What we noticed. The policy existed. The list did not.
Holistic AI has spent years helping large companies govern the AI they build: the models in their repositories, the pipelines in their clouds, the agents in their products. That work kept running into the same wall. Ask a governance lead which AI tools the company uses and the answer was the approved list. Ask which laptops ran a coding agent with unattended mode switched on, or held a provider key in a file git had been told to ignore, and the answer was a pause.
The pause was not carelessness. Every one of those tools had been installed by someone doing their job well, from a website, in an afternoon. None of it went through a gateway, so no network control saw it. None of it was an application in the sense an MDM understands, so no software inventory listed it. The AI that mattered most was the AI nobody could see, and a policy that cannot name its instances applies to nothing.
Why we built it. Governance starts with a row.
Our position has always been that governance should be infrastructure, not a bottleneck. On the device that means a fact before a rule: which tool, which version, whose account, what it can reach, whether it may act on its own, and when that was last true. Once there is a row, a rule can grade it, an owner can close it, and an auditor can read the record. Until there is a row, the best policy in the world is a document.
We could not find a product that produced that row without putting something in the path of traffic, executing the tools it found, or asking people to fill in a survey. So we built endlayer to do the one thing those approaches cannot: read the disk.
A control plane for AI has to start where the AI actually is. Today that is a laptop.
How it works. Read, do not intercept.
A lightweight agent runs on each machine as the person using it. It reads files that are already on the disk, the same binary and the same config on macOS, Windows and Linux, and never elevates or launches the AI it finds. Every fifteen minutes it takes a snapshot of 21 signals: installed AI apps and coding agents, whether an agent may act unattended, MCP servers, provider keys, accounts, spend, the repositories the tools have touched, and the device’s own security posture. Sensitive values are removed on the endpoint before anything leaves it.
The console turns those snapshots into three things, in order. Surface finds every AI tool, agent, model and key on the machine. Monitor shows what they reach, whose account they run on and what they cost. Govern grades every signal against a versioned policy and keeps the record. Guardrails inside the agent act on the device in real time: a prompt is scored before it runs, and a secret is redacted or blocked on the way out. The one thing that waits for a person is uninstalling an app. We would rather you knew exactly where that line is than found it out.
Part of Holistic AI. Research first, then product.
Holistic AI was founded in London in 2020 by Adriano Koshiyama and Emre Kazim, out of University College London, to give enterprises one platform to discover, assess, mitigate, monitor and govern risk across every AI agent, model and application. It is used by governance, risk and AI leaders in regulated industries, and its assessments map to the EU AI Act, NIST AI RMF and ISO 42001.
The company is research-led. Its team publishes on AI risk, robustness and red teaming, with papers accepted at NeurIPS 2025 workshops, and its work on agent-level red teaming placed in the top ten of OpenAI’s GPT-OSS-20B red teaming hackathon. endlayer is that research applied to the part that was missing from every inventory: the device.
Models, pipelines, agents and applications, from discovery to audit-ready evidence. Holistic AI — holisticai.com ↗
The AI on the laptops, surfaced, monitored and governed from the same plane. How the platform works →
Where we are. And what ships today.
The device layer, backend and console ship today. Cloud connectors and SDK ingestion are planned. The team works from San Francisco and London, and the agent is open source under Apache 2.0, so you can read exactly what it reads before you run it.
- Office: 95 Third Street, 2nd Floor, San Francisco, CA 94103, United States
- Email: hello@endlayer.com
- Versions: app 0.1.0 · console 0.1.1 · wire schema_version 1