Governing ever-expanding AI risk with a two-person team.
When Cogentrix rolled out Claude and GPT Enterprise company-wide, AI adoption exploded, putting pressure on the security team to keep pace. Challenges included:
- A lean two-person security team, tasked with managing and protecting both corporate and OT NERC-CIP environments simultaneously.
- Zero visibility into the AI landscape left the team with no way to classify, govern, or track incoming browser extensions, models, and marketplaces.
- A tedious manual vetting process required 30 to 120 minutes every day, pulling hashes from security blogs just to block malicious packages.
- A high-value target profile, with Cogentrix seeing routine probing from sophisticated threat actors.
- Friction between security and developer speed made it hard to protect third-party dependencies without blocking rapid software development.
“Previously, we had zero visibility, zero classification for AI, marketplaces, and packages. We couldn’t do any cooldown protection. Now Koi Agentic Endpoint Security does all that for me—quickly and easily.”
Jim Boyer
Director of Cybersecurity & AI, Cogentrix
Dynamic visibility and rapid time to value.
Deploying Koi was remarkably swift for Cogentrix. Using its existing endpoint management tool, the team rolled out the Koi agent script across all endpoints within a single week. By day five, the dashboard had lit up with over 5,000 previously unmonitored assets, including browser extensions, AI tools, and code packages.
In its first week, Agentic Endpoint Security identified 30 critical vulnerabilities that Cogentrix successfully remediated. Once deployed, the platform gave Cogentrix immediate, global control over the modern AI workspace, blocking unwanted marketplaces and packages, enforcing malware protection, and applying version cooldowns and delayed install access before threats could take hold.
Operating alongside Cogentrix’s existing endpoint solution, Koi Agentic Endpoint Security provided AI-native visibility and pre-execution guardrails to stop unverified packages and browser add-ons before they could run. It also surfaced shadow AI activity the team hadn't been tracking — including downloads from the Hugging Face model marketplace, where anyone can publish and models arrive as executable code rather than inert data files. With that visibility, Boyer could see which endpoints were pulling models from the marketplace and work directly with the individuals involved on what they needed and how to get it safely.
-
Freeing a lean team to focus on what matters
For a two-person team, the time saved was a significant win. Koi Agentic Endpoint Security reduced daily manual vetting from two hours to about 30 minutes, freeing Boyer to work directly with developers on the reasoning behind each policy, an approach that has also helped mature the company’s software bill of materials (SBOM) practice. “The most interesting part of deploying Koi Agentic Endpoint Security,” he explains, “is that it gives me the intelligence to talk with developers about the why. Why do you need to mitigate this? What issues are there? They'll stop coding for a few minutes and update their dependencies as needed.”
-
Bringing AI risk to leadership
The platform also gave Boyer a better way to show leadership what AI risk looks like. Instead of summarizing activity in an email, he has walked business and engineering leaders through the live dashboard directly — making both the value of the investment and the moving-target nature of AI risk visible in one view. The reasoning behind each recommended mitigation, work that used to take him time to research on his own, surfaces automatically, so leadership sees immediate context.
-
Visibility across the AI supply chain
Koi’s research team tracks active supply chain campaigns, giving Boyer a way to cross-reference threat activity hitting Cogentrix's perimeter against the extensions and monitored packages. That same visibility extends to Cogentrix’s growing use of agentic endpoints. Boyer can see which Model Context Protocol (MCP) servers are active across the environment, monitor agent tool invocations in real time, and apply runtime controls to safeguard sensitive credentials and prevent unauthorized shell execution.
“Marketplace governance is what sold me. Being able to write policy across browser and IDE extensions instead of just blocking known-bad ones, and having that in the same place as package and model visibility — that's the win for us.”
Jim Boyer
Director of Cybersecurity & AI, Cogentrix
A strategic ally for the next generation of AI-native threats.
“Koi Agentic Endpoint Security is one of my favorite tools because it gives me visibility and governance into areas I didn't have before — the marketplaces, extensions, and packages my people pull from every day.”
Jim Boyer
Director of Cybersecurity & AI, Cogentrix
share this story
