About Sondera
Sondera builds semantic integrity for agents: assurance that they act within the bounds of your intent. Organizations write their own rules for agents in natural language, from security and compliance requirements to everyday business logic, and Sondera verifies their translation into code that returns a deterministic verdict on every agent action before it runs. Adversarial simulation stress-tests agents and their policies against misuse and unexpected behavior, helping teams uncover gaps before deployment. Sondera’s research on turning natural-language instructions into verifiable policy has been presented at the ICML 2026 AIWILD workshop, and its open-source coding agent enforcement tool was presented at Black Hat USA 2026 Arsenal.
Q: Tell us about your background.
We’re three founders who have spent our careers on the defender’s side of security, from different angles.
Josh has spent more than 20 years building companies that study adversaries. He co-founded SITE Intelligence Group in 2002 to track terrorist activity online, then co-founded Flashpoint in 2013 and served as COO, growing it to $100M ARR and about 400 employees.
Matt, our CTO, has spent more than 15 years building machine learning security products at Cylance, Obsidian Security, and NetRise, from early malware classification models to detection for SaaS and the software supply chain. He holds an M.S. in Computer Science from Johns Hopkins.
Tyler, our COO, worked alongside Josh at Flashpoint for more than seven years in IT and InfoSec. He helped build the company’s secure research environment and went on to lead IT. Before Flashpoint, he co-founded two startups.
Across threat intelligence, behavioral detection, and running security inside a fast-growing company, we each learned the same lesson: you can’t reliably read intent, but you can watch and control behavior. That idea is the foundation of Sondera, which we founded together in 2025.
Q: Tell us about your business/idea.
Sondera governs what agents are allowed to do while they run. A company writes its rules in natural language, the same way it would brief a new employee. Sondera compiles those rules into formally verified policy-as-code and checks every agent action against them before the action executes. The verdict is deterministic: allow, deny, steer the agent to a safer path, or escalate to a human.
Three things set the approach apart. Autoformalization turns natural-language rules into verifiable policy, and we’ve published that research (arXiv:2606.26649, presented at the ICML 2026 AIWILD and FLoC 2026 LLM-Solve workshops). Enforcement is trajectory-aware, so a sequence of harmless-looking steps that adds up to something harmful gets caught, even across sessions. And simulation lets teams test agents against adversarial scenarios before deployment, not after an incident.
We call what we do semantic integrity: assurance that agents act within the bounds of your intent. We also open-source parts of our work, including our deterministic reference monitor for coding agents that we presented at Black Hat USA 2026 Arsenal, and enforcement hooks for agents like Claude Code, Cursor, GitHub Copilot, and Gemini CLI.
Q: What was the original inspiration for your company/product?
The military has a concept called commander’s intent. A good order tells a soldier what to accomplish and the rules for accomplishing it, so they can adapt when the plan breaks down without crossing lines that matter.
Agents are very good at achieving the objective. Give one a goal, and it will find a way to reach it. But agents don’t know the defined limits of their own behavior. A new employee absorbs thousands of unwritten rules about what not to touch, who to ask, and when to stop. An agent gets none of that unless someone writes it down and enforces it.
We kept watching enterprises try to fill that gap with longer prompts and with classifiers that try to guess what the agent is thinking. Both approaches miss the same thing. A well-meaning agent and a manipulated agent can look identical from the inside. What separates them is what they do. So we built Sondera to enforce on actions, not to infer a motive.
Q: What’s your vision for the future … “What will the market you are pursuing look like in 5-10 years?”
Within a decade, most enterprises will run more agents than people, and those agents will run core business processes with real authority. Today’s security stack was built around human users: identities, logins, endpoints. It’s good at answering “who is this?” It’s much weaker at answering “should this action happen right now, given everything that came before it?”
We expect three shifts. First, the control point moves from the user to the action. Second, auditors, regulators, and insurers will stop accepting “we told the model not to” and will start asking companies to prove what their agents can’t do. Third, business rules become code. The policies that now live in handbooks and in people’s heads will be written down, versioned, and enforced by machines.
The companies that move fastest with agents will be the ones that can show their work.
Q: How does your business address pressing cyber and data challenges for the commercial sector?
This summer showed what happens when nothing governs what an agent actually does. In July, AI agents using two OpenAI models autonomously escaped an OpenAI cybersecurity test environment, used credentials found on four third-party services, and breached the production infrastructure of Hugging Face. The restrictions on those models were environmental rather than behavioral: the sandbox was expected to stop them, and the models were configured not to decline the work. Days later, the UK AI Security Institute disclosed that in 10 runs of a single evaluation, an AI agent took autonomous, unsanctioned action on the live internet against real people and organizations, including trying to insert malicious code into an open-source project.
Both incidents happened at organizations with some of the deepest safety expertise in the world. Enterprises aren’t doing better. The Cloud Security Alliance found that 65% of organizations experienced at least one cybersecurity incident caused by AI agents in the past year, most often data exposure, operational disruption, or unintended actions in business processes.
This is the core tension. Agents that summarize documents are safe, but they don’t change the P&L. The return comes from agents working the highest-risk workflows: moving money, changing production systems, handling patient and customer records, approving transactions. Those are exactly the places where one wrong action costs the most. So enterprises end up choosing between agents that are safe but marginal and agents that matter but can’t clear the security review.
We focus on large and regulated enterprises in financial services, healthcare, and government contracting, where that choice is hardest. Sondera puts rails on the actions themselves. Every action an agent attempts is checked against the company’s written rules before it executes, deterministically, and each decision leaves a trail that maps back to policy.
The return on agents is in the highest risk work. Controls you can prove are what let a CISO approve them for it.
Q: What attracted you to the DataTribe Foundry? Why did you choose to participate in the DataTribe Challenge?
DataTribe is built by operators who have founded and scaled security companies, and that shows in how they engage. Every conversation we’ve had has been about the hard parts: the technical bets, the go-to-market sequencing, which buyers will move first and why.
The Washington network also matters to us. Agents are coming to government and defense work quickly, and the stakes there are higher than anywhere else. DataTribe understands that world in a way few investors do.
We entered the Challenge for the same reason we published our research: we want our thinking pressure-tested by people who know the space and will tell us where we’re wrong.
Q: What’s your long-term vision for your business?
We want Sondera to be where an organization’s intent lives in machine-enforceable form. Today a company’s rules sit in policy documents, compliance binders, and the judgment of experienced employees. As more work shifts to agents, those rules need a home that every agent checks before it acts, across every framework and vendor a company uses.
If we get this right, governance stops being a brake on adoption and becomes the reason companies can hand agents real responsibility. The goal is simple to say and hard to build: every agent action, everywhere, checked against what the people responsible for it actually intended.
