Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Prompt Injection Benchmarks: AgentDojo, BIPIA, CyberSecEval

Seven prompt injection benchmarks are in active use and their headline attack success rates run from 24% to 84.30%: AgentDojo (629 security cases, ETH Zurich, NeurIPS 2024), BIPIA (Microsoft, KDD 2025), InjecAgent (1,054 cases, ACL Findings 2024), Open-Prompt-Injection (USENIX Security 24), CyberSecEval 2 (Meta, 26-41% on every model), Agent Security Bench (ICLR 2025, 84.30% peak), and MCPTox (45 real MCP servers). Every one of those is a static score. When researchers from OpenAI, Anthropic, and Google DeepMind ran adaptive attacks against twelve published defenses, all twelve fell, most above 90%. This piece gives the comparison table, what each benchmark measures, and the design conclusion the numbers force.

Problem-Awareprompt-injectionllm-securityai-securityagentic-aiarchitecture
Read post →

Document-Level Security in RAG Must Filter Before Retrieval

Document-level security in RAG belongs in the retrieval query, before chunks enter an LLM prompt. Index each document with tenant and access metadata, derive the caller identity from a trusted source, apply the filter server-side, preserve source permissions during updates, and record the retrieved document IDs for each model request.

Platform & Architectureai-securityidentity-and-authorizationllm-securitypolicy-enforcementarchitecture
Read post →

LLM Caching Creates a Second Data Store with Its Own Access Rules

LLM caching can reduce latency and repeated token spend, but semantic and prefix caches create another store for prompts, responses, embeddings, or provider-side context. Security design needs cache scope, tenant isolation, key construction, encryption, expiry, invalidation, and a rule for which data classes may be cached.

Platform & Architectureai-securityllm-securitycloud-securitypolicy-enforcementarchitecture
Read post →

Secrets Detection in Prompts Needs a Block Before the Provider Call

Secrets detection in prompts should identify provider keys, cloud credentials, private keys, database strings, and organization-specific tokens before an HTTP LLM request leaves the application boundary. Pattern matching needs entropy checks, custom signatures, decoding tests, allowlists, and a response plan for any credential already exposed.

Platform & Architectureai-securitydata-loss-preventionllm-securitypolicy-enforcementdevsecops
Read post →

OPA for AI Policy Separates Decision Logic from the LLM Call

Open Policy Agent can evaluate structured facts about an AI request, including caller role, model route, data classification, region, and requested tool. OPA returns a decision; the gateway still has to enforce it, fail closed, protect policy inputs, version bundles, and write evidence for each request.

Platform & Architectureai-securitypolicy-enforcementidentity-and-authorizationllm-securityarchitecture
Read post →

Tokenization vs Redaction for LLM Prompts: Reversibility Changes the Risk

Redaction removes or masks sensitive values before an LLM call. Tokenization replaces them with references that an authorized service may later resolve. The reversible path preserves workflow utility and creates a token vault, access-control, and re-identification obligation. Choose per data field and output requirement.

Platform & Architectureai-securitydata-loss-preventionllm-securitypolicy-enforcementarchitecture
Read post →

AI Logs in a SIEM Need Decisions, Identity, and Content Minimization

AI logs sent to a SIEM should record caller identity, model route, policy version, data classification, decision, latency, and correlation IDs. Raw prompts and responses require a separate content decision. OpenTelemetry can standardize model events, while an independent gateway record proves what policy allowed before the call.

Platform & Architectureai-securityauditforensic-auditllm-securityarchitecture
Read post →

A Self-Hosted AI Gateway Moves Control Inward Without Removing Provider Risk

A self-hosted AI gateway gives the enterprise custody of routing configuration, credentials, policy code, telemetry, and failure behavior. It does not move an external model provider inside the network. Buyers should test egress, identity propagation, fail-closed behavior, log custody, upgrades, and bypass routes before calling the deployment private.

AI Security Solutionsai-securityai-governancecloud-securitypolicy-enforcementarchitecture
Read post →

Glean Permissions Depend on Connector Mode, Sync State, and Sharing

Glean permissions come from several control planes: source-system access lists, indexed snapshots, live authorization checks, Glean administrator roles, and agent-sharing rights. Connector mode determines when source permission changes take effect. Buyers should test revocation, domain-shared documents, and published agents as separate cases.

Platform & Architectureai-securityidentity-and-authorizationai-governanceauditarchitecture
Read post →

BYOK for LLM Gateways: Storage, Fallback, Billing, and Attribution

BYOK for an LLM gateway can mean a team-level stored provider credential, a request-scoped credential, or a customer credential used before platform fallback. Those modes change the bill payer, rate limit, approved provider account, and audit trail. A sound design records which credential path served every request without exposing the secret.

Platform & Architectureai-securityllm-securityidentity-and-authorizationpolicy-enforcementarchitecture
Read post →

Google Model Armor Pricing, Limits, and Cost Scope

Google Model Armor pricing starts with 2 million free tokens each month, then charges $0.10 per additional 1 million tokens on the public pay-as-you-go path. Security Command Center subscriptions include 3 billion tokens per month, and Gemini Enterprise includes Model Armor. Buyers still need to model prompt and response volume, integration paths, quotas, file and token limits, logging and support plus adjacent cloud costs.

Comparisons & Alternativesai-securityllm-securitycloud-securityarchitecturepolicy-enforcement
Read post →