Enterprises are handing AI agents the keys to their data, code, and systems. McKinley Labs builds the infrastructure to do that safely: visibility into every agent, governance over every prompt, and enforcement all the way down to the kernel.
Every agent a developer ships can reach databases, email, repositories, and internal APIs. Data protection that works at rest and in transit stops the moment a model reads it. The controls built for the last era weren't designed for software that decides for itself.
Employees paste sensitive data into unapproved AI tools, and nobody finds out until after the incident.
Agents ship without security review, with broad tool access and no registered owner.
Malicious MCP servers and tampered tool definitions can redirect an agent toward exfiltration.
When the auditor asks what a model saw and what an agent did, most organizations have no record to show.
Each product secures a different layer of how AI runs in the enterprise. They work on their own, and they're built to work together.
Catch shadow AI before it becomes a breach.
Continuous visibility into every AI agent in the enterprise: what it can access, how it behaves, and where it drifts from policy.
Enterprise AI, without the trade-off.
Governs AI at the moment of inference. It classifies every prompt, keeps regulated work inside your boundary, routes the rest to the cheapest capable model, and proves every decision.
For agents that can escape their sandbox.
Security that follows an agent from application intent down to kernel enforcement, with a policy engine that learns from every decision.
Bastion figures are measured in-house; independent penetration testing and SOC 2 are in progress.
These products come from decades of running technology where failure makes the news, and from sitting on the board side of the table when it does.
When a control can't decide, the default is to block, not to allow. Regulated data never leaves the boundary on a guess.
Every decision goes into a hash-chained record. Evidence for an auditor should come from a button, not a fire drill.
Self-hosted by design. Your prompts, your data, and your keys stay on infrastructure you control.
Founder, McKinley Labs · Board member and Technology Committee Chair, Equifax · Founder, Great Falls Ventures
John has spent three decades running technology where the stakes are highest. Today he writes the code himself.
He was Chief Technology Officer at News Corp, AOL, Merrill Lynch, and GE Capital, leading engineering organizations of thousands. At Merrill Lynch, his team delivered the firm's first robo-advisor in 2002. He began his career at Ernst & Young, where he became a partner and helped establish the firm's US computer security practice.
Since 2008 he has served on the Equifax board, where he chairs the Technology Committee and oversees AI security, AI in software engineering, and the company's cloud transformation. Through Great Falls Ventures he has backed AI companies since 2007, starting with Powerset (acquired by Microsoft and built into Bing).
He founded McKinley Labs in 2025 to build the security infrastructure he wanted as a board member and couldn't buy.
Through Great Falls Ventures, John has backed early-stage companies in AI, search, security, and communications, from seed stage to acquisition.
Hands-on tests of what AI can actually do, and what it means for the companies building and buying it.
What happened when AI ran a full market-entry analysis, and what that means for strategy work.
An investor's map of which businesses AI actually disrupts, and which ones the market is mispricing.
A real-world test of handing an autonomous agent a credit card and an 8-day trip to plan.
For pilots, beta access, partnerships, or investor conversations, reach out directly.