Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

LLM Security Vulnerabilities: Five Classes of Real CVE in the 2026 AI Stack

OWASP's Top 10 catalogs LLM risks in the abstract. The CVEs filed against the LLM stack in 2026 are concrete, and they cluster into five classes: control-plane authentication bypass, multi-tenant isolation failure, pre-auth RCE in orchestration tooling, unsafe model file deserialization, and configuration-to-command execution by protocol design. This walks each class with its 2026 exemplars, the shared root cause, and which classes an enforcement layer can compensate for.

Problem-Awarellm-securityai-securitycybersecurityarchitecturedevsecopsagentic-ai
Read post →

LLM Supply Chain Security: Nine Components, and the Only One You Can Enforce at Runtime

An LLM system has nine supply-chain components: base weights, fine-tunes and adapters, tokenizers, training and RAG corpora, inference servers, orchestration frameworks, tool and MCP servers, prompt templates, and the provider API itself. Eight of them are verified before deployment, through provenance, signing, and pinning. One is verified at runtime, on every call. This walks each component, the attack that hits it, and where the enterprise's enforceable control actually sits.

Problem-Awarellm-securityai-securityarchitectureai-governanceagentic-aidevsecops
Read post →

MCP Server Supply Chain Security: The Install Path Nobody Reviews

An MCP server is installed with a line of configuration, runs with the privileges of the host process, updates on its own schedule, and ships a tool description that the model reads as instructions. That install path receives less scrutiny than an npm dependency, and the 2026 CVE record shows what it cost. This walks the five gates a third-party MCP server should pass, a ten-question review rubric, and the runtime controls that hold when the review was wrong.

Problem-Awareagentic-aiai-securityllm-securitydevsecopsarchitecturecybersecurity
Read post →

Multi-Agent System Security: The Authorization Problem Nobody Solved Before Shipping

A2A version 1.0 shipped in April 2026 with signed Agent Cards and an explicit design rule: A2A payloads carry no user or client identity. MCP forbids token passthrough and mandates RFC 8707 resource indicators. Both protocols push identity to the HTTP layer and leave delegation chains without a protocol-native way to carry an originating principal across hops. This piece walks through the multi-agent threat model, the six failure modes that only appear when agents talk to each other, and the enforcement point that reconstructs who authorized what.

Problem-Awareagentic-aiai-securityidentity-and-authorizationllm-securityarchitecturezero-trust
Read post →

Best MCP Security Tools: Scanners, Gateways, and Registries Worth Running in 2026

The NSA published an MCP security information sheet in June 2026 calling out limited audit logging and weak access controls. The Cloud Security Alliance documented a design-level RCE across every official MCP SDK. MCPTox measured tool-poisoning success rates up to 72% against real servers. This piece sorts the MCP security tooling that actually exists into scanners, gateways, and registries, names what each one covers, and marks which failure modes no HTTP control can reach.

Comparisons & Alternativesai-securityagentic-aillm-securityarchitectureidentity-and-authorizationcybersecurity
Read post →

69% of Enterprises Let AI Agents Share Credentials: The Attribution Problem That Starts Before the Breach

VentureBeat Q2 2026 agentic security research found that 69% of enterprises let AI agents share credentials, and 54% had already had an agent-related security incident or near-incident. With several agents on one key, the forensic trail goes cold at the credential level. This is an attribution problem an identity-aware gateway fixes before anything goes wrong, and this article walks through what per-agent identity and per-decision logging change about incident response.

Problem-Awareagentic-aiai-securityidentity-and-authorizationforensic-auditai-governancellm-security
Read post →

The FCA Mills Review Puts Agentic Finance on the Record: Who Is Accountable When an AI Agent Moves the Money

The FCA published the Mills Review on July 6, 2026, the first review of its kind by a financial regulator. It names four shifts AI is driving in retail financial services and makes seven recommendations, including enabling the foundations for agentic finance. This article stays on the accountability gap the Review opens: once an agent acts within a customer pre-set goal, a firm has to prove per action which identity authorized it and what the agent asked the model to do.

Industry Verticalsai-governanceai-complianceagentic-airegulationforensic-auditai-security
Read post →

AI Agent Memory Security: What a Gateway Sees, and What Persists Where It Cannot Reach

Agent memory spans the context window, provider-hosted long-term memory, vector-store RAG memory, and local file state. Attacks like MINJA, SpAIware, the Gemini delayed-tool-invocation poisoning, and the July 2026 MemGhost paper corrupt that memory through prompt content. This article maps each memory type and attack to the HTTP AI request boundary, and is blunt about which steps a gateway can see and which persist where it cannot reach.

Platform & Architectureagentic-aillm-securityprompt-injectionai-securityarchitectureforensic-audit
Read post →

AI Egress Control Implementation: Allowlisting the Destination Does Not Govern the Payload

Teams implement AI egress control with DNS filtering, SNI inspection, forward proxies, Kubernetes NetworkPolicy, and Cilium FQDN rules. Each governs the destination of AI traffic without reading the prompt, and Kubernetes NetworkPolicy cannot express FQDNs at all. This article gives working Cilium and Envoy egress config, explains why each layer stops at the destination, and shows why reading the payload requires sitting on the decrypted HTTP path.

Platform & Architectureai-securityarchitecturezero-trustkubernetesinline-enforcementllm-security
Read post →

Prompt Injection Testing: Building a Repeatable Program Instead of a One-Off Red Team

A one-time red team tells you whether an app was vulnerable last month. A testing program tells you whether every deploy still is. This guide walks how to build repeatable prompt injection testing: assemble a corpus across direct and indirect vectors, wire a runner into CI, measure attack success rate against a defined objective, and account for the adaptive-attack ceiling that static corpora miss. It marks why testing measures exposure and enforcement closes it.

Platform & Architectureai-securityprompt-injectionllm-securitydevsecopsarchitecture
Read post →

LlamaIndex Security Patterns: Trust Boundaries in a RAG Pipeline

A LlamaIndex application ingests documents, retrieves chunks, and synthesizes an answer, and each stage is a trust boundary. This article walks the security patterns that matter: enforce per-user document access at retrieval, treat ingested content as untrusted, scope query-engine tools, and govern the model call and its response. It marks which controls live in your ingestion code and which need an enforcement layer on the HTTP path to the model.

Platform & Architectureai-securityllm-securityarchitectureidentity-and-authorizationzero-trust
Read post →

LLM Output Validation Patterns: Four Layers Before You Trust a Model Response

Model output gets treated as trusted input to the next step, which is how a hallucinated field, an injected instruction, or a leaked value becomes an action. This article lays out four layers of LLM output validation: structural schema checks, content and safety filtering, grounding and semantic checks, and action gating on tool calls. It shows where each layer catches what, and why the action-gating layer belongs on an enforcement point outside the application.

Platform & Architectureai-securityllm-securityarchitecturepolicy-enforcementinline-enforcement
Read post →