# Straight answers for buyers. URL: https://avispa.ai/faq/ FAQ What security, IT and procurement teams ask first, and the words we use. ## The basics **What is Avispa Enterprise?** A Secure AI Agent Platform: agent teams that work alongside your people, on the models you choose, with Zero Trust security built into how every agent operates. Shown on [Story Mode](https://avispa.ai/) **Do AI agents replace people?** No. People direct the work, approve sensitive actions and own the outcomes. Shown on [Agent teams](https://avispa.ai/agent-teams/) **How is Avispa different from a chatbot?** A chatbot waits for a prompt; Avispa agents do assigned work, on demand, on a schedule, when an event happens or continuously, and record what they did. Shown on [Agent teams](https://avispa.ai/agent-teams/) **Do we have to replace our ITSM or collaboration tools?** No. Agents work in the tools you already run, including Microsoft Teams, Slack, email and ServiceNow, and finished work comes back there. Shown on [Integrations](https://avispa.ai/integrations/) **Where does Avispa run?** Where your architecture requires it: SaaS, your cloud, an appliance or air-gapped. Shown on [Deployment and models](https://avispa.ai/deployment/) ## Agent teams **What does a pre-built agent team include?** Defined agent roles, a team lead, procedures, tools and integrations, knowledge and an optimized harness. Shown on [Azure Platform Engineering](https://avispa.ai/agent-teams/azure-platform-engineering/) **Do agents work alone or as a team?** Both. As a team, a lead plans, specialists execute, and every task has a single owner. Shown on [Agent teams](https://avispa.ai/agent-teams/) **Can we build our own agents and teams?** Yes. You choose each agent's role, tools, model, schedule, budget and approvals. Shown on [Agent teams](https://avispa.ai/agent-teams/) **Can developers keep using Claude Code or Codex?** Yes. Avispa runs Claude Code, Codex, GitHub Copilot CLI and Gemini CLI as agents under your controls. Shown on [Integrations](https://avispa.ai/integrations/) **How do agents learn?** They document what they do, what they know and what they learn. Shown on [Agent teams](https://avispa.ai/agent-teams/) **How do we get started?** With one team and one workflow that has a clear owner. An Azure Platform Engineering team onboards in 15 minutes. Shown on [Azure Platform Engineering](https://avispa.ai/agent-teams/azure-platform-engineering/) ## Security and control **How does Avispa keep agents secure?** Zero Trust across identity and access, network, applications and tools, and data. Shown on [Security](https://avispa.ai/security/) **What do SOC agents do?** Every deployment comes with dedicated SOC agents that monitor agent activity and continuously validate security controls. Shown on [Security](https://avispa.ai/security/) **Why do agents need governance?** Ten agents across a department is an operations problem: nobody can say who owns a task, what it cost, or when a person had to step in. Shown on [Avispa Enterprise](https://avispa.ai/enterprise/) **Can agents change production?** Only through the gates you set, and no agent approves its own work. Shown on [Security](https://avispa.ai/security/) ## Cost and models **Which AI models can agents use?** Any, per agent: hosted providers such as Anthropic, OpenAI, Microsoft Foundry, Amazon Bedrock and Google, or local LLMs. Shown on [Deployment and models](https://avispa.ai/deployment/) **How do budgets work?** You're warned at 80%, and at the limit the agent pauses, after the run that crossed it, until a person approves more. Shown on [Story Mode](https://avispa.ai/) **Who pays for model usage?** The provider you choose bills it, or it costs nothing per token on local LLMs. Shown on [Deployment and models](https://avispa.ai/deployment/) **How is Avispa priced?** Talk to us. We'll walk through it on the demo. Shown on [Book a demo](https://avispa.ai/book-a-demo/) **More: the CISO's checklist for approving AI agents** ## The CISO's checklist for approving AI agents Ask these of any agent platform, including ours. ### Identity and access 1. Does every agent have its own identity, separate from any person's? · **Avispa:** Yes. Each agent has its own identity (Entra Agent ID), and people sign in as themselves through single sign-on. 2. Are agent credentials short-lived and scoped to one job? · **Avispa:** Yes. Every run gets its own short-lived token, scoped to its purpose. 3. Can you revoke one agent without touching the others? · **Avispa:** Yes. Each agent's identity, tools and allowed hosts are its own: pause one, or take away a tool or a host, and no other agent changes. ### Network 1. Do agents reach out only through an egress proxy with an allowlist you control? · **Avispa:** Yes. Every connection out goes through the egress proxy and is denied unless your allowlists, per team and per agent, allow it. 2. Are credentials injected at the proxy, so agents never hold them? · **Avispa:** Yes. The proxy adds them on the wire, so an agent never holds a credential. 3. Are denied requests logged and reviewed? · **Avispa:** Yes. Every connection and every denial is logged and can go to your SIEM, and SOC agents monitor agent activity. ### Applications and tools 1. Does each agent run in its own sandbox? · **Avispa:** Yes. On Kubernetes, each agent runs in its own pod, with Landlock and a network policy. 2. Can you limit which tools and MCP servers each agent may use? · **Avispa:** Yes. Tools are granted per agent, starting at none, through a managed MCP gateway. 3. Do sensitive actions wait for a named person, and can an agent ever approve its own work? · **Avispa:** Yes, the ones you choose. You decide which actions wait for a person, and an approval covers that exact call, once. No agent approves its own work. ### Data 1. Are secrets encrypted at rest and stripped from logs and outputs? · **Avispa:** Yes. Secrets are encrypted with AES-256-GCM or kept in HashiCorp Vault, and redacted from logs, transcripts and activity. 2. Do controls cover PII, PHI and secrets where data leaves? · **Avispa:** Yes. DLP patterns for PII, PHI and secrets run in the egress proxy. They ship off, and an admin turns them on. 3. If an agent is fooled by something it reads, can it still reach credentials, the network or a write without a person? · **Avispa:** No. It holds no credentials, reaches only approved hosts, has only the tools you granted, and changes nothing without approval. ### Oversight 1. Is there a full, tamper-resistant record of every run, action and cost? · **Avispa:** Yes. The audit log is append-only, and nothing under 90 days can be deleted. It exports to your SIEM over OpenTelemetry, or to write-once storage. 2. Does something watch the agents and test that controls still hold? · **Avispa:** Yes. Every deployment comes with dedicated SOC agents that monitor agent activity and continuously validate security controls. 3. Can you stop every agent at once? · **Avispa:** Yes. The emergency stop pauses every agent and cancels every run. ### Cost 1. Does every agent have a budget that stops it at the limit? · **Avispa:** Yes. Catalog agents come with $25 a month, and you set budgets per team, agent or project. At 80% the owner is warned; at the limit the agent pauses, after the run that crossed it. 2. Can only a person raise a budget? · **Avispa:** Yes. An agent can't raise its own. A person resumes it, with a limit above what was spent. **More questions, by topic, and the glossary** ## What happens if… **What happens if an agent reads a hidden instruction?** The design assumes it will. What matters is that nothing the instruction asks for can happen on its own: the agent holds no credentials, reaches only approved hosts, has only the tools you granted and changes nothing without approval. **What happens when an agent needs a decision?** It stops and asks a person. The approver decides in Avispa or in a Microsoft Teams card, and Slack and email bring them one click back to Avispa. No agent approves its own work. **What happens if an agent tries to approve its own work?** It can't. Only people can decide an approval, and an agent that produced the work can't review it. **What happens when an agent reaches its budget?** At 80% the owner gets a warning. At the limit the agent pauses, its running and queued runs are cancelled, and a person gets an approval request. Only a person can resume it, with a limit above what was spent. **Can spend ever pass the limit?** By one run at most. Cost is recorded when a run finishes, so the run that crosses the limit is the last one before the agent pauses. **What happens if an agent is asked to grant Owner?** It refuses. On the Azure Platform Engineering team, granting Owner or User Access Administrator has no approver at all: the team prepares the assignment, and a person applies it. ## Security, straight answers **Do you support SSO?** Yes, through your identity provider over OIDC, with a Microsoft Entra ID preset. Other OIDC identity providers work through standard discovery. MFA comes from your identity provider. **Does CyberShell see our data?** Not when Avispa runs in your cloud, on an appliance or air-gapped. Email goes through your own mail server, and the model providers are the ones you configure. **Does Avispa send telemetry from our environment?** No. In your cloud, on an appliance and air-gapped, Avispa has no product telemetry. Logs and metrics go only to the destinations you configure, such as your SIEM. **Does Avispa scan documents for hidden instructions?** It doesn't rely on scanning. The defense is containment: agents never hold credentials, reach only approved destinations, start with no tools and need approval to change anything. Results from synced knowledge sources such as SharePoint, OneDrive and Confluence arrive labeled as untrusted. **How do we report a vulnerability?** Email info@cybersh.com with what you found and how to reproduce it. Please give us time to fix it before you share it. **How do approvals work?** You choose which actions need approval. An approval covers that exact action, once. People approve in Avispa or in a Microsoft Teams card; Slack and email link back to Avispa. ## Deployment and models **Which Kubernetes platforms are supported?** Avispa ships a Helm chart for Kubernetes and Red Hat OpenShift, with a preset for Azure Kubernetes Service. **Can Avispa run without internet access?** That's the air-gapped option: licenses are verified offline, images are imported without a registry, there's no telemetry, and agents use local LLMs. Your security team decides what the environment is authorized for. **Can different agents use different models?** Yes. Model choice is set per agent, so a planner can use a frontier model while routine checks run on a smaller or local one. **Which local LLM servers work with Avispa?** Ollama and any OpenAI-compatible server, such as vLLM, LM Studio, llama.cpp, SGLang or TGI. **Can we keep regulated data off hosted models?** Yes. Choose local LLMs for sensitive workloads, per agent, so prompts stay on your infrastructure. **What happens if a model refuses a task?** You can set a fallback model. If a model's safety filter declines a step, the step runs again on the fallback. ## Avispa OrbitSOC **What does OrbitSOC watch?** The AI agents you run on Avispa. Behavioural analytics learn how each agent works and flag anomalous behaviour, detections built for agents run every minute, and canary tokens catch an agent where no task should go. When your rules say so, it pauses an agent on its own and keeps its work for a person to review. **Does OrbitSOC replace our analysts?** No. Agents investigate each alert and hand your analysts a recommended outcome, with the evidence, reasoning, ATT&CK mapping and response guidance to review it. Analysts confirm or override it, and only a person declares a security incident. **Do we have to replace our SIEM or EDR?** No. OrbitSOC isn't a SIEM, and it doesn't replace raw-log retention or your vendor's search console. OrbitSOC does not mirror your log platform: it queries your SIEM and EDR on demand. **Does it respond on its own?** Yes, for AI agents, if you turn on automatic pause. Response is guidance mapped to playbook steps, plus guarded actions: contain a host or disable an account, each once a SOC lead confirms. For AI agents, OrbitSOC pauses an agent on its own when your rules say so: its risk score reaches your level, it touches a canary or decoy, a detection you chose fires, or any detection at or above a severity you set fires. The agent keeps its work, and OrbitSOC or an Avispa instance admin resumes it. Host and account actions also need a tested connector and explicit confirmation. **How often do hunts run?** Daily, once a hunt is enabled. Each run publishes an assurance receipt that says what it established and what it could not look at. **Which models can it use?** Eight provider families: Anthropic, OpenAI, Google Gemini, Microsoft Foundry, AWS Bedrock, Gemini Enterprise Agent Platform, Ollama and any OpenAI-compatible endpoint. You bring your own keys, and strict routing fails visibly rather than quietly crossing a provider boundary. **Where does it run?** In your cloud, your VPC or your data center, deployed with a Helm chart for Kubernetes. **Can an MSSP offer it under its own brand?** Yes. Each tenant can carry its own logo, with “Powered by OrbitSOC”, so an MSSP can offer it to its customers under its own brand. **What if our tool isn't on the list?** Ask. Most new OrbitSOC integrations land in a week or two once a customer asks. **Does OrbitSOC train models on our data?** No. Your data never trains anyone's foundation model. Knowledge a person approves stays in your organization, and reaches only the agents it names. **How is it priced?** Talk to us. We'll walk through it on the demo. ## Channels **What can agents do in Microsoft Teams?** They work in chats, group chats and channels. People approve or deny on a card, and results come back in the thread. Not yet: an agent can message someone only after that person has sent the bot one message. **What can agents do in Slack?** They post updates, digests and change notices, and decisions link back to Avispa. The bot token is added at the proxy. Not yet: Slack is outbound only, so a Slack message starts no work, and there are no approvals by Slack reply. **What can agents do by email?** A shared mailbox can start a routine, and agents send through Microsoft Graph, SendGrid or your own relay. Email is off until you switch it on. Not yet: approvals by email reply. **What can agents do in ServiceNow?** They work incidents, changes, requests and the CMDB, read-only or full per agent, with no generic table access. Not yet: problem records and knowledge articles, and agents read queues on a schedule rather than the moment they change. ## Azure Platform Engineering **Is this the same as the Azure Platform Administration Team?** Yes. In the product catalog it's called the Azure Platform Administration Team. **What does it refuse, whoever asks?** It never grants Owner or User Access Administrator: both can grant any further permission, so it prepares the assignment and a person applies it. It never weakens a security control: no removing policy assignments, no NSG rule open to the internet, no disabling diagnostic settings. It never touches break-glass identities: the emergency-access accounts recorded in discovery are excluded from every operation. And it deletes only through the decommission workflow, after an agreed soak period. **Who approves a change?** A script classifies every operation by how reversible it is and how wide its scope is, then names the approver. Reversible or recoverable changes inside a resource group go through the Platform Lead's gate, and anything irreversible, subscription-wide or unrecognized goes to a named approver, and unrecognized operations never default to routine. **Does it manage Entra ID users or Intune devices?** No. It reads Entra ID only to resolve who Azure roles are assigned to. Identity and device administration belong to the Workplace Tenant Administration team. **Can it work alongside our own cloud engineers?** Yes. In supplement mode it takes on policy conformance, infrastructure-as-code migration, access reviews and cost work, and never changes anything your engineers own without their agreement. **What happens if Azure activity logs stop arriving?** The daily change review checks collection health first. A gap in audit-log collection is escalated as urgently as an unapproved change, because nobody can say what happened during it. ## Glossary - **AI agent**: Software that uses a language model to plan and carry out multi-step work with tools, not just answer a single prompt. In Avispa Enterprise, every agent has its own identity, role, budget and audit trail, and works in its own sandbox behind an egress proxy. - **Agent team**: A group of specialized AI agents with a lead, defined roles and shared goals, working together on a function's workflows. Avispa offers pre-built agent teams for many business functions. Each imports paused, runs discovery, proposes a plan and waits for a person to approve it. - **Agent harness**: The runtime around a model that gives an agent its instructions, tools, memory, guardrails and limits. Avispa provides optimized harnesses for its pre-built teams and runs the agent runtimes you already use, such as Claude Code and Codex, alongside its own. - **Agent control plane**: The system that assigns, governs, secures and records the work of many AI agents across an organization. In Avispa Enterprise, assignments, approvals, budgets and the audit trail live in one place. - **Secure AI Agent Platform**: One place to put AI agents to work across an enterprise: agent teams beside your people, in the apps they already use, with security, governance and cost control built into how they operate. It removes the tradeoff between locking AI down and letting agents run wild. It's the category Avispa Enterprise was built for. - **Zero Trust for AI agents**: No agent is trusted by default: every identity, network call, tool use and data access is verified and limited to what the task needs. Avispa applies it across identity and access, network, applications and tools, and data, and every deployment comes with dedicated SOC agents that monitor agent activity and continuously validate security controls. - **Prompt injection**: An attack that hides instructions in content an AI model reads, so the model follows the attacker instead of its user. Avispa treats what agents read as untrusted and limits what a fooled agent can do: no credentials in the sandbox, default-deny egress, tools granted per agent and approval before writes. - **Data loss prevention (DLP)**: Controls that find sensitive data and keep it from leaving where it belongs. Avispa redacts secrets from everything agents write, and adds PII, PHI and secrets patterns at the proxy that you can switch on. - **Egress proxy**: A gateway that every outbound connection must pass through, so only approved destinations can be reached. Avispa routes agent traffic through one, with allowlists you control, credentials injected on the way out and a log of every denied request. - **Agent sandbox**: An isolated environment where an agent's commands and code run, so a mistake or attack can't reach anything outside it. In Avispa, each agent works in its own sandbox and reaches out only through an allowlist you control. - **Human approval gate**: A point in an agent's work where it must stop and wait for a person to approve before it acts. In Avispa, you choose which actions wait for a person, approvals can arrive in a Microsoft Teams card, and no agent approves its own work. - **Agent budget**: A spending limit for a team, agent or project that warns as it fills and stops work when it's reached. In Avispa, budgets warn at 80% and pause an agent at the limit, after the run that crossed it, and only a person approves an increase. - **SOC agent**: An AI agent that does security operations work, such as watching activity, triaging alerts and checking that controls are working. Every Avispa deployment comes with dedicated SOC agents that monitor agent activity and continuously validate security controls. - **Model Context Protocol (MCP)**: An open standard for connecting AI models and agents to tools and data sources. Avispa lets you register MCP servers as custom tools and decide which agents can use which tools. - **Local LLM**: A large language model that runs on infrastructure you control, so prompts and data don't go to an outside provider. Avispa is model agnostic, including local LLMs, so each agent can run on the model that fits its work. ## See it on your own use case. [Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)