ShrikeGovernance Should Be Independent.
AI agents are making decisions at machine speed. Governance needs to operate at the same speed. Shrike screens every interaction against your policies: before data leaves, before actions execute, before risk becomes incident. Deterministic pattern checks answer in under 15ms; deep semantic analysis follows in seconds.
Our Mission
Keep people in charge of what AI agents do. Shrike evaluates each tool call, command, query, and agent message against your policy before it executes, routes the consequential calls to a human, and keeps the evidence behind every decision. Independent by design: not a feature inside your model provider, and enforceable across the models, frameworks, and clouds you already run.
Your Policies
You define what gets allowed, blocked, or escalated for human review.
Your Approval Workflows
Human-in-the-loop controls for high-risk AI actions across your organization.
Your Compliance
Controls mapped to SOC 2, HIPAA, GDPR, PCI DSS, and ISO 27001, with per-action evidence your auditor can read.
What Shrike Verifies
An agent's session has two planes. On the observe plane is what is said: the operator's prompt, the model's reply, a sub-agent's report. Shrike reads it, records what it found, and never gates it. On the act plane is what is done: a tool call, a command, a file write, a query, a message to another agent. Shrike verifies each one before it runs.
Against Your Authority
The agent's declared scope: which tools, for what purpose, for how long. A sub-agent inherits a narrowed copy of its parent's scope, never a wider one.
Against Your Policy
The built-in rules you keep, the ones you add, and a safety floor no operator can switch off. Every verdict is allow, warn, require approval, or block, and a held action waits for a person.
Against the Session
The trajectory across turns, so an escalation that unfolds over many steps is caught as one. Fourteen named controls decide on every action, and each records its decision, so the evidence behind a verdict can be read afterward.
The verification is itself verified. An adversarial suite runs against production at every release and scheduled probes run between releases, measured against a baseline that may not regress. The in-house corpus is always read beside the public benchmarks, and a refusal an operator calls wrong is recorded as a false positive and counted.
The Company
Shrike Security, Inc. builds and operates action governance software for AI agents. Our customers are the engineering and security teams accountable for AI systems that actually do things: write files, run shell commands, query production databases, call other agents. We give them one place to declare what those agents may do, and the runtime enforcement that holds when an agent attempts something else.
The business is a subscription software company. The platform is sold directly and through Google Cloud Marketplace, where it can be procured against an existing Google Cloud commitment. Plans run from a free community tier through Pro, Team and Enterprise, with air-gapped and sovereign deployments available for government and defense. Our client libraries are open source under Apache 2.0 and published to npm, PyPI and the Go module registry; the detection and policy engine runs on infrastructure we operate.
- Legal entity
- Shrike Security, Inc.
- Company LinkedIn
- linkedin.com/company/shrike-security
- Contact
- info@shrikesecurity.com
Team
Shrike is a solo-founder company at this stage, by design. Equity advisors cover security operations and AI governance, and the platform is built and operated by the founder.
We run Shrike on ourselves. We build with AI coding agents, and they work behind the same hook a customer installs: every command they run and every file they write is scanned first, and refused when it crosses a line. So we find our own false positives before customers do, and a destructive command does not get through because one person missed it.
The client libraries are open source under Apache 2.0, so you can read the code before you run it in your own systems.
Habiru Abubakar
Founder & Chief Executive Officer
Before founding Shrike in January 2026, he spent more than a decade securing Fortune 500 infrastructure across financial services and telecom, at Citigroup, Verizon and PenFed, including the Verizon application security team recognized with a CSO50 Award in 2021. He is AWS certified.
He wrote the policies and rules that governed those systems, most of them regex. That is how he knows exactly where deterministic matching stops: it is precise about the strings it has seen, and silent about intent it has not. Shrike keeps that basis and adds the other. Its deterministic layers answer in milliseconds and cannot be talked out of a verdict; its probabilistic layers judge what an action is about to do. An agent that can act needs both, which is why he built it with both. He is the engineer behind Shrike as well as its founder.
He is based in Dallas, Texas, where he runs about twenty miles a week, spends time with his family, and watches soccer, Chelsea above all.
How We Build
Shrike is shaped by real incidents, the ones where governance was an afterthought until it was too late. Every layer, every pattern, every guardrail traces back to a public failure we studied and refused to let happen inside our customers.
Governance at Machine Speed
Deterministic policy checks in under 15ms on every interaction; deeper semantic analysis in seconds. Not frameworks and PDFs, but runtime enforcement that executes before data leaves.
Independence by Design
Governance must be independent of the systems it governs. Shrike runs outside the AI model's reach via hardware-isolated enforcement.
Three Lines to Govern an Agent
Build the governance from a client, map your tools to Shrike's surfaces, hand it to your framework. The client is thin and the detection runs on our side, so nothing heavy ships into your process. Starters cover the Claude Agent SDK, OpenAI Agents, LangGraph, CrewAI and Google ADK, and the core underneath is framework-free: changing model or framework does not mean rewriting your controls.
Credentials & Recognition
Industry validation from the organizations that define AI governance standards.
NVIDIA Inception Member
Active member of NVIDIA's startup accelerator for AI-driven companies.
Cleared NVIDIA Maintainer Security Review
Shrike's agent-security recipe was reviewed by NVIDIA maintainers and merged into nemoclaw-community, the official recipe catalog for the NemoClaw agent stack.
Google Cloud Marketplace
Listed on Google Cloud Marketplace for procurement through your existing GCP commitment.
NIST CAISI Contributor
Comment NIST-2025-0035-0074, contributing to national AI safety and governance standards.
W3C WebMCP Security Proposal
Submitted to the Web Machine Learning Community Group for MCP security standardization.
Six Areas of Original Research
Cognitive detection, hardware-isolated enforcement, self-approval prevention, session-aware correlation, security knowledge graph, and runtime-neutral threat adaptation.
OWASP LLM Top 10 Aligned
Detection and governance mapped to all OWASP LLM Top 10 threat categories.
By The Numbers
The depth behind the platform.
Ready to Take Control?
Start with the free community tier, or apply for our design partner program for hands-on onboarding.
Questions? Reach us at info@shrikesecurity.com