Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Poisoned Tool Descriptions and Cross-Agent Privilege Escalation: Every IAM Call Was Authorized

At DEF CON 34, Microsoft security engineer Muskan Tomar demonstrated cross-agent privilege escalation triggered by a tool description rewritten to read like routine compliance guidance. An agent reads the description and makes an authorized IAM call that raises the privileges of a different agent in a different environment. The reported result across agents built on LangChain and Claude Code is that prompt guardrails, human approval and telemetry each failed in turn. This piece walks the three failures and separates the identity-platform problem from the authorization decision on the request path.

Problem-Awareai-securityagentic-aiprivilege-escalationtool-poisoningauthorizationmcp
Read post →

Cursor DLP: Four Paths Send Your Codebase to a Model, and Autocomplete Is the Loudest

A developer using Cursor produces model requests from four distinct paths: codebase indexing, tab completion, chat with context, and agent mode. Tab completion alone fires on a keystroke cadence and sends surrounding file content thousands of times a day, which is a volume profile no chat-oriented AI DLP programme was built for. This piece separates the four paths, explains why endpoint DLP and network allowlisting both miss them, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpdeveloper-toolscursor
Read post →

CrewAI DLP: The Delegation Chain Moves Data That No Single Agent Ever Saw

A CrewAI crew with four agents and a hierarchical process produces far more model calls than the task list suggests, because delegation, shared memory and tool output all become context on the next call. Instrumenting the first call and treating the rest as internal traffic misses most of the content leaving the boundary. This piece walks the four data paths inside a crew, explains why the manager agent concentrates the risk, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpagentic-aicrewai
Read post →

DeepSeek DLP: One Model Name, Four Deployment Paths, Four Different Answers About Where Data Goes

DeepSeek models reach an enterprise through at least four paths: the vendor API, self-hosted open weights, third-party inference hosts, and consumer apps on unmanaged devices. Each path has a different data destination, a different jurisdiction and a different retention posture, while all four produce requests that look alike to an application. This piece separates the four, explains why a policy written against a model name governs nothing, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpdeepseekopen-weights
Read post →

Databricks Mosaic AI DLP: Unity Catalog Governs the Table, Not the Prompt Built From It

Unity Catalog governs which principal can read which table, column and row inside the lakehouse. A Mosaic AI application reads a governed table, assembles a prompt from the rows, and sends that prompt to a model endpoint, at which point the governance metadata stops travelling with the content. This piece walks the four Mosaic AI paths that cross the model boundary, explains why external model serving changes the risk profile, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpdatabricksarchitecture
Read post →

Google Agentspace DLP: A No-Code Agent Builder Puts Data-Movement Design in Non-Engineer Hands

Google Agentspace lets a business user assemble an agent from connectors, a model and a set of actions without writing code. That moves the decision about which data reaches a model from an engineering review into a self-service form. This piece walks the connector, action and agent-build paths, explains why agent proliferation is the governance problem rather than any single agent, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpagentic-aigoogle-cloud
Read post →

Glean DLP: The Knowledge Graph Holds Content Nobody Ever Wrote Down

Glean indexes documents and also builds a knowledge graph over people, teams, projects and activity signals. That derived layer contains inferences no document states, and those inferences become retrieval context in prompts. Add Glean Agents taking actions across connected systems and the surface widens again. This piece separates the document index from the derived graph, explains why the agent action path needs different controls from the answer path, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpenterprise-searchglean
Read post →

Gemini Enterprise DLP: An Admin Toggle Governs Availability, Not What Leaves in the Prompt

Google Workspace admin controls decide which organizational units get Gemini features and which apps it can ground against. Those toggles govern availability. Once a user has the feature, the content of every grounded request is decided by whatever that user has access to, which for most employees is a larger surface than anyone has audited. This piece separates the Workspace side from the Vertex API side, explains why grounding scope is the real control, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpgoogle-workspacegemini
Read post →

DeepInspect vs Zenity: Agent Governance and the LLM Request Boundary

Zenity governs AI agents built on platforms like Salesforce Agentforce, Microsoft Copilot Studio, and ServiceNow, with build-time posture checks, observability, and runtime risk detection. DeepInspect enforces identity-bound policy and produces a per-decision audit record on the HTTP calls between users or agents and LLMs. This comparison draws the boundary between the two layers and gives honest pick-if guidance.

Comparisons & Alternativesagentic-aiai-securityai-governancearchitecturepolicy-enforcement
Read post →

DeepInspect vs Cisco AI Defense: Threat Guardrails and Identity-Bound Enforcement

Cisco AI Defense pairs model validation with real-time guardrails that block adversarial attacks, prompt injection, and unsafe agent behavior, delivered across Cisco security fabric and AI-aware SASE. This comparison separates threat-and-content guardrails from identity-bound authorization and per-decision audit, shows where each layer sits, and gives honest pick-if guidance for both.

Comparisons & Alternativesai-securityai-governancearchitecturepolicy-enforcementagentic-ai
Read post →

DeepInspect vs Cato Networks (Aim Security): Where the Enforcement Boundary Sits

Cato Networks acquired Aim Security in September 2025 and is folding its AI security capabilities into the Cato SASE Cloud platform through early 2026. This comparison lays out where a SASE-delivered AI security module fits, where a dedicated identity-aware policy gateway with per-decision audit fits, and which buyer each one serves, with honest pick-if framing for both.

Comparisons & Alternativesai-securityai-governancearchitecturepolicy-enforcementzero-trust
Read post →

Identity Propagation Closes the Attribution Gap on AI-Generated Passwords

On May 8, 2026, GitGuardian classified 28,000 passwords on public GitHub as LLM-generated. The mechanism is per-model Markov chain analysis applied to a dataset of 34 million credentials observed between November 2025 and March 2026. Detection at the leak point is the start of the forensic chain. Attribution comes next: which authenticated user issued the prompt, which model returned it, under what role. Those answers come from AI traffic logs that captured identity at the call boundary. This post covers what that capture looks like in practice.

ai-securitysecrets-managementai-trafficforensicsidentityauditllm-credentials
Read post →