Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

DeepInspect vs Apigee AI Gateway: API Management and the Audit Record Model Armor Does Not Produce

Apigee is Google Cloud API management used as an AI gateway. Model Armor policies filter prompt injection and jailbreaks, semantic caching runs through Vertex embeddings, and LLM token policies handle cost. What Apigee authenticates is the calling app, the developer, or the API product. DeepInspect authenticates the natural person behind the request, classifies prompt content against PII, PHI, and MNPI, and commits a signed per-decision audit record. This piece walks through what each does and how they compose.

Comparisons & Alternativesai-gatewaycomparisonai-securityai-complianceauditeu-ai-act
Read post →

DeepInspect vs AWS AI Gateway: What AWS Actually Ships and Where the Audit Record Stops

AWS has no product named AI Gateway. What people mean is one of four things: Bedrock AgentCore Gateway, the API Gateway plus Bedrock reference pattern, the Multi-Provider Generative AI Gateway guidance that deploys LiteLLM into your account, or Bedrock Guardrails. Each does a real job. None binds a natural person to the model call or signs a per-decision audit record. This piece separates the four, then walks through what a regulated workload on AWS still has to add.

Comparisons & Alternativesai-gatewaycomparisonai-securitycloud-securityauditai-compliance
Read post →

Best AI Gateway 2026: The Fifteen Products, Sorted by the Job They Actually Do

Palo Alto Networks completed its acquisition of Portkey on May 29, 2026. Envoy AI Gateway hit 1.0 on June 23. F5 launched its AI Security Platform on June 22. The AI gateway category spent 2026 splitting into two: products that route traffic and products that govern it. This piece sorts fifteen gateways by the job each one does, names which are open source, which are SaaS-only, and which answer the question a regulated deployment has to answer.

Comparisons & Alternativesai-gatewaycomparisonai-securityai-governancearchitectureinline-enforcement
Read post →

Prompt Injection Benchmarks: What AgentDojo, BIPIA, and CyberSecEval Actually Measure

Meta CyberSecEval 2 measured 26% to 41% successful prompt injection across every model it tested. AgentDojo runs 629 security test cases against tool-calling agents. Agent Security Bench peaked at 84.30% average attack success. And when researchers from OpenAI, Anthropic, and Google DeepMind ran adaptive attacks against twelve published defenses, all twelve fell, most above 90%. This piece walks through the named benchmarks, what each one measures, and the design conclusion the numbers force.

Problem-Awareprompt-injectionllm-securityai-securityagentic-aiarchitecture
Read post →

Best MCP Security Tools: Scanners, Gateways, and Registries Worth Running in 2026

The NSA published an MCP security information sheet in June 2026 calling out limited audit logging and weak access controls. The Cloud Security Alliance documented a design-level RCE across every official MCP SDK. MCPTox measured tool-poisoning success rates up to 72% against real servers. This piece sorts the MCP security tooling that actually exists into scanners, gateways, and registries, names what each one covers, and marks which failure modes no HTTP control can reach.

Comparisons & Alternativesai-securityagentic-aillm-securityarchitectureidentity-and-authorizationcybersecurity
Read post →

Multi-Agent System Security: The Authorization Problem Nobody Solved Before Shipping

A2A version 1.0 shipped in April 2026 with signed Agent Cards and an explicit design rule: A2A payloads carry no user or client identity. MCP forbids token passthrough and mandates RFC 8707 resource indicators. Both protocols push identity to the HTTP layer and leave delegation chains without a protocol-native way to carry an originating principal across hops. This piece walks through the multi-agent threat model, the six failure modes that only appear when agents talk to each other, and the enforcement point that reconstructs who authorized what.

Problem-Awareagentic-aiai-securityidentity-and-authorizationllm-securityarchitecturezero-trust
Read post →

MITRE ATLAS and Prompt Injection: Mapping AML.T0051 to Control Points You Can Actually Enforce

MITRE ATLAS catalogs prompt injection as AML.T0051, with Direct at .000 and Indirect at .001, and places jailbreak, data leakage, and plugin compromise downstream of it. That structure is more useful than a risk list, because it names the sequence an attacker follows. This maps each technique in the chain to the control point that answers it, gives the detection fields worth writing to a SIEM, and states which ATLAS entries an HTTP enforcement layer never reaches.

Problem-Awareprompt-injectionllm-securityai-securityinline-enforcementforensic-auditarchitecture
Read post →

MCP Server Supply Chain Security: The Install Path Nobody Reviews

An MCP server is installed with a line of configuration, runs with the privileges of the host process, updates on its own schedule, and ships a tool description that the model reads as instructions. That install path receives less scrutiny than an npm dependency, and the 2026 CVE record shows what it cost. This walks the five gates a third-party MCP server should pass, a ten-question review rubric, and the runtime controls that hold when the review was wrong.

Problem-Awareagentic-aiai-securityllm-securitydevsecopsarchitecturecybersecurity
Read post →

MCP Security Risks: Seven Failure Modes, Ranked by What They Cost You

Model Context Protocol risk decomposes into seven failure modes: configuration-to-command execution, tool poisoning, confused-deputy token passthrough, capability inheritance on agent compromise, credential aggregation in the server, unauthenticated HTTP endpoints, and registry supply chain. Each has a different mechanism, a different owner, and a different relationship to the HTTP boundary. This ranks them by blast radius and states which ones an enforcement layer can answer.

Problem-Awareagentic-aiai-securityllm-securityzero-trustidentity-and-authorizationarchitecture
Read post →

MCP Security News Tracker: The 2026 Timeline of Model Context Protocol Incidents and Disclosures

A running record of Model Context Protocol security events: the 40-plus CVEs disclosed against MCP implementations between January and April 2026, the CSA and OX Security finding that traced them to a single design decision, the NSA and CISA guidance published on June 2, and the individual critical CVEs in nginx-ui MCP, gemini-mcp-tool, and Mobile MCP. Each entry carries the date, the mechanism, and the control that answers it.

Problem-Awareagentic-aiai-securityllm-securitycybersecurityarchitecturezero-trust
Read post →

LLM Supply Chain Security: Nine Components, and the Only One You Can Enforce at Runtime

An LLM system has nine supply-chain components: base weights, fine-tunes and adapters, tokenizers, training and RAG corpora, inference servers, orchestration frameworks, tool and MCP servers, prompt templates, and the provider API itself. Eight of them are verified before deployment, through provenance, signing, and pinning. One is verified at runtime, on every call. This walks each component, the attack that hits it, and where the enterprise's enforceable control actually sits.

Problem-Awarellm-securityai-securityarchitectureai-governanceagentic-aidevsecops
Read post →

LLM Security Vulnerabilities: Five Classes of Real CVE in the 2026 AI Stack

OWASP's Top 10 catalogs LLM risks in the abstract. The CVEs filed against the LLM stack in 2026 are concrete, and they cluster into five classes: control-plane authentication bypass, multi-tenant isolation failure, pre-auth RCE in orchestration tooling, unsafe model file deserialization, and configuration-to-command execution by protocol design. This walks each class with its 2026 exemplars, the shared root cause, and which classes an enforcement layer can compensate for.

Problem-Awarellm-securityai-securitycybersecurityarchitecturedevsecopsagentic-ai
Read post →