Why Anoman.
Purpose-built for the two layers of AI security that matter most for an LLM gateway, measured against the AI Defense Matrix — an 8×6 grid of AI asset classes and NIST CSF 2.0 functions.
The framework
The AI Defense Matrix
The AI Defense Matrix is an independent 8×6 grid for evaluating AI security coverage: 8 AI-specific asset classes (rows) against the 6 NIST CSF 2.0 functions — Govern, Identify, Protect, Detect, Respond, Recover (columns). We measure ourselves against it below, cell by cell, rather than claim generic “full-spectrum AI security.”
| Asset class | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
AI Gateways & RoutersAnoman owns this row | Policy & catalogLive today: Policy groups and a model catalog govern what routes where. | TracesLive today: Full request tracing and traffic observability across every call. | Gateway + MCP gatingLive today: Guarded gateway pipeline plus per-tool MCP allow/deny/require-approval gating. | Anomaly + LSPLive today: Statistical + ML anomaly detection and LLM-Security-Perimeter attack signatures. | Block + failoverLive today: 403 blocks on policy violations and automatic provider failover. | Latency routingLive today: Latency-based provider routing re-routes around degraded upstreams. |
Runtime AI DataAnoman owns this row | Prompt/PII policyLive today: Per-customer prompt and PII handling policy (redact / tokenize / synthetic / block). | Data classificationOn the roadmap: Automated runtime prompt-data classification is on the roadmap. | PII + injection defenseLive today: Reversible PII anonymize-then-de-anonymize round-trip, ML-based prompt-injection defense, and content moderation — all live in the gateway and the Edge Collector. | Jailbreak detectionLive today: Jailbreak / prompt-injection detection running on every request. | Auto incident responseOn the roadmap: Automated runtime-data incident response workflows are on the roadmap. | Partner scopePartner scope: Runtime data-loss recovery is partner / integration scope. |
AI Orchestration Tools | Orchestration policyOn the roadmap: Formal orchestration-tool governance standards are on the roadmap. | Partner scopePartner scope: Tool/chain discovery and inventory is partner scope. | MCP governanceLive today: MCP server registry with per-tool RBAC (allow/deny/require-approval) plus system-prompt hardening. | LSP signaturesLive today: LLM-Security-Perimeter attack-signature detection covers orchestration traffic. | Tool quarantineOn the roadmap: Automated tool quarantine on detection is on the roadmap. | Partner scopePartner scope: Orchestration-level recovery/rollback is partner scope. |
AI Agent Identities | Identity policyOn the roadmap: Agent-identity governance policy is on the roadmap. | Shadow-AI inventoryOn the roadmap: Shadow-AI OAuth-app inventory (discovering which SaaS apps agents have connected to) is on the roadmap — not yet deployed. | Credential scopingOn the roadmap: Agent credential scoping / least-privilege is on the roadmap. | Anomalous behaviorOn the roadmap: Anomalous agent-identity behavior detection is on the roadmap. | Grant revokeOn the roadmap: Agent-grant revoke (endpoint DLP / MVP2) is on the roadmap — not yet deployed. | Partner scopePartner scope: Agent-identity recovery is partner scope. |
AI Model | Model catalogLive today: Model selection and provider evaluation via a live, tiered model catalog (100+ models). | Model inventoryLive today: Full model inventory with tier, pricing, and provider metadata. | Partner scopePartner scope: Model-weight protection is partner scope — Anoman routes to third-party LLMs, it does not host or protect model weights. | Drift / eval monitoringOn the roadmap: Model-drift and eval monitoring are on the roadmap. | Partner scopePartner scope: Model-level incident response is partner scope. | Partner scopePartner scope: Model recovery/rollback is partner scope. |
AI-Generated Code | Code-gen policyOn the roadmap: Formal AI-generated-code governance standards are on the roadmap. | Partner scopePartner scope: AI-code provenance inventory is partner scope. | Governed coding agentsOn the roadmap: Coding agents (Claude Code, Cursor, Cline, Aider, and more) can be routed through the guarded gateway via a one-line installer — governance is via the gateway, not a dedicated code-specific control today. | Partner scopePartner scope: Hallucinated-dependency and SAST scanning is partner scope. | Partner scopePartner scope: Partner scope. | Partner scopePartner scope: Partner scope. |
AI-Workload Platforms | AISPM postureOn the roadmap: AI security posture management is on the roadmap. | Edge CollectorOn the roadmap: The Edge Collector on-prem appliance is an Enterprise early-access capability, onboarded with our team. | Partner scopePartner scope: Infrastructure hardening is partner scope. | Partner scopePartner scope: Container / runtime incident response is partner scope. | Partner scopePartner scope: Partner scope. | Partner scopePartner scope: Partner scope. |
Training Data | Partner scopePartner scope: Anoman is inference-time only. Training-data governance is deliberately out of scope — partner territory. | Partner scopePartner scope: Anoman is inference-time only — partner scope. | Partner scopePartner scope: Anoman is inference-time only — partner scope. | Partner scopePartner scope: Anoman is inference-time only — partner scope. | Partner scopePartner scope: Anoman is inference-time only — partner scope. | Partner scopePartner scope: Anoman is inference-time only — partner scope. |
Mapped to the AI Defense Matrix — an 8×6 grid of AI asset classes × NIST CSF 2.0 functions. Hover or focus a cell for detail.
The moat
We go deep on two rows instead of shallow on eight
We own the Gateway row
Policy groups, model catalog, full traffic observability, anomaly + LSP detection, 403 blocking, and latency-based failover — all live, on every request that passes through Anoman.
We own Runtime Data protection
Reversible PII anonymize-then-de-anonymize masking, ML-based prompt-injection defense, and jailbreak detection run on every call — the model sees synthetic values, your app gets the real ones back.
We deliberately don't do everything
No model-weight hosting or protection, no SAST or hallucinated-dependency scanning, no training-data governance — those are partner territory. A focused control plane, not a do-everything box.
Residency is part of the moat too: the standard gateway runs in Jakarta for UU PDP readiness, and the Edge Collector extends Runtime Data protection on-prem — an Enterprise early-access capability.
Honest roadmap note: cells marked “◐ On the roadmap” above — including shadow-AI discovery, AI security posture management, and endpoint enforcement for AI Agent Identities — are planned work, not shipped capabilities. They are not generally available today.
FAQ
Common questions
What is the AI Defense Matrix?
The AI Defense Matrix (aidefensematrix.com) is an 8×6 coverage grid: 8 AI-specific asset classes — AI Gateways & Routers, Runtime AI Data, AI Orchestration Tools, AI Agent Identities, AI Model, AI-Generated Code, AI-Workload Platforms, and Training Data — measured against the 6 NIST CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, Recover. It's a standard for evaluating how completely an AI security product covers the space, not a single product's feature list.
Which parts does Anoman cover today?
Anoman fully owns two rows end-to-end: AI Gateways & Routers (policy groups, traffic observability, the guarded gateway, anomaly + LSP detection, blocking, and failover routing) and Runtime AI Data (prompt/PII policy, reversible PII anonymize-then-de-anonymize masking, ML-based prompt-injection defense, and jailbreak detection). We also cover Protect and Detect for AI Orchestration Tools via MCP tool governance and LSP attack signatures, and Govern/Identify for AI Model via our live model catalog.
What does Anoman deliberately NOT do?
Anoman is a focused control plane, not a do-everything box. We do not train, host, or protect model weights (AI Model → Protect/Respond/Recover is partner scope). We do not do static code analysis or hallucinated-dependency scanning (AI-Generated Code → Detect is partner scope). We do not touch training data at all — Anoman operates entirely at inference time, so every cell in the Training Data row is partner scope by design. Shadow-AI discovery, AI security posture management, and endpoint enforcement for AI Agent Identities are on our roadmap, not live today.
How does this map to NIST CSF and the OWASP LLM Top 10?
The AI Defense Matrix's 6 columns are the NIST Cybersecurity Framework 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover), applied to AI-specific asset classes instead of generic IT assets. Anoman's live Protect/Detect coverage in the Runtime AI Data and AI Orchestration Tools rows directly addresses prompt-injection (LLM01), sensitive-information disclosure (LLM02), and excessive-agency (LLM06) categories from the OWASP Top 10 for LLM Applications.
See the gateway that owns its two rows.
Guarded routing and reversible PII protection, live on every request — not a roadmap slide.