Lightly edited for readability. Chapter times match the strip above.
0:00 – Open
An AI agent in your organisation just accessed your secrets. Nobody noticed. Nobody will. Your engineers ship at the speed of a prompt – Claude Code, OpenCode, Codex, your own SDK web apps, agents on AWS or Azure. Every one of them can read a secret, run a script, access tools and data. The moment the action ends, it evaporates. Five different runtimes, five blind spots, and no single record of what any of them actually did.
0:37 – What RAXE is
So here is what changes that. RAXE is runtime security for your AI agents. It watches every agent across your stack – coding agents, SDKs, gateways, the kernel execution of agents itself. It records what each one actually did, and seals it as provable evidence. Here is what that means for your team.
1:01 – SOC console
Start with your SOC analyst. Instead of five dashboards, one central console. And it opens on the honest headline: what would have been blocked is counted in plain sight – because RAXE runs in observe-and-log mode today, and never breaks your agents or interferes. Every surface lands in one triage queue, and when a threat fires, your analyst sees the exact rule that caught it. Not a black-box score.
1:33 – Coding agents
For the platform owner, the blind spot is where AI enters – and it is already covered. Every coding agent your engineers run: Claude Code, OpenCode, and Codex, each with its own session and lineage. Claude Code and OpenCode tie back to the exact agent with explicit attribution. Codex, we label inferred – because we only claim what the evidence earns.
1:56 – The AWS lane
Your AWS Bedrock lane is here too, shown with clearly-labelled sample data.
2:06 – Lineage
And you stop correlating by hand. One agent's actions resolve under a single lineage: the gateway that saw what it claimed, the SDK inside the app, and the host kernel itself. All three – one continuous story you own, end to end. Next, we zoom into what that kernel caught.
2:30 – The reveal
Here is the moment that matters – the one your analyst and your CISO both need. The host kernel, real eBPF, caught the agent reading the /etc/passwd file, in-process. Something no proxy or log would ever see, pinned to the exact agent. The evidence sits sealed: you can see that it happened, not what – until the analyst clicks Reveal, and the act of looking writes its own audit row into the audit log. Actor, field, outcome granted, an audit ID. RAXE watches your agents, and it watches its own watchers.
3:12 – Verdicts
For your AI and detection engineers, none of this is a black box. Every verdict opens up: the binary threat head's probability, the per-family heads, an out-of-distribution energy score, the nearest known-attack prototypes. And for the borderline calls, a heavyweight second opinion – a separate model gives an advisory read, threat or benign. It is evidence for the analyst. It never changes the decision. Advisory, only.
3:45 – CISO
And for the CISO, the AI-risk story finally has a paper trail. Every reveal and every denial is hash-linked into one tamper-evident ledger, and you can verify the whole chain on demand: Intact. Aligned to MITRE ATLAS and OWASP ASI, the AI-specific frameworks – not the classical endpoint frameworks, which are the wrong frame for agent threats. This is not a screenshot someone could doctor. It is board-grade, audit-ready evidence you can hand up with confidence.
4:20 – Close
RAXE gives you the true, sealed, provable story of everything your AI agents did – across every agent, in one place. Today, it lets you see it. Next, it lets you stop it. We watch everything now, so you can act with confidence later. Trust starts with the truth.
