Defensive Architecture & Security Controls

Knowing where the attack surface is only half the work—the harder problem is building systems that resist exploitation under real operating conditions. This category covers concrete defensive patterns for agentic systems: sandboxing tool execution, enforcing least-privilege credential delegation, designing trust boundaries in multi-agent pipelines, and implementing runtime controls that don't cripple the autonomy you're trying to protect. The focus is architectural decisions that hold up when things go wrong, not checklists that look good in a review.

• Agentic AI Risk Management: A Six-Step Programme Built on the NIST AI RMF — A six-step agentic AI risk management programme from inventory to incident response, tied to the NIST AI RMF and the Playbook, with the option many teams forget: avoid the agent.
• Secrets Management for AI Agents: Keeping Credentials Out of Configs and Prompts — Agent configs and prompts now collect the credentials that malware targets. Learn six moves to keep secrets out, and why rotation, not detection, is the bottleneck.
• OAuth for AI Agents: Scopes, Token Exchange and Per-Action Authorization — Use OAuth to bound what an agent token can do, record who the agent acts for and limit theft damage. Learn the grants, token exchange, scope design and why scopes are too coarse.
• Shadow AI: How to Detect Unsanctioned AI Agents and Tools on Endpoints — Shadow AI is an endpoint inventory problem. Learn which signals to collect, how to phase a 90-day programme, and why managed configuration beats chasing traces.
• AI-SPM vs CSPM vs DSPM: What AI Security Posture Management Covers — AI-SPM borrows its name from cloud and data posture management but covers different ground. See what it sees, what it misses and when a dedicated product pays off.
• AI Security Controls by Layer: What Each Control Buys You and What It Does Not — A seven-layer catalog of AI security controls, each row stating what it buys you and what it does not, with a case for choosing controls that fail closed.
• AI Prompt Injection Attacks: Direct, Indirect and What Actually Reduces the Damage — Prompt injection has two entrances and one root cause. Learn how direct and indirect attacks differ, what lowers the odds, what limits the damage, and why sorting by writer beats sorting by channel.
• Agentic AI Security Risks: A Copyable Risk Register With Scoring — Twelve agentic AI security risks in a register you can copy, with exposure and impact scoring, proof to attach and a case for scoring paths instead of categories.
• How to Secure AI Agents: Ten Controls in Build Order — A short, ordered list for securing AI agents, grounded in NCSC and OWASP guidance. Each control comes with the proof worth keeping, and the order puts limits before detection.
• Agentic AI Governance and Compliance: A Complete Guide for Security Teams — Governance makes agent controls provable. Learn the frameworks, one evidence set that serves several of them, and why the EU delay should not delay your programme.
• AI Agent Runtime Security: A Complete Guide to Policy, Isolation and Containment — Most agent incidents happen at run time, between a decision and its effect. This guide covers seven controls, incident patterns and why walls beat prompts.
• AI Agent Identity and Non-Human Identity Security: A Complete Guide — Every agent control depends on knowing which agent acted, for whom. This guide covers identity designs, the credential lifecycle, OWASP's NHI risks and what to ask vendors.
• NIST AI RMF for AI Agents: What Govern, Map, Measure and Manage Should Leave Behind — The NIST AI RMF never mentions tool calls or MCP servers. Here is one practitioner's reading of the evidence each function should produce for an agent.
• AI Agent Kill Switch: A Self-Check for Stop, Containment and Rollback — A kill switch is three abilities, not one button. Score yours across stop, containment and rollback, then fix the weakest link first.
• AI Agent Guardrails Versus Controls: What Each One Can Actually Stop — A guardrail lowers how often a model misbehaves. A control limits what happens when it does. Here is how to sort your protections and where each belongs.
• Non-Human Identity Security: Score Your Agent Credential Lifecycle — Eight questions on owners, end dates and offboarding, scored in an hour. Plus the 2026 scanning data that shows why expiry beats discovery as a first purchase.
• Copilot Studio Security: Six Settings That Decide the Blast Radius — There is no public incident, and the three defaults everyone checks would not have stopped the one documented case. What actually caps a low-code agent's reach, setting by setting.
• Agentic AI Security: Deciding What to Buy, What to Build and What to Ignore — An analyst curve maps where suppliers are spending attention, not where your risk sits. Here is how to read one and still write the right purchase order.
• MCP Gateway Security: What a Choke Point Enforces and What It Never Sees — A gateway in front of your tool servers is a real control doing a real job. The job is narrower than the architecture diagram implies, and the gap needs naming.
• Prompt Injection Defense for Production Agents: Build for the Injection That Works — The UK's national cyber agency does not expect this bug class to be eliminated. That changes the design goal from blocking hostile text to shrinking what hostile text can reach.
• AI Agent Identity: Stop Classifying the Agent, Start Describing the Action — Identity reviews for agents stall on whether the thing is a person or a workload. The question has no answer, and a better one already has standards behind it.
• AI Agent Monitoring: Logs, Measures and Alerts Are Three Different Jobs — Agent failures pass every health check. Here is the field set a step record needs, the measures worth computing per task type, and how an alert earns an owner and an action.
• MCP Server Authorization: Audience Binding and the Confused Deputy — A verified token tells you nothing about who it was issued for. How audience checks, a ban on relaying credentials, and per-client consent keep an MCP server from acting as somebody else's deputy.
• AI Agent Architecture Security: A Layer-by-Layer Reference — A security reference for agent architecture, layer by layer: the model, context and memory, the tool layer, identity and orchestration, with the trust boundary that belongs to each.
• AI Security in 2026: The Scope, the Boundaries and the Order to Work In — The term covers two distinct jobs: defending the model system and bounding what it can reach. Here is the scope, the structural differences, and a sequenced first month.
• Claude Code Audit Trails: What the Session History Cannot Tell an Investigator — Saved session history narrates the work. The executions live in a separate stream that is off by default, redacted by default, and gated by hooks that fail open.
• Agentic AI Security Checklist: Twenty Questions to Answer Before Launch — Twenty pre-ship questions in five themes, covering authority, untrusted input, action gating, dependencies and response. Each one closes against evidence, not opinion.
• Agentic AI Audit Logs: The Four Claims Your Record Has to Substantiate — An agent's event stream has to establish attribution, fidelity, authorization and integrity. Here is which event carries each claim, and where ordinary logging leaves nothing behind.
• The Agentic SOC Is Here: How Salesforce, Datadog, and GreyNoise Are Putting Autonomous Agents on the Front Line —
• Google's Heather Adkins and Four Flynn on Weathering AI's "Perfect Storm" of Security Risk — Heather Adkins and Four Flynn's AI security strategy for agentic systems - from treating agents as untrusted intermediaries to hardening prompt injection defenses in
• Stripe, Snap, and Sondera on Stopping Prompt Injection Without Neutering Your Agents — Stripe, Snap, and Sondera's practitioners explain why prompt engineering is not a security boundary for agentic systems - and what capability-based authorization actually looks like in production.
• How Snowflake, FFF Enterprises, and Sysdig Are Building AI Governance That Doesn't Kill Innovation — Ragini Ramalingam, Billy Norwood, and Sergej Epp are building enterprise AI governance that actually works - here's the risk-based model replacing the approval-gate approach.
• Inside Trail of Bits' AI-Native Transformation: Dan Guido on Building a Security Firm Around Autonomous Agents — Dan Guido and Trail of Bits show why AI-native security consulting requires rearchitecting for autonomous scale - not wrapping LLMs around existing processes.
• Human Oversight in Agentic Systems: What Governance Actually Looks Like in Production — Human oversight in agentic systems fails not because the controls are missing but because they are designed for the ideal case, not the production one.
• Incident Response for Agentic AI: What to Do When an Agent Has Already Acted — When an agent has already acted, incident response for agentic AI means reconstructing the action chain, containing real damage, and preventing the same failure from recurring.
• From RBAC to ABAC: A Practical Access Control Roadmap for AI Agents and Autonomous Systems —
• How Open-Source Security Layers Are Closing the Safety Gaps in Agentic AI Systems —
• Inside Agentic AI Architectures: How Prompts, Timers, and Skill Modules Shape Agent Behavior —
• Sandboxing AI Agent Tool Calls: An Isolation Architecture — Tool misuse in agentic systems rarely looks like a breach - it looks like permitted behavior in an unanticipated sequence, which is exactly why tool call sandboxing requires runtime isolation, not just access control.
• Detecting Malicious Tool Calls in Agentic AI Systems —
• Defending Agentic AI Memory: Detection and Isolation Controls — Memory poisoning in agentic AI systems corrupts stored state that persists across sessions - here is how to detect it, isolate it, and verify memory integrity before it becomes an incident.
• Runtime Monitoring for AI Agents: What to Watch, What to Log, and What to Alert On — Runtime monitoring for AI agents requires semantic observability, not just latency thresholds - here's what to log, what to alert on, and where conventional monitoring fails.
• Defensive Architecture Principles Every Security Team Needs — Defensive architecture principles give security teams the structural guardrails to constrain agent behavior before something goes wrong - not after.
• Securing Agentic AI: Controls Your Architecture Needs Now — Securing agentic AI requires controls your architecture probably doesn't have yet - here's how to build them before something goes wrong.
• Defense-in-Depth for AI Pipelines: A Layered Control Guide — Defense-in-depth for AI pipelines means layering input, model, output, execution, and monitoring controls so that when one safeguard fails, others are already in place.
• Zero Trust Architecture: What It Actually Means to Implement It — Zero Trust Architecture means more than buying new tools - here's what actual implementation looks like, step by step.
• Least Privilege Is Harder With AI Agents — Here's Why — Least privilege gets genuinely hard with AI agents - here is why the traditional model breaks and what you can do about it.