Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Mindgard Pricing: Demo-Led Scope and Quote Questions

Mindgard pricing follows a demo-led sales path with no numeric amount on the public platform and demo pages reviewed. The platform spans discovery and reconnaissance plus automated red teaming and assessment. It also covers runtime protection and threat response alongside continuous assurance. A useful quote must identify which modules, applications, agents, environments, test cadence, runtime paths, support terms, and evidence obligations are included.

Comparisons & Alternativesai-securityllm-securityagentic-aiauditpolicy-enforcementarchitecture
Read post →

Lasso Security Alternatives by Enforcement Boundary

Lasso Security alternatives divide by enforcement boundary. Noma Security emphasizes agent discovery and control through existing infrastructure. Harmonic covers employee and agent usage with browser and endpoint controls. Prompt Security argues for browser and endpoint sensors, while agentgateway provides an open-source gateway for agent protocols. DeepInspect governs authenticated HTTP traffic sent to LLM endpoints.

Comparisons & Alternativesai-securityllm-securityagentic-aiinline-enforcementpolicy-enforcementarchitecture
Read post →

Gemini Enterprise vs ChatGPT Enterprise: Control Boundaries

Gemini Enterprise and ChatGPT Enterprise are hosted work surfaces with identity, permissions, connected systems, and audit controls inside their provider-managed environments. Google emphasizes one agent across business applications under existing permissions. OpenAI documents workspace groups, hosted Work Cloud execution, connected accounts, and Compliance API records. The buying decision should test access inheritance, hosted execution, evidence coverage, and the routes an enterprise gateway can actually inspect.

Comparisons & Alternativesai-securityidentity-and-authorizationcloud-securityauditarchitecture
Read post →

ChatGPT Enterprise vs Microsoft Copilot: Security and Audit Fit

ChatGPT Enterprise and Microsoft 365 Copilot both exclude commercial customer prompts and responses from foundation-model training, but they attach to different control planes. ChatGPT Enterprise centers on an OpenAI workspace, its apps, retention settings, and Compliance API. Microsoft 365 Copilot works inside the Microsoft 365 service boundary, uses Microsoft Graph permissions, and writes interaction records into Microsoft Purview Audit.

Comparisons & Alternativesai-securityai-governancedata-loss-preventionpolicy-enforcementcloud-securityaudit
Read post →

Does Grammarly Train on Your Data? Account Defaults and Controls

Grammarly can use content for model training and product improvement, but the default depends on the account and purchase route. Individual accounts start with training on. Sales-purchased Business, Pro, Education, and Enterprise accounts start with it off. Website-purchased multi-user teams start with it on until an administrator changes the organization setting. Training control also differs from tailored assistance.

Problem-Awareai-securityai-governancedata-loss-preventionpolicy-enforcementcloud-security
Read post →

LLM Agent Incident Response: Containment, Forensics, Recovery

An LLM agent incident response playbook for containment, eradication, recovery and forensics. It maps prompt injection, agent escalation, model-extraction attempts and prompt-based data exfiltration to request-boundary signals, containment decisions, evidence records and SOC handoffs.

Problem-Awareincident-responsesocai-securityprompt-injectionforensicscontainment
Read post →

Gong AI Security: SOC 2, ISO 42001, and Retention

Gong holds SOC 2 Type II certification and ISO/IEC 42001:2023 certification for AI management, states that customer conversation data is never used to train its generative models, and lets each customer configure retention themselves. This covers what Gong's Trust Center answers and what it does not: which authenticated identity triggered a specific AI request, what conversation content it carried, and whether a policy decision on that request is provable independent of Gong's own systems.

Platform & Architectureai-securityllm-securityauditpolicy-enforcementidentity-and-authorizationarchitecture
Read post →

ISO 42001 Annex A Controls: The 38 AI Management Controls and Where Each One Lands in the Deployment

ISO 42001 Annex A lists 38 controls across nine areas (A.2 through A.10) that an organization implementing an AI Management System (AIMS) has to consider. Numbering starts at .2 because the .1 position holds each control objective, and A.6 splits into A.6.1 and A.6.2 for nine lifecycle controls. The Statement of Applicability records implementation status, exclusions with justification, and incomplete controls with target dates. This guide maps all 38 controls to deployment layers and evidence artifacts, explains ISO/IEC 42006:2025, and sets out why an ISO 42001 certificate grants no EU AI Act Article 17 presumption.

Compliance & Regulationiso-42001annex-aaimsai-management-systemai-compliancecertification
Read post →

Does Codex Train on Your Data? Cloud, Workspace, and API Rules

Codex data-use rules depend on the route. Codex Cloud inspects selected repositories and executes tasks in OpenAI-managed workspaces. Business, Enterprise, and Edu workspace data is excluded from model training by default. Direct OpenAI API data is also excluded unless the customer opts in, while retention depends on abuse-monitoring settings and endpoint state. A useful approval names the execution surface, account, repository, retention control, connected services, and training rule.

Problem-Awareai-securityai-governancedata-loss-preventionpolicy-enforcementcloud-securityaudit
Read post →

Is Codex HIPAA Compliant? Local, API, and Cloud Eligibility

Codex has a conditional HIPAA answer. Codex Local can transmit PHI to OpenAI under a BAA when it is signed into an eligible ChatGPT workspace. An API route requires BAA coverage for API Services with Modified Retention. OpenAI excludes Codex Cloud from BAA coverage, and its BAA also excludes local client execution and third-party services accessed by Codex. Approval therefore belongs to a named route, account, configuration, and task rather than the Codex brand.

Compliance & Regulationhipaaai-complianceai-securitypolicy-enforcementauditarchitecture
Read post →

Google SAIF: Turn the Secure AI Framework Into Control Ownership

Google SAIF maps AI security risks and controls across four component areas: data, infrastructure, model, and application. A useful implementation turns that map into a versioned ownership record for each relevant risk, with an enforcement point, acceptance test, evidence location, and review trigger. This guide explains the framework, the artifact security teams should build, and the limited request-boundary slice that DeepInspect can support.

Compliance & Regulationai-securityai-governanceai-compliancearchitecturepolicy-enforcementaudit
Read post →

GitHub Copilot GDPR: Map Controller, Processor, and Model Routes

A GitHub Copilot GDPR review should assign controller and processor roles by processing activity, identify model and subprocessor routes, connect each purpose to its data categories and retention terms, and test what actually leaves developer tools. GitHub may act as processor for most organization-account activity and as controller for specified activities, so one label for the whole service is unreliable.

Compliance & Regulationgithub-copilotgdprdata-protectionvendor-riskai-governanceaudit-evidence
Read post →