Griffin AI is the model behind search, chat and remediation in Safeguard. The docs describe it as a purpose-built large language model for software supply chain security, trained on security data, vulnerability databases and software composition patterns rather than general web text.
This post explains what Griffin does, where you meet it in the product, and what it will and will not do for you.
What it is
Griffin is one model. It does not come in sizes, so there is no Griffin Lite or Griffin XL. Safeguard also ships other models (Eagle, Lino and Zero), and the docs list their roles on a separate AI Models page. Griffin is the flagship tier you can pick for a search turn.
The docs group what Griffin does into four areas:
- Natural language search. You query your SBOMs in plain English, for example "Show me all critical vulnerabilities in production services" or "What GPL-licensed packages are we using?"
- Prioritization. Griffin weighs reachability (is the vulnerable code called), exploitability, environment context and business impact.
- Remediation. Upgrade recommendations, dependency conflict resolution, breaking change analysis and pull request generation.
- Security analysis. Component behavior analysis, anomaly detection, supply chain risk assessment and attack path identification.
How to use it
There are three entry points in the web app.
Search bar. Click the search icon or press the slash key, type a question in natural language, and open any result to see details.
Chat. Click the Griffin icon and ask about your security posture, request an analysis or ask for a report. The docs list example prompts such as "What's our biggest risk?", "Compare last two scans" and "Generate executive summary".
AI Remediate. Open a vulnerability, click AI Remediate, review the proposed fix, then apply or edit it. On the Vulnerabilities page the same button asks Griffin to build remediation plans for everything listed, and you can then create pull requests from the reviewed changes.
Griffin also appears outside the web app. The Safeguard side panel extension for Chrome brings Griffin search next to any browser tab, and the CLI assistant answers questions such as how many critical vulnerabilities you have.
What happens under the hood
Search is agentic. The July 2026 release notes say each search turn streams what the model is doing as it works: thinking, tool calls, pages read, sandboxed code runs and sub-agents it spawns. You can pick a model tier per turn. Lino is described as fast and suited to basic queries, and Griffin is the flagship. Eagle is the third tier.
Griffin can also reach connected systems. When you connect a vendor through its MCP server, search can call that connector's tools and answer questions about the system.
Privacy, as documented
The Griffin page states that Griffin runs on Safeguard infrastructure, that your code is never stored or used for training, that analysis runs in isolated environments, and that tenants are fully isolated from each other. If you need the model choice to differ, Safeguard also supports Zero AI mode and bringing your own model.
Limits worth knowing
Griffin proposes. You decide. A proposed fix is something to review, and policy can require approval for exceptions. If a question depends on data that is not in your Safeguard scope, Griffin has nothing to read, so connect the source first.
Try it yourself
Click through it at your own pace, or open it full screen.
Then ask the same question two ways in your own workspace: once in the search bar, once in chat. Compare how each shows its work.
Quick check
Does Griffin come in different sizes?
No. The docs say Griffin is one model with no Lite, S, M, L or XL variants. Tiers you choose per search turn are separate models: Lino, Eagle and Griffin.
Is a proposed fix applied automatically?
No. You review the proposed fix in AI Remediate, then apply or modify it.
