This preview is password protected. Enter the password provided by the GSIS AI practice team.
GSIS helps organizations identify AI opportunities, establish AI policies, build AI workflows, and maintain ongoing observation of every agent in the estate, company built, vendor bought, or employee created.
Start with the Readiness Snapshot Begin with a Census SprintWhat slows your organization down? Ten questions capture the bottlenecks, handoffs, recurring work, informal AI use, and decisions that shape the first engagement. The snapshot returns three likely opportunities, one risk flag, and a starting posture, then feeds client onboarding and the Census Sprint.
A client can enter at any pillar. Every pillar is backed by a working platform, not a brochure.
Find what is already running, declared or not, across runtime logs, identity, endpoints, network metadata, and cloud audit. Then score the opportunity portfolio: value, feasibility, risk, and a documented misuse case for every candidate. No misuse case, no ranking.
See the proof: sample census findings · Start with the Snapshot
The charter, policy, rules, and processes that govern AI use, written from your live registry. Includes off limits data zones, the control policy (block, monitor, allow), and evidence in the formats regulators and government buyers require.
Every workflow starts with a Design Sprint: blueprint, pre-build red team, and a governance gate that must pass before build sprints begin. Attestation before anything goes live, and a named human owner for every agent.
Continuous monitoring for drift, new tools, new endpoints, and new agents, with day 90 value verification that proves each workflow earned its keep. Managed Oversee runs it for you under written service terms.
Wondering whether an agent is running on a machine in your organization? The Quick Sweep walks a two minute guided check, hands you the same collector our platform uses, and analyzes the evidence bundle in your browser. Your data never leaves the device. A web page cannot scan your computer, and we will not pretend otherwise; the sweep is how it honestly works.
The platform reads evidence from seven planes and fuses it into a single verdict per agent, with the action to take. It reads log metadata, not your data lakes.
Runtime logs, SSO and OAuth identity, MCP servers, endpoint artifacts (an agent workspace leaves fingerprints: scheduler wakeups, heartbeat files, process cadence), DNS and proxy metadata, cloud audit trails, and the endpoint fleet, reconciled against the registry. Undeclared agents surface with confidence scored by corroboration.
Every agent carries a signed attestation, its Know Your Agent passport, checked at the platform edge on every interaction. Drifted or missing attestation: denied. Data owners declare zones; the data itself refuses agents it is closed to.
Drift alerts the day they happen, a four layer kill switch drilled quarterly, incident plans generated from the ledger, and value verification at day 90: cycle time, cost per case, errors, baseline against actual.
Every competitor governs agents. We also govern data. A data owner declares a dataset's posture once, and it binds every agent, every scope, and every attestation in the estate.
Closed to all agents, full stop. The legal hold store, the sealed HR system, the PII lake under rights review. A design naming it is blocked, an attestation claiming it is a breach, and touching it fires a critical finding.
Only named, attested agents may touch it. Anyone else is a finding on sight.
Ordinary declared scope rules apply, checked continuously against what agents actually touch.
Your most sensitive data does not need a better behaved agent. It needs a fence no agent can cross.
GSIS serves government clients today. The platform speaks their evidence language from day one.
A NIST 800-53 crosswalk (the census is CM-8, the data zones are AC-3 and AC-4, the ledger is AU-9), findings delivered as POA&M rows with federal cadence due dates, the AI use case inventory your agency must maintain exported from the registry, and impact assessments drafted from each workflow's own blueprint. StateRAMP, TX-RAMP, and CJIS overlays are available per pursuit.
FIPS validated cryptography and a packaged air gapped deployment are on the roadmap as named items, and a Section 508 audit of the console is available as an engagement. Government buyers punish vendors who blur that line. We never do.
We help clients find and build agents, so we will never meter them. Registering agents is always free. Bands are set at signing and renewal; nothing meters in between.
| Entry | What it is | Price |
|---|---|---|
| Census Sprint | Two week census of the estate plus the scored opportunity portfolio. Credited in full toward a subscription signed within 60 days. | $9,500 flat |
| Scout | Platform subscription, estates up to 30 agents. Onboarding $4,500. | $1,495 / month |
| Guardian | Platform subscription, estates up to 300 agents. Onboarding $12,500. | $8,900 / month |
| Sentinel | Platform subscription, estates up to 1,200 agents. Onboarding $40,000. | $26,500 / month |
| Managed Oversee | We run observation for you, under written service terms with severity clocks and escalation. | 1.6x the band fee, flat |
| Implementation sprints | Two week build sprints. A typical first workflow takes 4 to 8. | $18,500 / sprint |
Annual prepay saves 15 percent. Kill switch and red team drills are $7,500, included quarterly in Managed Oversee.
Against planted ground truth, the detection fusion scores recall 1.000, 11 of 11 rogue and shadow agents caught. Detections outside the planted set are listed openly, never hidden.
Five adversarial scenarios run on every release. Current scorecard: 4 caught, 1 designed miss (a borrowed credential), published with its mitigation, a key bound to one agent and one configuration, verified at the edge.
We grade ourselves in the same format we hand clients: known weaknesses, due dates, no varnish. It is available to any client who asks.
No. It reads log metadata, identity exports, audit trails, and census metadata about datasets (names, owners, classification, flags), never lake content. Off limits zones are never read at all.
Yes. The control policy sets block, monitor, or allow per agent, key, application, endpoint, or cloud actor. Blocked means edge denial, credential revocation, and the kill switch, applied through your own control points.
Start with the Census Sprint. Then the Govern Foundation is generated from your live registry, designs pass their gate, build sprints run, and Oversee begins at registration. The onboarding page walks the whole path.
GSIS leadership brings decades of federal security, investigations, and government relations experience. The AI practice is led by practitioners who build the platform they sell.