Identity & Access
Entro Security Alternatives: Secrets-Centric NHI Governance
Evaluating alternatives to Entro Security for secrets-centric non-human identity governance and how it compares to broader NHI platforms.
Blog
Insights & updates
AI agent security, identity, governance, cost, and the engineering behind the control plane.
AI Agent Security
The Lethal Trifecta: A Framework for Agent Data Exfiltration
The lethal trifecta names the three properties that make prompt injection dangerous: private data, untrusted content, and external communication.
Identity & Access
Token Exchange for Agent-to-Tool Authorization
OAuth 2.0 Token Exchange (RFC 8693) is the standard mechanism for on-behalf-of agent authorization. Learn the flow, the claims that matter, and the constraints that keep delegation from becoming escalation.
AI Agent Security
ForcedLeak and PipeLeak: Agentforce Breaches Explained
Two 2025-2026 prompt-injection disclosures in Salesforce Agentforce, ForcedLeak and PipeLeak, show how form data becomes a data-exfiltration path.
AI Governance & Compliance
Public Agent Reputation and k-Anonymity
A public reputation lookup for agents leaks information unless it is designed carefully. Learn the anti-enumeration contract, why k-anonymity thresholds matter, and how reputation differs from trust.
AI Governance & Compliance
How to Audit AI Agent Activity
What to log for AI agents, how to keep audit trails credible and tamper-evident, and how to reconstruct any agent action for compliance or forensics.
Platform & Operations
LLM Observability Tools for Security and Compliance Teams
Langfuse, LangSmith, Arize Phoenix, and Braintrust evaluated for audit-trail and compliance readiness — not eval quality.
AI FinOps
AP2 Explained: How Google's Agent Payments Protocol Works
AP2 authorizes AI agent purchases through signed Mandates, not a single API call. Version, governance, and mechanism as of April 2026.
Identity & Access
mTLS, SPIFFE, and Workload Identity for Agents
Workload identity gives an agent's runtime a cryptographic identity with no secret to steal. Learn where SPIFFE and mTLS fit, what they do not cover, and how they compose with agent-level identity.
Identity & Access
Oasis Security Alternatives: NHI Lifecycle Management
Evaluating Oasis Security alternatives for non-human identity lifecycle management, including how it compares to Astrix and platform-native options.
AI Agent Security
Agent Sandbox Escape: Containing Code Execution
Giving an agent a code interpreter means running attacker-influenceable code in your infrastructure. Learn the escape paths that matter and how to build a sandbox that fails safely.
AI Governance & Compliance
What FINRA and the SEC Expect From AI Agents in Finance
FINRA's 2026 oversight report and existing SEC rules set concrete expectations for AI agents at broker-dealers and RIAs — here is what they actually require.
AI Agent Security
Insecure Output Handling: When Agent Output Becomes an Injection Vector
Model output is untrusted input to whatever consumes it. Learn how agent output causes XSS, SQL injection, command execution, and log poisoning downstream — and how to bound it.
Platform & Operations
MCP STDIO RCE Vulnerability Wave (2026) Explained
OX Security's April 2026 disclosure found a design-level flaw in Anthropic's MCP SDKs enabling remote code execution via STDIO transport.
AI Agent Security
Are Agent Skills Safe? A SKILL.md Security Checklist
Agent Skills bundle scripts an agent executes at high trust, and the script's own output — not its source — is what the model ever sees. Vet before enabling.
Identity & Access
How to Give an AI Agent Its Own Identity
Why AI agents need first-class identity and how to model it so every action is attributable, governed, and revocable without disrupting other systems.
Platform & Operations
LiteLLM Enterprise Alternatives: Beyond Self-Hosting
When LiteLLM's self-hosted model stops scaling and what teams evaluate instead — Portkey, Kong AI Gateway, Cloudflare AI Gateway, and TrueFoundry.
Identity & Access
Sub-Agent Delegation with Scoped Tokens
An orchestrator that shares its credentials with sub-agents has no delegation model. Learn how to pass narrowed authority down a chain, bound the depth, and keep attribution intact.
AI Agent Security
Securing AI Agents in CI/CD Pipelines
An agent in your pipeline runs with deploy credentials and reads attacker-submittable content. Learn why pull-request-triggered agents are the sharpest case and how to constrain them.
AI Agent Security
WitnessAI Alternatives for Runtime AI Access Control
Evaluating alternatives to WitnessAI for runtime AI access control and compliance — what the category covers and how peers compare.
AI Governance & Compliance
US State AI Laws Compared: SB 53, RAISE, TRAIGA, Colorado
California SB 53, New York's RAISE Act, Texas TRAIGA, and Colorado's amended AI Act target different companies — here is who actually has to comply.
AI Agent Security
Voice Agent Security Risks
Voice agents add a biometric identity channel that can be synthesized, an audio input channel that carries injection, and a real-time path with no room for review. Here is what changes.
Platform & Operations
Agent Evaluations: Catching Quality Regressions Before Users Do
Agents regress silently when prompts, models, tools, or data change. Learn how to build an evaluation harness that catches it — scoring methods, what to measure, and where evals belong in the pipeline.
Platform & Operations
LLM Gateway Comparison 2026: Security and Governance
Portkey, LiteLLM, Kong AI Gateway, and Cloudflare AI Gateway compared for routing, spend control, and security — how to shortlist for your team.