Waxell

01 Discover · Product

For security and IT teams who own the fleet

Govern the AI youremployees already run.

Endpoints finds the AI already running on employee laptops. An agent on each enrolled Mac and Windows device records which AI apps and extensions are in use, which accounts they use and which providers they call. Then you set policy per tool.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF

endpoints · shadow AI report
endpoints · shadow AI report
The problem

Your people adopted AI faster than anyone could approve it.

Coding agents with access to your repos. Desktop chat apps. A personal ChatGPT login on a work laptop. Ask which AI tools are in use, on which devices, under whose account, and the honest answer is usually a guess. You can't set a rule for something you can't see.

Where it fits
  1. 01 DiscoverFind the AI tools and agents you build, buy, or didn't know about.
  2. 02 ObserveSee every call, token and dollar your instrumented agents spend, run by run.
  3. 03 EnforceDecide allow, hold, redact, or block while the agent acts.
  4. 04 RunRun the agents you build inside the plane, with a kill switch that works.
  5. 05 ProveEvidence per decision, mapped to the frameworks.

Endpoints is how Waxell discovers the AI on employee laptops. It's the first of the five moves. Everything else, from policy to evidence, starts from what it finds.

How discovery works
  1. 01

    It arrives through your MDM.

    IT pushes Waxell to Mac and Windows laptops with the device management tool it already uses, such as Jamf, Intune, Kandji or Hexnode. Employees see a small Waxell icon. On Macs not enrolled through Apple Business Manager, each person switches on one network setting once.

  2. 02

    It checks for known AI tools.

    At startup and every six hours, Waxell compares each laptop against a catalog of AI apps, command-line tools and code-editor extensions, from Cursor and Claude Code to Copilot and Ollama. It also reads which MCP servers those tools are connected to.

  3. 03

    It notes where AI traffic goes.

    Waxell records which app talked to which AI service, and when. It sees the address, not the conversation. Traffic is not decrypted.

  4. 04

    In the browser, it sorts work from personal.

    A Waxell extension for Chrome, Edge and Firefox sees which AI sites are in use and whether the signed-in account is on your company's domain or a personal one.

  5. 05

    Coding agents check before they act.

    For Claude Code, Cursor, Copilot, Codex and other coding agents, each tool call is checked against your policy before it runs.

  6. 06

    You see it, then you decide.

    Everything found lands in a Shadow AI report. From there you can block an AI vendor on the network, warn or block personal accounts, quarantine a tool on one device, or turn on content capture for the services you name. Capture stays off until an admin turns it on.

What you can do with it
  1. 01

    Secrets stopped before the prompt is sent.

    Someone pastes a card number, a cloud key, a private key or a database password into ChatGPT or Claude in the browser. The extension catches it before the message leaves: ask them to confirm, or block it. File uploads can be held and checked the same way.

  2. 02

    Redacted on the laptop, before upload.

    When content capture is on, email addresses, API keys, card numbers and other secrets are replaced on the device before anything is sent to Waxell. The raw text never leaves the laptop, on Mac or Windows.

  3. 03

    Endpoints for the AI you run; Observe and Runtime for the agents you build.

    One record either way. A coding agent on a laptop and a workflow in production show up in the same decision log.

In the recordmacOS and Windows · Chrome, Edge, Firefox extension · coding-agent hooks · quarantine from the console

In practice
endpoints · decision log · today
  1. Ollama found on 14 devicesfleet · daily scan · new tool · added to the Shadow AI report allow
  2. chatgpt.com · personal accountwin-7781 · a.patel · personal accounts blocked on this group block
  3. Claude Code · bash: drop the staging databasembp-0093 · r.diaz · destructive command · coding-agent hook block
  4. Cursor · MCP server added: githubmbp-0142 · j.lee · sanctioned tool · metadata only allow
  5. api.deepseek.com · unknown appmbp-0142 · j.lee · vendor blocked: consumer AI block
Where it leads
Next · 03 EnforceOnce you can see it, set the rule. Allow it, warn on personal accounts, capture the content of the services you name, or block a vendor outright.

See what AI is already running on your laptops.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF