USE CASE 01
Proposals and program docs
Capture and proposal teams draft against the RFP with AI that's governed at every step, the identifiers your policy flags screened, and the whole run sealed to your record.
Defense
AI on controlled work, on your hardware, under your keys.
Verillian governs what AI may do with controlled information, and it runs inside your own boundary. It seals every captured action into a record under your key, and it can run fully disconnected when a program calls for it.
Inside the boundary
One paste can be an export.
The case for AI on a program writes itself: a technical data package summarized in minutes, a proposal volume drafted against the RFP by dinner, test reports read for anomalies overnight. The case against it is one sentence long. Under ITAR and EAR, controlled technical data pasted into a public chatbot may have just left the country. Nobody can bring it back. So the useful tool sits unused, or worse, gets used quietly. The way through isn't a stronger memo. It's governance that runs where the data is allowed to live, under rules that hold, with a record you could hand your program office.
On the program
The work AI can do inside the fence.
Real program work, on controlled data, with governance and the record running right beside it, connected or not.
USE CASE 02
Local models, disconnected
Run self-hosted models on a network with no outside connection, with the full policy and record layer working beside them. Going disconnected doesn't mean going dark.
USE CASE 03
Evidence for CMMC
When an assessor asks how AI use is controlled and evidenced, the policy is written down, the record is sealed, and both live on your infrastructure, ready for your System Security Plan.
The controls
Controlled data, controlled AI.
The rules for controlled unclassified information are blunt on purpose: know where the data is, control who touches it, prove both. The layer speaks that dialect natively.
Air-gap capable, genuinely
The whole layer runs with no outbound connection at all: the decisions, the sealing, and the console. That's not a reduced mode. It's the product as designed.
Local models, inside the boundary
Self-hosted models run where nothing phones home, and coverage binds to the endpoints your deployment names, so bringing a local endpoint under the same declared policy is configuration rather than a new product.
Refused before anything moves
Each AI action is decided against declared policy on the device, and a governed tool that touches export-controlled data without permission is refused before it runs, not written up after.
Marked data treated like marked data
Policy can hold AI to the folders and shares where it belongs, per program, per team, with limits an agent inherits and can't widen from the inside.
Answers for the flow-down questions
When a prime or a program office asks how AI is governed on their data, you answer with policy in writing and a sealed, testable record instead of assurances.
Rules per program, per role
An engineer on a controlled program and a subcontractor on the unclassified side each carry their own declared policy, applied the moment you set it, so the separation your program plan describes holds on the device.
Aligned to NIST 800-171 and CMMC
Access, audit, and media protection, the families your assessment already covers, line up with what the layer enforces on every endpoint in scope.
Aligned, not certified
Where this sits in your assessment.
Certification stays with your organization: CMMC is assessed against your whole environment, and export control is a program you run, not a product you buy. Verillian's role is the enforcement point and the evidence, aligned to NIST 800-171's controls for CUI and built to operate where connections aren't allowed.
CMMC
practices
practices
NIST SP 800-171
protecting CUI
protecting CUI
ITAR and EAR
export-controlled technical data
export-controlled technical data
Your organization holds its certifications and its export obligations. Verillian supplies enforcement and evidence inside the boundary.