The Short Answer First

If you are evaluating an enterprise AI proxy or AI data loss prevention tool, 3 products come up most: Nightfall, GitHub Copilot Enterprise, and Pretense. They solve different problems with different architectures. The choice depends on which risk you are trying to eliminate.

• -Nightfall: cloud DLP. Scans outbound API traffic for sensitive data. Detects after the fact.
• -Copilot Enterprise: Microsoft IDE assistant with enterprise contract terms. Trusts Microsoft with source code.
• -Pretense: local AI firewall. Mutates identifiers before transit. The provider sees only stand-in names.

This teardown walks through 8 dimensions that matter to a CISO making the call. Zero paid placements, zero spin. We run Pretense. We compared honestly.

Dimension 1: What Leaves Your Network

This is the most important difference, and the 1 most vendor sheets hide.

Nightfall: the prompt with all identifiers leaves your network. Nightfall scans the traffic on its cloud endpoint and logs violations. If the prompt contained proprietary code, that code already reached OpenAI before Nightfall saw it. Nightfall is a detective control, separate from prevention.

Copilot Enterprise: the prompt with all identifiers leaves your network. Microsoft's contract says they will refrain from training on your data. You are trusting the contract. If Microsoft is breached, subpoenaed, or changes the policy, the real code is in their data center.

Pretense: only synthetic hashes leave your network. Real identifiers stay on your machine. The mutation map is local. If the provider is breached, the attacker sees _fn4a2b in place of getUserToken. This is a preventive control by math, independent of any contract.

For a CISO who has to answer what leaves the network, the 3 answers are: all of it, all of it with a promise, or synthetic hashes.

Dimension 2: Architecture

Nightfall: SaaS proxy. Traffic routes from your developer laptop to Nightfall cloud to the AI provider and back. Nightfall sees all traffic in clear text. Latency overhead is 100 to 300 ms per request in our testing.

Copilot Enterprise: Microsoft first party. Direct connection, skipping any third party proxy. Latency is identical to consumer Copilot. Data crosses into Microsoft data centers.

Pretense: local proxy on the developer laptop. Traffic routes from laptop through the local Pretense process to the provider. The traffic stays between you and the provider, with zero third parties in between. Latency overhead is 1.8 ms per request in our benchmark (the Rust scanner rewrite).

The architecture choice decides the trust model. SaaS proxies require trusting the proxy vendor with clear text code. First party requires trusting the AI vendor. Local requires trusting open source code running on your own machine.

Dimension 3: Audit Log

Nightfall: logs violations at the SaaS boundary. You get a dashboard. You get CSV export.

Copilot Enterprise: Microsoft admin center provides usage reports. Prompt content sits outside the standard reports. You can request enterprise data controls for deeper access, paid add-on.

Pretense: every mutation logged locally with timestamp, user, file path, identifier, synthetic hash, model, and provider. pretense audit shows the log. pretense audit --format csv produces evidence for SOC2 and EU AI Act reviews.

For compliance teams evaluating enterprise AI proxy options, the audit log detail matters. Nightfall logs what was flagged. Pretense logs what was mutated. Copilot logs what was generated. The 3 logs answer different compliance questions.

Dimension 4: Pricing

Nightfall: starts around 15 dollars per developer per month for basic DLP. Enterprise tier with code coverage is 45 dollars per developer per month.

Copilot Enterprise: 39 dollars per developer per month. Includes the Copilot assistant.

Pretense: 23 dollars per developer per month on the Pro tier. Enterprise tier with SSO, SIEM export, and custom policies is 79 dollars per developer per month. Free tier for solo developers and small teams.

The honest math: Nightfall plus your AI tool costs 80 to 100 dollars per developer per month. Copilot Enterprise alone is 39 and leaves the IP exposure question open. Pretense plus your AI tool of choice is 23 plus the AI cost. Pretense adds a layer on top of the AI tool you already use.

Dimension 5: What Gets Protected

Nightfall: API keys, secrets, PII, PCI data, some code patterns. Detects strings that match known patterns.

Copilot Enterprise: client side coverage is absent. Microsoft contract covers the provider side. Your source code is in the provider boundary.

Pretense: function names, variable names, class and interface names. Plus the secrets engine layer catches API keys, tokens, and credentials and swaps them for stand-ins that stay in place in the answer. Comments and string literals are preserved verbatim (we keep what the LLM needs to read).

Different protection scope. Nightfall is broad pattern matching. Copilot Enterprise is a trust relationship. Pretense is narrow identifier mutation plus secret detection. For code work, identifier mutation is the control that blocks IP reconstruction.

Dimension 6: Language Coverage

Nightfall: language agnostic pattern matching. Reads code as text, outside its structure.

Copilot Enterprise: all languages Copilot supports.

Pretense: 8 languages with AST-aware scanning. TypeScript, JavaScript, Python, Go, Java, C Sharp, Ruby, Rust. Pattern matching for others.

AST-aware matters for code work. Pattern matchers miss identifiers in template strings, destructuring, and generic types. AST scanners catch them. For teams heavy in TypeScript or Go, the AST path produces cleaner mutation.

Dimension 7: Deployment

Nightfall: SaaS. Sign up, configure routes, done. 15 minutes.

Copilot Enterprise: Microsoft 365 admin enablement. Existing Microsoft enterprise agreement required. 1 to 3 weeks depending on the existing contract state.

Pretense: curl install.sh and pretense start. 30 seconds on a laptop. Team wide rollout with CI gates and SSO is 1 day.

Deployment time matters less than it looks. The real question is what breaks when deploying. Nightfall leaves everything intact, it is a cloud proxy. Copilot Enterprise requires contract work. Pretense requires an environment variable change in the IDE.

Dimension 8: What Happens When Your Provider Is Breached

This is the thought experiment that separates preventive from detective controls.

Nightfall scenario: OpenAI or Anthropic suffers a breach. Attacker exfiltrates 90 days of API logs. Your prompts are in the logs. Your proprietary code is in the logs. Nightfall's reach ends before the provider's logs, so those logs stay as they are. You are exposed.

Copilot Enterprise scenario: Microsoft suffers a breach affecting AI service logs. Your source code is in the logs. Microsoft notifies you. The data is already out. You are exposed.

Pretense scenario: provider suffers a breach. Attacker exfiltrates 90 days of API logs. Your prompts are in the logs. The prompts contain synthetic hashes in place of real identifiers. Lacking your local mutation map, the attacker holds useless hashes. You stay protected.

This is the math argument for mutation over redaction and for local-first over cloud proxy. When the provider is the threat, protection has to happen before the data reaches the provider.

When Each Tool Wins

Nightfall wins for general DLP across file uploads, email, Slack, and other SaaS traffic. It is a broad enterprise DLP play. If your threat model is employees sharing SSNs in Slack, Nightfall is the right answer.

Copilot Enterprise wins if you are a Microsoft shop, your CISO is comfortable with Microsoft as a data processor, and your codebase falls short of crown-jewel status. Fastest developer experience. Zero client side work.

Pretense wins if your threat model is proprietary code reaching any LLM provider, you operate under EU AI Act or SOC2 with specific AI logging requirements, or you run heterogeneous tools (Claude Code, Cursor, Copilot, Codex). Pretense is provider agnostic.

The Honest Weakness of Each

Every tool has tradeoffs. Here are the weaknesses we see.

Nightfall weakness: detective, after the fact. The data has already left by the time Nightfall sees it. Good for compliance evidence, weaker for IP protection.

Copilot Enterprise weakness: single provider lock in. The enterprise contract only covers Microsoft AI services. Your team using Claude or Cursor is outside the control.

Pretense weakness: identifier only mutation. String literals and comments pass through as written (by design, for output quality). If your IP is encoded in string constants more than identifiers, Pretense protects less of it. Narrow coverage, deep control.

The CISO Buying Question

The question that separates these 3 tools: what is the worst case outcome?

• -Nightfall: a violation report after the fact.
• -Copilot Enterprise: a contract promise.
• -Pretense: synthetic hashes in the provider log.

If you need a contract, buy Copilot Enterprise. If you need broad pattern DLP, buy Nightfall. If you need a preventive control on proprietary code reaching any LLM provider, buy Pretense.

How I run Pretense on my own code

I build Pretense with Claude Code, and my sessions run through it. Here is the setup I give a new engineer, in order.

1. -Run the agent through the proxy. Type pretense run claude where you would type claude. It starts a local proxy on port 9339, points Claude Code at it and stops the proxy when the session ends. Detected secrets and PII leave the laptop as stand-in tokens.
2. -Put hooks on every repo. pretense install adds a pre-commit and a pre-push hook. A key that never lands in git is a key an agent never reads.
3. -Scan before an agent reads the repo. pretense scan path . lists what it finds. In CI, pretense scan ci exits 0 when clean, 2 on findings and 3 when it examined nothing. Treat 3 as a failure.
4. -Preview the swap. pretense review . shows what would be mutated. pretense mutate <file> --preview prints one file mutated and leaves the file on disk as it was.
5. -Round-trip a file you need to share. pretense mutate <file> --map <map> swaps the secrets in place. pretense reverse <file> --map <map> turns it back into the original, byte for byte, from the encrypted map on your machine. We run that round trip on real files before every CLI release and compare sha256 hashes.

One thing I learned the hard way: inside a session the agent sees stand-ins, so a file the agent writes can hold a stand-in where you expected a real value. Grep what the agent wrote before you ship it.

What Pretense will not do is put a secret back into the model's answer. Code identifiers come back byte-exact. Secrets and PII stay as stand-ins in the response. That is deliberate: a prompt-injected model can echo a token into a link, and reversing it there would hand over the real key.

What this means if you buy security

The outcome: your engineers keep their AI coding tools, and detected secrets and PII leave each laptop as stand-in tokens.

• -The control sits on the endpoint. The swap runs on the developer's machine before the request leaves. No shared gateway holds every team's keys.
• -You get evidence, not a memo. pretense audit --format csv exports every mutation event. Add --framework SOC2 to keep only the events that map to that framework.
• -Check it on your own code. Detection is pattern and entropy based, and coverage varies by data type. Run pretense review . on a real repo and read what it catches before you sign off.
• -Start with one team. One repo, pretense run claude, one week. Then read the audit log with the team lead.

Try it on your own repo: create a free account, then run npm i -g @pretense/cli and pretense run claude. If you need a security review first, talk to me.