AI Agent Security
How to Run an AI Agent Security Incident Tabletop Exercise
A guide to designing and facilitating a tabletop exercise for an AI agent security incident: roles, injects, a 90-minute run sheet, and the debrief.
Blog
Insights & updates — page 2
AI agent security, identity, governance, cost, and the engineering behind the control plane.
AI Governance & Compliance
How to Write an AI Agent Acceptable Use Policy
The sections a usable AI agent acceptable use policy needs, why a chatbot AUP isn't enough, and a draft-to-review process for authoring one.
AI Agent Security
LangChain and LangGraph CVEs: What Deployments Need to Know
Three CVEs disclosed in March 2026 exposed files, secrets, and checkpoint data across LangChain and LangGraph. What they are and how to verify you're patched.
AI Governance & Compliance
Microsoft Agent Framework Is GA: Governance After the Merger
Microsoft Agent Framework went GA as the successor to AutoGen and Semantic Kernel. What its design choices — and its own disclaimers — mean for governance.
AI Governance & Compliance
n8n's AI Agent Node Is Core Infrastructure Now
n8n's AI Agent node bundles a model, memory, and tools into one node holding live credentials — and a CVSS-10 flaw showed exactly what that exposes.
AI Agent Security
NemoClaw DNS Rebinding: One Webpage Could Rewrite the Model
NVIDIA NemoClaw shipped Ollama unauthenticated on 0.0.0.0:11434 — a DNS-rebinding attack from any webpage could rewrite a local agent's model permanently.
AI Agent Security
OpenAI Agents SDK Guardrails: What They Cover, and the Gaps
OpenAI Agents SDK guardrails validate input and output — but only for specific agents in a handoff chain. What the docs disclose, and what to add.
AI Agent Security
Prompt Injection vs. Jailbreaking: The Practical Difference
Prompt injection hits the application layer; jailbreaking hits the model's safety alignment. OWASP groups both under LLM01 — here's the practical difference.
AI Governance & Compliance
SOC 2 vs. ISO 42001 for AI Agents: What Each One Proves
SOC 2 is an attestation, ISO 42001 a certification — they prove different things about an AI agent program. A decision framework for which to pursue first.
AI Governance & Compliance
Governing Atlassian Rovo Agents
Rovo agents inherit Jira and Confluence permissions by default, but Forge-based extensibility and third-party connectors create a separate control surface.
AI Agent Security
Governing Windsurf Cascade: Agent Access to Your Repo
Windsurf's Cascade agent edits across files and runs terminal commands from inside the IDE. Here is what to scope before letting it loose on a real repository.
AI Agent Security
Cloud-Executed Coding Agents: Governing Replit Agent
Replit Agent builds, runs, and deploys apps in a hosted cloud workspace with its own stored secrets. Here is the blast radius and where control has to sit.
AI Agent Security
Governing GitHub Copilot Agents: Repository-Level Risk
Copilot's coding agent works issues autonomously and opens pull requests from a cloud sandbox. Here is the repository-level risk and how to scope it.
AI Agent Security
Governing Gemini CLI: Controls for Terminal-Resident Agents
Gemini CLI runs in the terminal with local file and shell access. Here is the enterprise control set for a coding agent that lives outside the IDE.
AI Agent Security
Governing Autonomous SWE Agents Like Devin
Autonomous SWE agents like Devin work tickets end to end in their own sandbox. Here is what changes when a coding agent needs no human per step.
AI Agent Security
Governing Cursor in an Enterprise Codebase
Cursor's agent mode edits files and runs terminal commands with full developer privileges. Here is the blast radius and the controls that actually contain it.
AI Agent Security
Governing Claude Code in Enterprise Environments
Claude Code runs as a terminal agent with file, shell, and MCP access on the developer's machine. Here is how to scope and audit it at enterprise scale.
AI Agent Security
Governing Amazon Q Developer Agents
Amazon Q Developer's agentic features touch your IDE, CLI, and AWS account. Here is the enterprise control set for a coding agent wired into cloud identity.
AI Agent Security
Code Review Controls for AI-Generated Pull Requests
AI-generated pull requests arrive with plausible summaries and passing checks, which erodes review attention. Here is how to keep review rigorous.
AI Agent Security
Preventing Secrets Leakage Through AI Coding Agents
Coding agents read config files, run shell commands, and log tool arguments verbatim — three distinct paths for a secret to leak. Here is how to close each one.
AI Agent Security
Protect AI Alternatives: Evaluating AI Security Platforms
What Protect AI's AI/ML security posture category covers, where it stops, and how to evaluate alternatives for securing agents in production.
AI Agent Security
Agentic Commerce Fraud: Stolen Cards Through AI Agents
AI shopping agents create a new carding target: not the card, but the delegated payment authority. What HUMAN Security has documented, and what to instrument.
AI Governance & Compliance
Does Your Cyber Insurance Cover What Your AI Agent Does?
Cyber policies largely cover attacks that use AI, not losses your own agents cause. The AI-agent coverage market is still forming as of August 2026.
AI Governance & Compliance
Agent Sprawl: 150,000 Agents Is a Governance Problem
Gartner projects 150,000+ agents per Fortune 500 enterprise by 2028, up from under 15 in 2025. Why sprawl is a different problem than shadow AI.