Blog

• Agentic AI Risk Management: A Six-Step Programme Built on the NIST AI RMF — A six-step agentic AI risk management programme from inventory to incident response, tied to the NIST AI RMF and the Playbook, with the option many teams forget: avoid the agent.
• Secrets Management for AI Agents: Keeping Credentials Out of Configs and Prompts — Agent configs and prompts now collect the credentials that malware targets. Learn six moves to keep secrets out, and why rotation, not detection, is the bottleneck.
• OAuth for AI Agents: Scopes, Token Exchange and Per-Action Authorization — Use OAuth to bound what an agent token can do, record who the agent acts for and limit theft damage. Learn the grants, token exchange, scope design and why scopes are too coarse.
• Shadow AI: How to Detect Unsanctioned AI Agents and Tools on Endpoints — Shadow AI is an endpoint inventory problem. Learn which signals to collect, how to phase a 90-day programme, and why managed configuration beats chasing traces.
• AI-SPM vs CSPM vs DSPM: What AI Security Posture Management Covers — AI-SPM borrows its name from cloud and data posture management but covers different ground. See what it sees, what it misses and when a dedicated product pays off.
• AI Security Controls by Layer: What Each Control Buys You and What It Does Not — A seven-layer catalog of AI security controls, each row stating what it buys you and what it does not, with a case for choosing controls that fail closed.
• AI Prompt Injection Attacks: Direct, Indirect and What Actually Reduces the Damage — Prompt injection has two entrances and one root cause. Learn how direct and indirect attacks differ, what lowers the odds, what limits the damage, and why sorting by writer beats sorting by channel.
• Agentic AI Security Risks: A Copyable Risk Register With Scoring — Twelve agentic AI security risks in a register you can copy, with exposure and impact scoring, proof to attach and a case for scoring paths instead of categories.
• How to Secure AI Agents: Ten Controls in Build Order — A short, ordered list for securing AI agents, grounded in NCSC and OWASP guidance. Each control comes with the proof worth keeping, and the order puts limits before detection.
• Agentic AI Governance and Compliance: A Complete Guide for Security Teams — Governance makes agent controls provable. Learn the frameworks, one evidence set that serves several of them, and why the EU delay should not delay your programme.
• AI Agent Runtime Security: A Complete Guide to Policy, Isolation and Containment — Most agent incidents happen at run time, between a decision and its effect. This guide covers seven controls, incident patterns and why walls beat prompts.
• MCP Security: A Complete Guide to Securing the Model Context Protocol — An MCP server runs code, holds credentials and feeds text to your model. This guide covers the 2026-07-28 specification, seven risks with their controls and a containment-first rollout.
• AI Agent Identity and Non-Human Identity Security: A Complete Guide — Every agent control depends on knowing which agent acted, for whom. This guide covers identity designs, the credential lifecycle, OWASP's NHI risks and what to ask vendors.
• AI Security Posture Management: Finding Shadow Agents You Did Not Deploy — Shadow agents are born as consents and tokens, not cloud workloads. Here is how to discover them through identity, record posture, rank by authority and offer a faster sanctioned route.
• Prompt Injection Testing in CI: Building a Regression Suite for Agents — Assert on tool calls, not on wording. Build a prompt injection regression suite with canary fixtures, sampling gates and a tiered pipeline, then learn what a green build cannot tell you.
• NIST AI RMF for AI Agents: What Govern, Map, Measure and Manage Should Leave Behind — The NIST AI RMF never mentions tool calls or MCP servers. Here is one practitioner's reading of the evidence each function should produce for an agent.
• AI Agent Kill Switch: A Self-Check for Stop, Containment and Rollback — A kill switch is three abilities, not one button. Score yours across stop, containment and rollback, then fix the weakest link first.
• AI Red Teaming for Agents: Scope, Rules of Engagement and Reporting — A bypass rate says nothing about what an agent could do with its tools. Scope the exercise by authority, write the rules first, and report findings engineers can fix.
• AI Agent Guardrails Versus Controls: What Each One Can Actually Stop — A guardrail lowers how often a model misbehaves. A control limits what happens when it does. Here is how to sort your protections and where each belongs.
• MCP Security Intake Sheet: Eight Questions Before a Third-Party Server — Score any third-party MCP server from 0 to 16 before it reaches company data, using the protocol's own security guidance and a 2026 audit of nearly ten thousand public servers.