Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Gemini Enterprise DLP: An Admin Toggle Governs Availability, Not What Leaves in the Prompt

Google Workspace admin controls decide which organizational units get Gemini features and which apps it can ground against. Those toggles govern availability. Once a user has the feature, the content of every grounded request is decided by whatever that user has access to, which for most employees is a larger surface than anyone has audited. This piece separates the Workspace side from the Vertex API side, explains why grounding scope is the real control, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpgoogle-workspacegemini
Read post →

Google Agentspace DLP: A No-Code Agent Builder Puts Data-Movement Design in Non-Engineer Hands

Google Agentspace lets a business user assemble an agent from connectors, a model and a set of actions without writing code. That moves the decision about which data reaches a model from an engineering review into a self-service form. This piece walks the connector, action and agent-build paths, explains why agent proliferation is the governance problem rather than any single agent, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpagentic-aigoogle-cloud
Read post →

Glean DLP: The Knowledge Graph Holds Content Nobody Ever Wrote Down

Glean indexes documents and also builds a knowledge graph over people, teams, projects and activity signals. That derived layer contains inferences no document states, and those inferences become retrieval context in prompts. Add Glean Agents taking actions across connected systems and the surface widens again. This piece separates the document index from the derived graph, explains why the agent action path needs different controls from the answer path, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpenterprise-searchglean
Read post →

Dropbox Dash DLP: Connectors Turn Twelve Separate Permission Models Into One Prompt

Dropbox Dash indexes content across connected sources and answers questions over the combined result. The security property that matters is the fan-in: content from a dozen systems, each with its own permission model and its own history of over-sharing, converges into a single retrieval corpus and a single prompt. This piece walks the connector paths, explains why inherited over-permissioning surfaces at retrieval time, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpenterprise-searchdropbox-dash
Read post →

DeepSeek DLP: One Model Name, Four Deployment Paths, Four Different Answers About Where Data Goes

DeepSeek models reach an enterprise through at least four paths: the vendor API, self-hosted open weights, third-party inference hosts, and consumer apps on unmanaged devices. Each path has a different data destination, a different jurisdiction and a different retention posture, while all four produce requests that look alike to an application. This piece separates the four, explains why a policy written against a model name governs nothing, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpdeepseekopen-weights
Read post →

Databricks Mosaic AI DLP: Unity Catalog Governs the Table, Not the Prompt Built From It

Unity Catalog governs which principal can read which table, column and row inside the lakehouse. A Mosaic AI application reads a governed table, assembles a prompt from the rows, and sends that prompt to a model endpoint, at which point the governance metadata stops travelling with the content. This piece walks the four Mosaic AI paths that cross the model boundary, explains why external model serving changes the risk profile, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpdatabricksarchitecture
Read post →

Cursor DLP: Four Paths Send Your Codebase to a Model, and Autocomplete Is the Loudest

A developer using Cursor produces model requests from four distinct paths: codebase indexing, tab completion, chat with context, and agent mode. Tab completion alone fires on a keystroke cadence and sends surrounding file content thousands of times a day, which is a volume profile no chat-oriented AI DLP programme was built for. This piece separates the four paths, explains why endpoint DLP and network allowlisting both miss them, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpdeveloper-toolscursor
Read post →

CrewAI DLP: The Delegation Chain Moves Data That No Single Agent Ever Saw

A CrewAI crew with four agents and a hierarchical process produces far more model calls than the task list suggests, because delegation, shared memory and tool output all become context on the next call. Instrumenting the first call and treating the rest as internal traffic misses most of the content leaving the boundary. This piece walks the four data paths inside a crew, explains why the manager agent concentrates the risk, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpagentic-aicrewai
Read post →

Poisoned Tool Descriptions and Cross-Agent Privilege Escalation: Every IAM Call Was Authorized

At DEF CON 34, Microsoft security engineer Muskan Tomar demonstrated cross-agent privilege escalation triggered by a tool description rewritten to read like routine compliance guidance. An agent reads the description and makes an authorized IAM call that raises the privileges of a different agent in a different environment. The reported result across agents built on LangChain and Claude Code is that prompt guardrails, human approval and telemetry each failed in turn. This piece walks the three failures and separates the identity-platform problem from the authorization decision on the request path.

Problem-Awareai-securityagentic-aiprivilege-escalationtool-poisoningauthorizationmcp
Read post →

Azure MCP Server SSRF and Credential Relay: Six Services That Carry a Managed Identity Token Wherever the Request Points

At DEF CON 34 Cloud Village on August 8, 2026, Marios Gyftos and Chrysostomos Manousis presented credential relay findings across six Azure services, including Azure AI Foundry, Azure AI Speech, Azure MCP Servers, AKS MCP and API Management. The root cause is one sentence long: the credential attached to an outbound request and the destination of that request are resolved independently, and nothing checks that they belong together. This piece walks the mechanism, separates the part Microsoft owns from the part a policy gateway owns, and sets out the record an incident reviewer needs.

Platform & Architectureai-securitymcpazuressrfcredential-relaypolicy-enforcementllm-security
Read post →

Prompt Injection Benchmarks: AgentDojo, BIPIA, CyberSecEval

Seven prompt injection benchmarks are in active use and their headline attack success rates run from 24% to 84.30%: AgentDojo (629 security cases, ETH Zurich, NeurIPS 2024), BIPIA (Microsoft, KDD 2025), InjecAgent (1,054 cases, ACL Findings 2024), Open-Prompt-Injection (USENIX Security 24), CyberSecEval 2 (Meta, 26-41% on every model), Agent Security Bench (ICLR 2025, 84.30% peak), and MCPTox (45 real MCP servers). Every one of those is a static score. When researchers from OpenAI, Anthropic, and Google DeepMind ran adaptive attacks against twelve published defenses, all twelve fell, most above 90%. This piece gives the comparison table, what each benchmark measures, and the design conclusion the numbers force.

Problem-Awareprompt-injectionllm-securityai-securityagentic-aiarchitecture
Read post →

ISO 42001 Annex A Controls: The 38 AI Management Controls and Where Each One Lands in the Deployment

ISO 42001 Annex A lists 38 controls across nine areas (A.2 through A.10) that an organization implementing an AI Management System (AIMS) has to consider. Numbering starts at .2 in every area because the .1 position holds the control objective, and A.6 splits into A.6.1 and A.6.2 for a total of nine lifecycle controls. The auditor's Statement of Applicability records which controls the organization has implemented, which it has excluded (with justification), and which are partially implemented with a target date. This piece gives the full 38-control table with the deployment layer for each, the evidence a certification body accepts per area, what ISO/IEC 42006:2025 changed about who may audit you, and why an ISO 42001 certificate grants no presumption of conformity under EU AI Act Article 17.

Compliance & Regulationiso-42001annex-aaimsai-management-systemai-compliancecertification
Read post →