When your own AI drifts, or goes rogue.

The distinction that decides what anyone can honestly claim

Rogue is a scope question. Did this system talk to a service, a model or a tool that nobody approved? Did it act at three in the morning with no human involved? Did its reach inside your network quietly grow? These are questions about behaviour and destination, and network observation answers them well.

Drift is a quality question. Is the same approved system giving worse answers than it did a month ago? That is a question about content, and content sits inside TLS. A passive sensor can produce strong leading indicators and it can date the moment something changed, but it cannot grade an answer. Any vendor turning packet metadata into a quality score is inventing a number.

So the product does two things instead of one. It reports rogue behaviour as detection, and it reports drift with an explicit statement of how much of the picture is actually available.

Rogue AI: what we detect on the network today

All of the following work from observed traffic, with no agent and nothing in your application path. Most of them key off an approved-AI register that you declare once, and which we seed from what is already happening rather than asking you to write an inventory from memory.

• Shadow AI. A service genuinely in use that your register never declared. An empty register means no register, never that nothing is approved, so adding this does not turn every service you use into a finding on day one.
• Zombie AI. A service with a real history that has then gone silent for weeks. The egress path and the credential are very likely still open, and nobody is watching a system nobody remembers.
• Destinations, models and tools outside the register. Declaring what is approved is what makes the word approved mean anything, and each of the three is checked separately.
• New external tool servers reached by your agents. An agent acquiring a new capability from outside your control is a scope change whether or not it was malicious.
• Unattended autonomy. AI activity outside your declared working hours, in your declared timezone. The alert states the basis it used, so you can argue with it.
• Consumption runaway and loop pathology. Volume that keeps climbing, and agents caught talking in circles. We report consumption rather than currency, because the network does not know your contract price.

Drift: leading indicators, dated, with the confidence stated

• Provider endpoint and client change. A change in the negotiated TLS characteristics of a provider, a new client fingerprint for a host and service pair, or a host reaching a provider it had never used. These are dated facts, and the finding says explicitly that they do not prove the model changed.
• A rolling numeric baseline with an honest warm-up. It reports nothing at all until it holds fourteen daily samples, and says so while it is learning. We would rather show you a blank panel for two weeks than a confident number derived from three days.
• Sustained change, not a bad afternoon. A shift has to persist across days before it is reported, and it is expressed as a percentage change with the date it began, because nobody can act on a sigma value.
• With gateway metadata, certainty replaces inference. If your AI calls pass through a gateway that can export metadata, a genuine model or model version change becomes a stated fact rather than a hypothesis, and token, truncation, refusal and tool-failure rates become measurable.

What we will not claim

This list is deliberately part of the product description rather than something you have to extract from us in a meeting.

• We do not detect hallucination, prompt injection, insecure output handling or reasoning failure. Those live in the prompt and tool-call layer, which no passive sensor sees.
• We never call a number derived from packets a quality score.
• A fingerprint or endpoint change proves the endpoint changed. It does not prove the model changed, and the finding says so in those words.
• We do not collect your prompt text. Content fields are rejected on arrival by name, not filtered later, and that is a design constraint rather than a policy we could quietly relax.
• Systems we genuinely cannot see, such as an assistant running in a laptop editor that never crosses a monitored segment, are marked out of scope rather than allowed to pass as clean.