Canyon Road Beacon

Canyon Road Beacon is an endpoint agent for macOS and Windows that monitors and enforces policy on AI applications running on employee devices. It operates at the execution layer, intercepting and attributing network connections, shell commands, and file operations to the specific AI tool that triggered them — without requiring any modifications to the monitored AI applications. Key capabilities: - Live Activity Feed: Captures every network connection, command execution, and file operation made by AI tools, with full process-chain attribution back to the originating application. - Network Controls: Enforces per-app destination policies, allowing administrators to define approved API endpoints, block unknown or suspicious domains (including unknown MCP servers), and prompt for approval on unrecognized destinations. Supports wildcard rules and real-time enforcement. - Action Approval (Human-in-the-Loop): When a risky operation is attempted, Beacon surfaces a prompt to the user or administrator with full context — AI tool identity, process chain, and exact action. Decisions can be applied once or made into durable rules. Prompts have a 30-second timeout and decisions are cached. - Incident Response: Detects anomalous patterns (e.g., bulk file access), automatically blocks offending actions, quarantines affected files for reversible recovery, and logs full context for investigation. - Audit Trail and SIEM Export: Maintains an event history (duration depending on plan tier) and supports export to SIEM platforms for enterprise customers. Beacon is one component of Canyon Road's broader execution-layer security platform, which also includes AgentSH (for unsupervised AI agents) and Watchtower (a centralized control plane). All three products share a unified policy engine and audit trail. Supported AI applications include Claude Desktop, ChatGPT Desktop, Cursor, and Claude Code. Enterprise customers can define custom application profiles. Pricing tiers: Free (1 endpoint, local policy, 24-hour history), Team (up to 5 endpoints, shared cloud policy, 7-day history), Enterprise (unlimited endpoints, SIEM integration, SSO, RBAC, 30/90/365-day retention).