The Complete AI Security Platform
ASTRA BASTION unifies identity, gateway security, trust scoring, agent operations, compliance, risk quantification, resilience testing, and data governance into one modular, enterprise-grade platform.
234
API Endpoints
12
Security Modules
33
AI Providers
38+
Integrations
132
Dashboard Pages
Modular Architecture
12 Purpose-Built Security Modules
Each module is a bounded context with its own database schema, domain events, and REST API. Deploy all twelve or pick the ones you need.
IAM
Identity & Access Management
Enterprise-grade identity with multi-factor authentication, SSO federation, and non-human identity management for service accounts and API keys.
- Multi-factor authentication (TOTP, WebAuthn, SMS)
- SSO federation (SAML 2.0, OIDC, OAuth 2.0)
- Non-Human Identity (NHI) lifecycle management
- RBAC + ABAC fine-grained permissions
- Session management with refresh token rotation
AI Gateway
Secure AI Traffic Control
14-step security pipeline inspecting every LLM request and response. Supports 18+ AI providers with prompt injection detection, PII redaction, and kill switch.
- 14-step security pipeline (pre + post processing)
- 18+ AI provider adapters (OpenAI, Anthropic, etc.)
- 9 prompt injection detection techniques
- 38 tool call injection pattern signatures
- Kill switch with scope hierarchy
Trust Engine
Continuous Trust Scoring
5-pillar trust scoring from A+ to F, aggregating security posture, compliance adherence, risk exposure, resilience readiness, and AI governance maturity.
- 5-pillar scoring (Security, Compliance, Risk, Resilience, AI Gov)
- A+ to F grading with real-time recalculation
- 6 ACL data adapters for cross-module aggregation
- Score decay models (linear, exponential, sigmoid, step)
- Event-driven recalculation with 30s debounce
AEGIS
AI Agent Security Operations
Complete agent lifecycle security: MCP Firewall for tool call validation, behavioral monitoring with anomaly detection, inter-agent HMAC authentication, and emergency kill switch.
- Agent kill switch (instant termination)
- MCP Firewall with tool name + injection regex
- Inter-agent HMAC-SHA256 authentication
- Behavioral monitoring (z-score + IQR anomaly)
- Memory poisoning detection engine
Compliance
Regulatory Framework Management
Automated compliance assessments against EU AI Act, NIST AI RMF, ISO 42001, SOC 2, GDPR, and HIPAA with cross-framework control mapping and evidence collection.
- EU AI Act assessor (Art. 5-53, 350+ rules)
- NIST AI RMF (24 subcategories)
- Cross-framework control mapping (24 mappings)
- ISO 42001, SOC 2, GDPR, HIPAA support
- Evidence collection and audit trail
Risk
AI Risk Quantification
Quantitative risk analysis using FAIR methodology and Monte Carlo simulations with 10,000 iterations. PERT distributions, VaR/CVaR calculations, and portfolio-level aggregation.
- FAIR quantitative risk calculator
- Monte Carlo simulation (10K iterations)
- PERT distribution modeling
- VaR and CVaR at 95th/99th percentile
- Threat modeling with convergence detection
Resilience
Breach & Attack Simulation
Scenario-based resilience testing with blast radius analysis using BFS graph traversal. Chaos engineering injection, RTO/RPO measurement, and automated recovery validation.
- Breach & attack scenario execution
- Blast radius analysis (BFS graph traversal)
- RTO/RPO measurement and tracking
- Chaos engineering injection service
- Automated recovery procedure validation
BASTION AI
Intelligent Security Assistant
Built-in AI assistant with streaming chat, RAG pipeline for contextual security intelligence, model routing with failover, and production-grade OpenAI/Anthropic integration.
- Streaming chat with token-by-token output
- RAG pipeline (chunking, reranking, assembly)
- Multi-provider routing with failover
- Production-grade OpenAI adapter (221 lines)
- Contextual security intelligence queries
Platform Services
Event Processing & Workflows
OCSF v1.4.0 event normalization across 22 event types into 7 classes. Multi-channel notification dispatch, workflow engine with loop detection, and report generation.
- OCSF v1.4.0 normalization (22 event types)
- Multi-channel notifications (email, Slack, webhook)
- Workflow engine with loop detection
- Report generation and scheduling
- Exponential backoff retry with dead-letter queue
Administration
System Health & Configuration
Centralized admin console with real-time health monitoring, tenant onboarding wizard, license management, and system configuration with audit logging.
- Real-time system health monitoring
- Guided tenant onboarding wizard
- License and subscription management
- System configuration with versioning
- Complete administrative audit trail
CyberTwins
Digital Twin Topology
Digital twin modeling of your AI infrastructure with graph-based topology visualization, attack path analysis, and continuous security posture assessment.
- Infrastructure digital twin modeling
- Graph-based topology visualization
- Attack path and blast radius analysis
- Asset discovery and classification
- Continuous posture assessment
Data Governance
ML-Powered Data Protection
Machine learning data classification detecting 18 sensitive data types (PII, PHI, PCI, credentials). DSAR processing across 7 jurisdictions with full data lineage tracking.
- ML classification (18 data types: PII, PHI, PCI)
- DSAR processing (7 jurisdictions incl. India)
- Data lineage with graph traversal
- Retention policy enforcement
- Aadhaar, PAN, and credential detection
Under the Hood
Hexagonal Architecture
Clean separation of domain logic from infrastructure. Ports and adapters ensure every module is testable, replaceable, and independently deployable.
Presentation
Next.js 15, React 19, 132 dashboard pages
API Layer
FastAPI, 234 REST endpoints, RFC 7807 errors
Application
CQRS commands/queries, Result<T> monad
Domain
DDD entities, value objects, 137 domain events
Infrastructure
PostgreSQL 17, Redis 7, Neo4j, Elasticsearch
Domain-Driven Design
12 bounded contexts with aggregate roots, entities, and value objects. Clean domain events for cross-module communication.
CQRS Pattern
Selective command-query separation for Gateway, Trust Engine, and CyberTwins. Optimized read and write paths.
Result Monad
Result<T, DomainError> throughout. No exceptions for business logic. RFC 7807 Problem Details at the API boundary.
Row-Level Security
PostgreSQL RLS on every table. Tenant isolation enforced at the database layer, not just application code.
Enterprise Integrations
38+ Integrations
Connect ASTRA BASTION to your existing security stack. Native integrations across SIEM, SOAR, cloud security, identity, DevOps, communications, and observability platforms.
SIEM
8 integrations
SOAR
5 integrations
Cloud Security
5 integrations
Identity Providers
8 integrations
DevOps
5 integrations
Communications
4 integrations
Observability
3 integrations
33
AI Provider Types
US, China, APAC, self-hosted
38+
Enterprise Connectors
SIEM, SOAR, cloud, identity
OCSF
Event Formats
v1.4.0, 22 event types
4
Notification Channels
Slack, Teams, email, webhook
Universal AI Coverage
33 AI Providers Supported
From OpenAI and Anthropic to DeepSeek, Qwen, and self-hosted models. Every request routed through the 14-step security pipeline.
US / Western
12OpenAI
Anthropic
Google Gemini
Meta Llama
Mistral
Cohere
AI21 Labs
Perplexity
xAI Grok
Inflection
Stability AI
Hugging Face
China / APAC
10DeepSeek
Qwen (Alibaba)
Baidu ERNIE
Zhipu GLM
Moonshot (Kimi)
01.AI (Yi)
Baichuan
SenseTime
iFlytek Spark
Minimax
Cloud Platforms
3AWS Bedrock
Azure OpenAI
Google Vertex AI
Self-Hosted
5Ollama
vLLM
TGI
LM Studio
Custom (OpenAI-compatible)
Defense in Depth
Security at Every Layer
Prompt Injection Detection
9 heuristic techniques including Unicode normalization, emoji stripping, RTL override detection, homoglyph analysis, Base64 decoding, and nested encoding detection.
PII / PHI Redaction
ML-powered classification detects 18 sensitive data types including Aadhaar, PAN, SSN, credit cards, and medical identifiers before they reach AI models.
Tool Call Validation
38 injection pattern signatures covering SSRF, command injection, path traversal, SQL injection, and template injection in MCP tool parameters.
Rate Limiting
Redis sliding-window rate limiter with per-tenant, per-user, and per-provider quotas. Burst allowance with automatic recovery.
Kill Switch
Hierarchical scope control: global, tenant, provider, model, or individual agent. Instant shutdown with audit trail and automatic notification.
Full Audit Trail
Every request and response logged with OCSF normalization. Complete chain of custody from ingress to model response and back.
Regulatory Coverage
Built for Compliance
EU AI Act
Art. 5-53
NIST AI RMF
24 subcats
ISO 42001
AI Management
SOC 2
Assessment ready
GDPR
Gap analysis
HIPAA
PHI controls
Start Securing Your AI
12 modules. 234 API endpoints. 38+ integrations. One platform. Deploy on-premise or in the cloud with full tenant isolation and zero-trust security from day one.