Barrikade is a security platform that discovers AI agents running across an enterprise, ties each agent to a human owner, and monitors their runtime behavior for unsafe actions. Its open-source Lens tool inventories agents across endpoints, repositories, CI, and Kubernetes with evidence-backed findings, while Core is a runtime security engine still in alpha. The platform's goal is to ensure no agent operates anonymously, treating agents as a new identity class that needs explicit accountability.
Funding
Funding not disclosed
Founders
Product
Problem
AI agents are proliferating across enterprise environments—on laptops, in code, in CI pipelines, and on Kubernetes—often before security teams know they exist. These agents frequently borrow developers' credentials, leaving no clear owner behind their actions, and unlike ordinary software, they do not just hold data; they act, creating blind spots for security teams that cannot secure agents they do not know about.
Solution
Barrikade provides a single security layer that discovers AI agents, connects them to an identified owner, catches unsafe behavior, and explains exactly what happened. The platform consists of Lens, an open-source inventory tool that finds agents across endpoints, repositories, CI, and Kubernetes, and Core, a runtime security engine that watches agent sessionsholistically. Lens normalizes findings into an evidence graph that separates autonomous agents, agent-capable tools, model runtimes, and supporting systems. Core monitors full agent sessions, spots when an agent moves off task, and records the response RNA. Together with an identity layer still under development, Barrikade aims to answer four key questions: what is running, who owns it, what may it do, and what did it do.
Target Audience
Barrikade targets enterprise security teams, including CISOs, security engineers, and DevOps professionals who need visibility into AI agents running across their infrastructure and must enforce accountability for agent actions.
Features
- Open-source Lens tool that scans endpoints, source repositories, CI pipelines, and Kubernetes using read-only permissions with no Secret or pod-exec access
- Endpoint collectors that inspect known configuration roots, processes, and listeners to detect agents on individual machines
- Repository and CI scans that analyze manifests, imports, and validated agent, MCP, A2A, OpenAPI, and workflow descriptors
- Kubernetes controller that observes workload metadata with evidence-based confidence scoring and explicit coverage reporting
- Privacy-enforced data contract that rejects prompt bodies, source bodies, credentials, environment values, and full command arguments while accepting only sanitized identifiers
- Agent runtime security capability that detects prompt-injection and off-task behavior during live agent sessions, recording responses for audit
- Evidence-before-conclusions approach requiring independent evidence families before raising confidence, distinguishing confirmed, likely, and possible findings without artificial risk scores
- Export capabilities in Lens JSON, JSONL, and CycloneDX 1.7 for integration into broader security workflows