Intelligence for the autonomous internet
Vigilframe is building a security intelligence network for the age of autonomous AI. Detect signs of agent activity. Reconstruct what happened. Put evidence behind the finding.
From activity to understanding.
Software has agency
AI agents browse, call tools and adapt their next action to the result. An unusual session can now involve a script, a human, an AI agent, or a combination of all three.
For investigators, the question goes beyond whether traffic looks unusual. What happened? What suggests an agent was involved? And what can the evidence actually support?
The shift is already visible
Recent research shows a field moving from agent capability demonstrations toward operational questions: how to observe behavior, validate findings and investigate consequences.
7 Oct 2026 / Microsoft
Microsoft's latest frontier security research describes the challenge of turning growing volumes of AI-assisted findings into validated, actionable work.
Read the research (opens in a new tab)1 Oct 2026 / Microsoft Digital Defense Report
Microsoft's 2026 report describes faster operations and agentic systems beginning to automate more of the attack chain.
Read the report (opens in a new tab)30 Sep 2026 / Transluce
Transluce reported agent activity apparently connected to information retrieval that included failed attempts against government websites. It found no evidence in those datasets of access to non-public information.
Read the investigation (opens in a new tab)Independent reporting. Research checked 9 October 2026. Sources are not partners or endorsements.
The Vigilframe platform
Our platform vision connects four capabilities: observation, behavioral analysis, investigation and reusable intelligence. Each finding should lead back to the record that supports it.
01 / Observe
Instrumented decoy environments provide a controlled place to observe sessions and preserve the sequence of activity.
02 / Interpret
Compare timing, action patterns and responses to changing context. Combine signals, test their reliability and keep ambiguous sessions unresolved.
03 / Reconstruct
Bring events, supporting evidence and analyst judgement into one inspectable timeline. Separate observations from interpretations.
04 / Inform
Turn reviewed findings into research, evidence packs and, as the platform matures, intelligence feeds for the teams that can act on them.
Follow one trace
Follow an observation back through the session. Inspect the signals behind the assessment. See the supporting events, the alternative explanations and the questions still open.
Interaction recorded A sequence begins on an instrumented surface.
EVT-01A sequence begins on an instrumented surface.EVT-02Multiple observations suggest adaptive behavior.EVT-03Each interpretation points back to its source events.EVT-05The record includes evidence, uncertainty and next questions.ALT-1A scripted client replaying a fixed sequence.ALT-2A human operator assisted by an AI tool.ALT-3A combination of all three.EVT-04Observed behavior alone does not establish an operator.OPENReady for human review.Measure the signal
Our research programme pairs observed sessions with a calibration lab: known agents, human participants and scripted clients under documented conditions.
The goal is to measure what generalises, what creates false positives and where the system should withhold judgement.
Labels come from recorded participation and run provenance.
Test beyond the agent frameworks used during development.
Preserve the reasons for a finding and the limits of the conclusion.
Intelligence that has somewhere to go
Evidence to support investigations into suspected misuse and unexpected agent behavior.
Behavioral research and contextual findings to enrich detection and investigation workflows.
Structured observations, case timelines and research into emerging agent activity.
Start with a concrete investigation need. Build toward recurring intelligence.
The opportunity
Our thesis is that autonomous software creates a growing need for evidence about how it behaves outside the environments its developers control.
Vigilframe's opportunity is to build a distinctive body of observations, labelled behavior and reviewed cases, and make that intelligence useful to the organizations investigating agent activity.
01
Recurring access to curated research and reviewed findings.
02
Documented behavioral datasets and evaluation assets for security and AI teams.
03
Focused analysis and evidence reconstruction around specific questions.
The asset we intend to build is a growing record of observed behavior, tested signals and investigator feedback. Its value depends on quality, coverage and usefulness, not traffic volume alone.
Stage: pre-launch research and development. Our initial programme focuses on a controlled sensor deployment, a labelled calibration dataset and reproducible evaluation. The next milestone is evidence for a design-partner pilot.
We welcome conversations with investors and strategic partners who see security intelligence as essential infrastructure for the next generation of software.
Help build the intelligence to understand it.
Request a briefing
Connect with the team about the investment thesis, research programme or a potential design partnership.
A security intelligence platform that connects observed agent-like activity, controlled evaluation and evidence-based investigation.
An inspectable record, a clear explanation of the finding, and an honest account of what the evidence cannot establish.
The initial programme combines owned decoy environments with labelled sessions from a controlled calibration lab.
Pre-launch research and development. We are preparing the first validation programme and exploring investment and design partnerships.
Request a briefing to discuss the evaluation plan, product direction and intended milestones.