Role Security
Overview
Koi is an endpoint security platform designed to secure software installations, providing visibility and control over all types of software before they reach endpoints.
Key Features:
- Unified software security platform
- Agentless operation
- Real-time risk evaluation
- Proactive risk analysis
- Automatic discovery and inventory
Use Cases:
- Securing software installations across various operating systems
- Monitoring software behavior and ownership changes
- Applying security policies based on user and risk level
- Cataloging software in IT environments
- Detecting and remediating malicious activity
Benefits:
- Enhanced visibility into non-binary software risks
- Improved security posture against malware
- Streamlined software approval processes
- Reduced manual vetting efforts
- Increased productivity without compromising security
Capabilities
- Continuously scans public marketplaces and registries for new listings and versions (hourly)
- Performs LLM-assisted static analysis of package and extension code for secrets, vulnerabilities, and malware
- Executes dynamic sandboxing of incoming packages/extensions/models to observe runtime behavior
- Assigns and updates per-item risk scores using the Wings™ risk engine
- Inventories discovered self-provisioned software across endpoints (packages, extensions, models)
- Generates risk reports, publisher reputation data, and per-item analysis outputs in a tenant dashboard and API
- Applies preventive policies to auto-approve, block, or require review of installs (Easy Allow automated approvals)
- Enforces policy via a network Supply Chain Gateway that gates marketplace traffic
- Integrates with SWG (secure web gateway) to control web/marketplace enforcement
- Integrates with EDR and MDM via scripts or user-mode agents to remediate or remove software
- Uses PAC file routing and user-mode agents to route and enforce supply-chain controls
- Supports software types: browser extensions, package managers, IDE marketplaces, containers, and AI models
- Continuously re-evaluates risk on publisher changes and new software versions
- Provides a SaaS tenant model exposing dashboard and API surfaces for visibility and policy management