DragonFly Defense Grid, powered by Knowledge Grid
Learn its normal. Catch the change.
The DragonFly Defense Grid is a joint offering from DragonFly Cyber and Knowledge Grid, with two modules. Defense Grid Core uses Knowledge Grid's Knowledge-Grounded Anomaly Detection (KGAD) to learn which combinations of attributes define normal for each user, host and service account in the logs you already collect, and flags deviations with evidence for your team to investigate. Add Defense Grid for AI and the same analysis extends to AI: DragonFly Discovery surfaces the AI tools, agents and SaaS apps visible to its sensors and connected sources, and KGAD watches how each one behaves.
Two gaps current security tools can't close
Detection covers what controls recognize
In-house or through an MDR, detection is built from signatures, indicators, rules and behavioral baselines, each designed around what someone chose to watch. Relevant changes in behavior, such as a service account reaching hosts it never touched or a login pattern that has never occurred, can still go unflagged or unexplained in the logs you already collect.
AI widens that gap
Teams adopt AI tools, copilots and agents faster than security can review them. Security often can't see which AI is in use, who approved it or what data it reaches, and few existing detections are built around how AI agents normally behave.
Boards, auditors and cyber insurers ask how you would notice suspicious activity your existing detections weren't built for, and now also which AI is in use and how its misuse would be noticed. A security leader at a mid-market company, running a small SOC backed by an outside MDR, often has no evidence to answer either question.
Defense Grid Core leads. Defense Grid for AI follows.
LEAD MODULE · AVAILABLE NOW
Defense Grid Core
Find suspicious changes your existing detections may miss, in the logs you already collect.
- Telemetry
- Supported customer log sources: firewall, EDR, directory and IAM, and cloud.
- DragonFly sensor
- Not needed. No additional Knowledge Grid sensor either.
- What it finds
- Suspicious changes in behavior across users, hosts, service accounts and cloud resources, flagged for investigation.
- How
- KGAD learns which combinations of attributes define normal for each entity and flags deviations with evidence for investigation.
ADD-ON MODULE
Defense Grid for AI
Know what AI is running in your business. Know when it starts behaving differently.
- Telemetry
- AI and SaaS telemetry from the DragonFly sensor and auditor.
- DragonFly sensor
- Needed. The module is added once the sensor is in place.
- What it finds
- AI activity visible to the DragonFly sensor and connected sources: who owns it, what it reaches, and when its behavior changes.
- How
- DragonFly Discovery surfaces AI activity visible to its sensors and connected sources, and KGAD analyzes that telemetry the same way.
Findings from both modules go to your existing SOC, MDR or SIEM.
How do you monitor AI agents and shadow AI?
Start with an inventory, then watch how each AI tool behaves. Defense Grid for AI does both. DragonFly Discovery surfaces the AI tools, agents and SaaS apps visible to the DragonFly sensor and connected sources, with owners, approval status and exposure. KGAD then learns how each one normally behaves and flags when that changes, with evidence for your team to investigate. Few existing detections are built around how AI agents normally behave, which is the gap this module closes.
Every attribute is normal. The combination has never happened.
A service account logs in at its usual hour, from a known host, over a protocol it always uses, to a destination it already reaches. Each attribute is normal on its own. That combination has never occurred. KGAD learns which combinations of attributes define normal for each entity, on logs you already collect, without labeled data or predefined rules, and flags deviations like that one with evidence for investigation. Not every change is an attack, and each deserves a look with the evidence in hand.
- Every finding is one of six named anomaly types, mapped to MITRE ATT&CK, with the evidence attached.
- Built on Rough Set mathematics, backed by seven issued US patents and peer-reviewed research from Knowledge Grid's Warsaw R&D team.
- Runs alongside existing workflows, using agreed forwarding or integration methods, on supported telemetry with the fields and quality the analysis needs.
What is running, and is it behaving normally?
DRAGONFLY CYBER
Discovery
What is running, who owns it, what it can reach
AI and SaaS usage, shadow AI, AI agents, owners, policy drift and exposure. DragonFly delivers an AI inventory, governance events and risk indicators, along with onboarding, managed service and readouts.
KNOWLEDGE GRID
KGAD
Is it behaving the way it normally does, and if not, how it differs, with evidence
Unsupervised, multi-dimensional anomaly detection on supported telemetry, with no additional Knowledge Grid sensor required. Knowledge Grid provides the detection engine, data onboarding support, and the research and patents behind the engine.
Start with Core. Add AI when the sensor is in place.
START
A Defense Grid Core baseline
A fixed-scope baseline runs KGAD on your existing identity, cloud, endpoint and firewall logs. The readout lists the named anomalies found, each with its evidence. No DragonFly sensor is required.
KEEP IT
A Defense Grid Core subscription
The baseline stays deployed and becomes a Defense Grid Core subscription, delivered with DragonFly.
ADD ON
Defense Grid for AI
Once the DragonFly sensor and auditor are in place, Discovery surfaces the AI activity they can see, and KGAD analyzes that telemetry for changes in AI behavior.
EXPAND
More sources, and the platform
Add more log sources over time. Customers whose own AI agents need trusted knowledge of their environment can add the Knowledge Grid Cognitive Data Platform.