Your AI Estate Has Assets You Have Not Inventoried Yet
Ask a security leader to list every model, dataset, and AI-powered feature running across their organization, and you will usually get a partial answer delivered with a hedge. There is the model the platform team deployed on purpose, the one a data science group pulled from Hugging Face last quarter, and, almost certainly, a handful of AI features quietly enabled inside SaaS tools that nobody formally approved. This is shadow AI, and it looks a great deal like shadow IT did a decade ago, except the artifacts involved carry risks that traditional application security tooling was never built to catch: a malicious pickle file, a prompt injection that manipulates an agent's behavior, a model quietly leaking personal data through its outputs.
Safeguard is building three connected capabilities to address this, and all three are honestly labeled as Early Access, meaning they are real and working in the product today, with depth that is still growing. Position them as available and expanding, not as a finished, comprehensive program.
AI-BOM: finding out what you actually have
Before you can govern AI assets, you need to know they exist. AI-BOM discovery inventories AI assets across an organization's estate: model imports found in code through SDK references, models deployed in cloud AI services, shadow AI running inside SaaS tools nobody centrally tracks, and models or embeddings living in vector databases. The output is an ML-BOM, a bill of materials for AI assets structured the same way SBOM has become the standard record for software dependencies.
This matters because you cannot secure or govern what you cannot see. Just as SBOM discovery answers "what open source packages are actually running in production," AI-BOM answers the AI-era version of that question: what models, what agents, and what AI-powered features actually exist across the organization, regardless of whether a formal request was ever filed to deploy them.
AI-SPM: scanning the artifacts themselves
Once an asset is discovered, the next question is whether it is safe. AI-SPM performs model-artifact malware scanning across the formats that AI models actually ship in: pickle files, safetensors, GGUF, and ONNX. This matters because model files are not inert data the way a CSV is. A pickle file in particular can contain executable code that runs the moment the file is loaded, which makes an unscanned model download from a public repository a genuine supply chain risk, not a theoretical one. Extending malware scanning discipline, the same discipline Safeguard already applies to package ecosystems through Eagle, into the AI model format is a natural and necessary extension of software supply chain security into the AI era.
AI Gateway: governing what the model does at runtime
Discovery and artifact scanning cover what exists and whether it is safe to load. AI Gateway, also described as an LLM firewall, addresses a different layer: what happens while a model or agent is actually running. It provides runtime guardrails against prompt injection, both the direct kind where a user tries to manipulate a model and the indirect kind where malicious instructions arrive hidden inside content the model processes, along with jailbreak attempts and guardrails against personally identifiable information leaving the system through model output. It can run in a monitoring posture by default or be configured to actively enforce.
This is the layer that answers the question every security team eventually asks about a deployed LLM feature: what stops it from being manipulated by the content it processes, and what stops it from leaking data it should not expose. AI Gateway is Safeguard's answer, still expanding in depth, but functioning today as a real proxy layer rather than a planned feature.
Why these three belong in one conversation
AI-BOM, AI-SPM, and AI Gateway cover three different moments in the life of an AI asset: discovering it exists, checking whether the artifact itself is safe before it loads, and governing its behavior once it is running. A security program that only does one of these has a real gap. An organization that only inventories its models still has no artifact-level malware protection. One that only scans artifacts still has no answer for a runtime prompt injection attack. Treating all three as one connected discipline, rather than three separate tools, is the more honest way to think about AI security posture management as it exists today.
Because all three are Early Access, the right way to evaluate them is with a scoped demo against your own AI estate rather than a promise of comprehensive coverage on day one. That is also the most useful way to find out how much shadow AI your organization actually has running.
If you want a clearer picture of the AI assets already live in your environment, safeguard.sh is where to start that conversation.
