Join the list for release updates and pilot availability.
- Browser extension + macOS endpoint agent
- Runtime policy enforcement at the keyboard
- Alerts, Forensics, and AI vulnerability posture
- Executive reports and audit export
- Threat intel enrichment (OWASP, MITRE, phishing/CVE feeds)
Runtime enforcement.
Intel-backed detection.
One closed loop.
Spur AIDR connects discovery, enforcement, investigation, and reporting in one workflow — for teams that need AI coverage, not another log dump.
