Mission AI Runtime
Run governed AI where the mission runs.
Commercial AI assumes the internet, one cloud, and consumer-grade governance. Mission systems assume none of it. Glyphon runs the same governed AI workflows in GovCloud and inside disconnected, boundary-controlled enclaves.
Commercial AI assumes
Mission systems require
The gap
AI built for the open internet does not survive contact with the enclave.
Commercial AI assumes
- Always-on internet connectivity
- Centralized cloud services
- A single model provider
- Consumer-grade governance
- Ship fast, iterate in production
Mission systems require
- Air-gapped and disconnected operation
- Operation across classification boundaries
- Human approval on consequential actions
- Accreditation and policy enforcement
- Auditability and operational resilience
Deployment portability
The same workflow. Any environment. No rewrite.
The accredited workflow does not change as it moves from a developer's workstation to a classified enclave. Only the ground underneath it does.
- Developer workstation
- Enterprise datacenter
- Commercial cloud
- GovCloud · Bedrock
- Air-gapped enclave
STIG-hardened Iron Bank containers from registry1.dso.mil. Three deployment tiers: local HTTPS, production slim, and Iron Bank. Deployable on FedRAMP High and IL5-authorized infrastructure such as Bedrock GovCloud. Assessed to date in an IL4 environment.
Self-hosting covers the orchestrator. Model inference runs through AWS Bedrock, and the endpoint is chosen per workload: commercial Bedrock for lower-sensitivity work, or Bedrock GovCloud to keep prompts and target data inside a DoD-authorized boundary. GovCloud is available today. Automatic, policy-enforced routing and fully-local inference are on the roadmap.
Operational governance
Every action attributable. Every decision recorded. Every model accountable.
Presented as operational requirements, because in a mission environment that is exactly what they are.
Human approval
Consequential actions pause for a person, across six channels: CLI, dashboard, email, Slack, SMS, or Teams. First responder wins.
Policy enforcement
Oversight tier set by classification, from autonomous to approval-required.
RBAC
Role-scoped access to workflows, approvals, and audit records.
Hash-chained audit
SHA-256 chained log of every action and decision. Tamper-evident by construction.
Replay and lineage
Reconstruct any run for review, incident analysis, or accreditation evidence.
Cost accounting
Per-run, per-model spend visibility for program budgeting.
Model independence
Models change. The accredited workflow does not.
A workflow is defined by the capability each step needs, not by a vendor. Swap the model underneath, and the accreditation boundary above it holds: a model change is designed not to re-open the boundary above it.
Harden image → resolve CVEs → produce compliance evidence
Operational continuity
Disconnected, degraded, or denied, the work still runs.
Glyphon's pipelines are deterministic where they can be, with bounded retries and resume, so a run survives an interruption instead of restarting it. What runs with no network path is explicit, not implied.
Tool stages run offline
Scanning, hardening, and benchmark stages (OpenSCAP, PowerSTIG, Trivy) run today with no external network path.
Reasoning needs an endpoint
Model-reasoning stages call a boundary-hosted endpoint such as Bedrock GovCloud. Fully-local, fully-offline inference is on the roadmap.
Bounded retries
Failure is contained, not cascaded.
Resume
Pick up a pipeline where it stopped.
Mission playbooks
Seven ways Glyphon hardens the mission.
Each playbook is a repeatable, accreditable workflow that produces the security evidence a mission owner actually has to file, from STIG-hardened images to POA&M packages. 56 agents across 7 playbooks (6 production, 1 beta).
Harden to STIG and benchmark
OpenSCAP + PowerSTIG · 9 agents
productionAMI Hardening
STIG-harden machine images across 6 OS platforms. PowerSTIG for Windows, OpenSCAP for Linux, validated end to end on AWS Bedrock GovCloud. All access via SSM.
Trivy + CIS · 7 agents
productionContainer Hardening
Harden Dockerfiles to CIS Docker Benchmark, with a rebuild and smoke test after every fix. Produces hardening compliance reports.
Find and remediate vulnerabilities
Trivy · 15 agents
productionCVE Resolution
Resolve container image CVEs through dependency upgrades with rebuild verification. Validated on Bedrock GovCloud at up to 15x lower cost than the commercial baseline across the playbook suite.
Semgrep · 8 agents
productionSemgrep Remediation
Fix real source-code vulnerabilities with test-validated edits. Automated triage separates fixable findings from false positives.
Assess posture and produce accreditation evidence
Multi-Scanner · 7 agents
productionSecurity Posture
Cross-scanner deduplication with NIST SP 800-53 and CWE mapping, and executive-ready posture reports for the program office.
eMASS · 5 agents
productioneMASS Submission
Generate POA&M reports and eMASS export packages from assessment results. Document generation is production; direct API submission is in preview.
FedRAMP · 5 agents
BetaSSP Generator
Draft System Security Plans from deterministic control data, with LLM review reserved for gap analysis only. (Beta, in development.)
Verified remediation
A hardened system that still boots.
STIG remediation that breaks the mission application is worse than the finding it closed. Glyphon proves every control against a baseline, and when a fix breaks the system it comes back out and gets POA&M'd, not forced through.
Step 01
Baseline before touch
Glyphon records a successful-startup baseline (the application boots, or the AMI reaches a clean OS boot) before any action, STIG, or remediation is applied.
Step 02
Smoketest each control
Every STIG and remediation is smoketested against that baseline, isolating any control that degrades the system.
Step 03
Remove, document, POA&M
A deviation from baseline has the remediation removed, documented, and written into a POA&M, the honest artifact an assessor expects to see.
Engineering proof
Results our playbooks produced on federal production systems.
These are the outcomes on five DoD production systems that Glyphon assessed and remediated, fixing findings and resolving CVEs to drive each system to this posture. Delivered by SigilArk in a lower-level (IL4) environment. The numbers describe those target systems, not Glyphon's own posture.
Glyphon is the platform that did the work. SigilArk delivered the engagement. The accreditation posture belongs to the systems, a platform does not hold an ATO.
Residual risk was limited to roughly 3 to 7 LOW-severity container CVEs per system (NVD via Trivy) that could not be remediated without breaking the application. Each was documented and POA&M'd rather than force-fixed, the same baseline discipline described above.
Lab benchmarks, separate from the production figures above
The figures below are repeatable lab runs against published baseline images and OWASP test projects, where we control the starting point. They measure the platform's remediation lift, not the production systems above.
AMI STIG hardening lab benchmark
| Platform | Method | Compliance |
|---|---|---|
| Windows Server 2022 / 2019 | PowerSTIG + DSC | 99.5% |
| Amazon Linux 2 | OpenSCAP | 83.7% |
| Amazon Linux 2023 | OpenSCAP | 82% |
| RHEL 8 | OpenSCAP | 80.6% |
| RHEL 9 | OpenSCAP | 74.3% |
$ glyphon run --playbook ./trivy --project ./app --model llama4-maverick
Scan: 117 CVEs → 21 remaining
Result: 96 of 117 resolved (82.1%) | all agents completed, no failures | ~$0.20
# single GovCloud run, OWASP juice-shop lab target, not yet cross-validated
# up to 15x lower cost vs commercial across the playbook suite (aggregate, not this run)Roadmap
The AI supply chain, as governed infrastructure.
Architectural intent, not shipping capability. Where mission AI operations are heading, and what the platform is built to absorb.
Fully air-gapped inference
Mission-tuned local models running fully inside the boundary, so reasoning stages need no external endpoint.
Fine-tuned org models
Models adapted to a command's own data and doctrine.
GPU scheduling
Accelerator-aware placement across enclave hardware.
Model registry
Governed catalog of approved and accredited models.
Evaluation pipelines
Gate a model on measured performance before it runs.
Model lifecycle
Evaluate, approve, deploy, monitor, retire: the full model supply chain as one auditable loop.
Get started
Bring Glyphon into your authorization boundary.
Delivered as part of a SigilArk engagement, self-hosted, and run against your targets.
Licensing
A perpetual license to the major version of Glyphon, with minor updates and patch cycles included. SigilArk provides professional services for installation, maintenance, and custom development. You are not labor-locked to keep it running.
Contracting Entity