raxIT Labs is an AI governance and security company for engineering teams putting AI agents into production. It helps those teams understand how their agents could fail and control them before and after release, so that risk owners have evidence they can sign off.
The work is grounded in research: the company tracks how AI systems have failed in the real world and turns those failures into controls.
At A Glance
| Vendor | raxIT Labs |
|---|---|
| Category | AI agent governance, security assessment and runtime policy |
| Deployment | Hosted app at app.raxit.ai; runtime SDK for agent tool calls |
| Agentic AI | AI agent discovery, threat modelling and runtime tool call checks |
| Founded | December 2025, Sydney |
| Market classification | AI Model Security |
What RaxIT Labs Does
Teams building agents often cannot say how many they have, what tools each can call or which controls apply. raxIT Labs works through four stages: inventory, risk review, stop and measure. It starts from the code where agents are built, reviews each agent against known failure patterns and against NIST AI RMF, the EU AI Act and ISO 42001, fixes what it finds, and then keeps measuring whether the controls hold, with an audit trail, root-cause analysis and attack success rate. Every control depends on first knowing which agents exist.
Products
RaxIT App
The raxIT App is the governance and security platform, hosted at app.raxit.ai. It connects to GitHub repositories to build the agent inventory and AI Bill of Materials, runs the threat modelling and control mapping, writes remediation specifications and architecture fixes as pull requests, and tracks control implementation over time. Security, risk and engineering leads share one record of each agent’s risks and fixes.
Raxit Runtime
For agents already running, the raxit runtime checks each tool call against a policy file before it executes, so a call that breaks policy never reaches the target system. It is in early access.
AI Security Assessment
Teams that want a first view of their exposure can have a single GitHub repository scanned and receive a report by email, mapped to the EU AI Act, NIST AI RMF and ISO 42001.
Raxit-Sdk
The SDK, published on PyPI as a “Security scanning SDK for AI agent applications”, performs static analysis of agent code and outputs an Agent Assets Schema. It ships under a proprietary licence and is in beta.
- Extractors for LangGraph, CrewAI, AutoGen, Swarm, PydanticAI, LlamaIndex, Google ADK and others
- Packages for Python, Node.js and Rust
AI Security Threat Intelligence
This public database links AI incidents, threat patterns and controls. It draws on the AI Incident Database, AVID, NVD, MITRE ATLAS and UK AISI, backs each threat pattern with evidence, and comes with a 58-rule open-source scanner.
Labs Research Projects
| GrayZoneBench | An open-source safety benchmark for prompts where the right answer is neither a refusal nor full compliance. |
|---|---|
| DirePhish | An incident-response simulation engine that clones an organisation as AI agents, adds a threat actor and runs the attack many times to show a range of likely outcomes. |
How It Works
| Component | What it does |
|---|---|
| Repository scanning | The platform, the SDK and the assessment work from source code in GitHub repositories, so agents are found where they are built, and findings return to engineers as pull requests. |
| Threat patterns | Each source in the threat intelligence record becomes a threat pattern, linked to the incidents that show it and the controls that address it. It is a record of past failures rather than a live feed of indicators such as IP addresses or file hashes, and it updates as its underlying sources do. |
| Runtime policy | At execution time the runtime sits between the agent and its tools and evaluates every call against the policy file. |
Company Background
| Founded | December 2025. |
|---|---|
| Headquarters | Sydney, Australia. |
| Leadership | Adesh Gairola, Co-Founder and CTO. |
| Experience | The team has run a reported 150 or more enterprise AI audits. |
Note: This overview is compiled from raxIT Labs’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.