Catch the Attack While It's Still a Conversation
Reflex reads live conversations across Slack, Teams, and email — and warns your people the moment someone tries to manipulate them. Every turn and verdict is sealed into a tamper-evident ledger you can hand to an auditor.
Requests an MFA code under time pressure — do not share.
Attacks Move Through Chat Now. Your Defenses Don't.
Social engineering has moved off email and into Slack, Teams, and DMs — where it plays out over multiple turns, in real time. The tools you already own only catch it after the money's gone.
Detect after the fact
Your stack reacts to attacks after they've already worked:
- Email gateways cover the inbox, and stop there
- SIEM and DLP flag it in tomorrow's report
- Awareness training happened last quarter
- By the time anyone knows, the user already acted
Warn in the moment
Reflex sits in the conversation and intervenes before the click:
- Reads every message across policy-approved apps
- Scores manipulation as it unfolds, across turns
- Fires a native warning within about a second
- Seals every turn and verdict into an audit ledger
From Message to Warning to Evidence, in About a Second
Reflex captures the conversation on-device, scores it in two tiers, warns the user instantly, and writes an immutable record of every verdict.
Capture on-device
A background macOS agent watches only the app bundle IDs you approve. It pulls text from the accessibility tree first, falls back to on-device OCR for Electron apps, and sends text only — raw screenshots are processed in memory and never leave the machine.
Score in two tiers
One fast Cerebras read scores every message: risk band, tactic, and a one-line reason, with recent turns for context. Only messages in the "uncertain" band escalate to focused lenses. Clear-cut messages never pay the cost.
Warn instantly
On an attack verdict, Reflex fires a native, time-sensitive notification that names the tactic and gives a one-line reason — reaching the person before they act on the message.
Seal the evidence
Every turn and verdict is hash-chained into an append-only ledger. Recompute the chain to prove nothing was altered or removed. Raw detections become attestable compliance evidence, not just alerts.
Why Your Current Stack Misses This
Every layer you own was built for a different shape of attack — the wrong channel, the wrong moment, or the wrong point in time. Reflex closes the gap each one leaves open.
Email gateways stop at the inbox
Proofpoint, Mimecast, and their peers guard email well — and see nothing else. The fastest-growing social-engineering surface is Slack, Teams, and native chat, which they were never designed to read.
Reflex watches the conversation surfaces where the attack actually lands, not just the inbox.
SIEM and DLP find out too late
They correlate and log after the fact from aggregated telemetry. By the time an analyst opens the alert, the wire has cleared and the credentials are already gone.
Reflex intervenes in the conversation and warns the person before they act — not the SOC an hour later.
Training doesn't fire in real time
A simulated phishing exercise last quarter does nothing against a live, multi-turn manipulation happening right now, while the employee is under pressure.
Reflex is the control that fires in the moment — every message, every employee, no memory of a training module required.
Deploy Fleet-Wide Without a Single Permission Prompt
Reflex ships as a signed, notarized macOS LaunchAgent. Push it through Jamf, Kandji, or Intune with a PPPC profile that pre-grants Accessibility, Screen Recording, and Notifications — so employees never click "Allow." The cloud runs as a Docker container against your managed Postgres.
- MDM rollout: signed + notarized agent with TCC permissions pre-granted via a PPPC profile — zero end-user prompts.
- One-time enrollment: each device claims a short-lived code, stores its token in the Keychain, and pulls tenant policy.
- Central policy sync: watched app bundle IDs, risk thresholds, and detection model update centrally and propagate to every device.
$ reflexctl enroll --code RFX-7QK2-9M4T
# Claiming one-time enrollment code…
[✓] tenant acme-corp resolved
[✓] device token stored in Keychain
[✓] policy synced · 12 watched apps
[✓] agent running as LaunchAgent
# Reflex is active. Watching Mail, Slack, Teams…$ reflexctl policy show
tenant: acme-corp
model: cerebras / llama-3.3-70b
escalate: when band = "uncertain"
watched apps:
com.tinyspeck.slackmacgap Slack
com.microsoft.teams2 Teams
com.apple.mail Mail
egress: text-only # screenshots never leave the device$ reflexctl verdicts tail
14:02:07 slack #finance safe 0.08
14:02:19 slack dm:vendor uncertain 0.55 → escalating
14:02:20 slack dm:vendor ATTACK 0.91 authority + urgency
reason: spoofed-CFO wire request, pressure to skip approval
# native warning delivered in 940ms$ reflexctl ledger verify --range today
# Recomputing hash chain over 3,412 entries…
[✓] chain intact no gaps, no rewrites
[✓] head hash 3f9a…c17e
[✓] anchored SOC 2 CC7.2 · EU AI Act Art. 12
$ reflexctl ledger export --format soc2 > evidence.jsonWatches the Surfaces Where Attacks Actually Happen
Reflex reads policy-approved conversations across the apps your team already lives in — no new inbox, no new client to adopt.
Capabilities
Every message read on-device. Every verdict sealed. Every tenant isolated at the database. Built for security teams rolling out across a macOS fleet.
Real-Time Warnings
A native, time-sensitive macOS notification names the tactic and the reason within about a second of the message landing — reaching the person before they act, not the SOC after.
Two-Tier Detection
A fast Cerebras read scores every message; only uncertain ones escalate to concurrent authority, urgency, trust, and high-risk-ask lenses. Accurate where it matters, cheap everywhere else — and lenses are defined as data, so adding one is a config change.
Tamper-Evident Audit Ledger
Every turn and verdict is hash-chained into an append-only log; a verify endpoint recomputes the chain to prove nothing was altered or removed. Raw detections become attestable evidence mapped to SOC 2 and the EU AI Act.
Enterprise Deployment
A signed, notarized LaunchAgent shipped through Jamf, Kandji, or Intune, with TCC permissions pre-granted via PPPC so employees never see a prompt. The cloud ships as a Docker container against your managed Postgres.
Privacy-First On-Device Capture
Text is extracted on the device from the accessibility tree, with OCR only where needed. Raw screenshots are processed in memory, never written to disk, never transmitted. Egress is text-only — and only from the apps you approve.
Multitenant Isolation via Postgres RLS
Every tenant-scoped row carries a tenant ID and a row-level-security policy keyed on a per-transaction session variable set after auth. Cross-tenant reads fail at the database, not just in application code.
Be First to Warn Your People in Real Time
Early access is opening to a small group of security teams rolling out macOS fleets. No spam, no commitment — we'll reach out when Reflex is ready for your environment.
Reflex is macOS-only for v1. The detection engine and replay dashboard run today as a single-tenant prototype; the multitenant cloud and capture agent described here are in active development.