✳ Research map / AI / AGENTS

Map the controls. Trace the boundaries.

AI application & agent security

← All segments Read the field guide ↗Method & limitations ↗

RESEARCH MAP / UNSCORED

Start with the boundary you need to protect.

These products address different jobs. Follow a control purpose to inspect its offerings, operating assumptions, and evidence. Placement groups related work; it does not indicate quality or rank.

Reviewed 2026-09-21. Comparable edition scopes and published scoring criteria are needed before this market receives scores or momentum signals.

CONTROL PURPOSE 01

Runtime input and output controls

Inspect prompts, retrieved content and responses for policy violations at defined integration points.

Where the boundary lies: A detection result cannot revoke a credential. Application code or the integrated service must enforce the result, including timeouts and streaming behavior.

Check Point

Check Point AI Guardrails

Check Point AI Guardrails, identified as Lakera Guard in its privacy documentation, inspects submitted LLM inputs and outputs for threats and policy violations. The practical question is where an application sends content for inspection, what action follows a detection and how that content is retained.

Make it observable: The result distinguishes the detected policy condition, the enforced application action and the content recorded in service logs.

Inspect scope & evidence ↗

Microsoft

Microsoft Azure AI Content Safety

Azure AI Content Safety provides APIs for application content checks. Prompt Shields addresses instructions that try to redirect a model, including attacks embedded in documents. The returned result is evidence for an application decision; a separate identity and permission system still controls access to records and tools.

Make it observable: The test separately records the prompt detection and the data-access denial, with benign scheduling questions still usable.

Inspect scope & evidence ↗

Google Cloud

Google Cloud Model Armor

Model Armor screens prompts and responses using configurable templates. Its inspect-only and blocking modes are useful for teaching the difference between a recorded policy violation and an interaction that was actually stopped. Integrations and content modalities have explicit boundaries that must be checked.

Make it observable: Logs identify the template and filter result, and the application records whether the model was invoked in each enforcement mode.

Inspect scope & evidence ↗

NVIDIA

NVIDIA NeMo Guardrails

NeMo Guardrails is a programmable library for adding checks at several stages of an LLM application. Input, retrieval, dialog, execution and output rails expose different control points. That makes it an educational option for seeing exactly where a check belongs, while leaving configuration and operation with the application team.

Make it observable: The trace demonstrates which rail ran and whether the mock tool was called; a blocked answer alone is not counted as a blocked action.

Inspect scope & evidence ↗

CONTROL PURPOSE 02

Agent authorization and tool controls

Authorize each tool call using the caller, action, resource and constrained arguments outside model instructions.

Where the boundary lies: Gateway policy only protects traffic that traverses that gateway. Direct API routes, broad credentials and delegated user context need separate controls.

Amazon Web Services

Amazon Bedrock AgentCore Policy

Policy in AgentCore places an authorization decision at the gateway tool boundary. Cedar policies evaluate the principal, action, resource and relevant context before a tool call proceeds. This provides a concrete contrast with asking the language model to remember a business rule.

Make it observable: The authorized read succeeds, containment is denied at the gateway, and the downstream mock records no containment action.

Inspect scope & evidence ↗

CONTROL PURPOSE 03

Security evaluation

Exercise a fixed application and agent configuration with adversarial and benign cases before and after changes.

Where the boundary lies: A passing evaluation samples behavior; it does not prove that every future prompt, language, tool sequence or model version is safe.

Cisco

Cisco AI Defense

AI Defense combines model and application validation with separately integrated runtime protection. Its management API exposes validation runs and results alongside application connections and policy events. This makes it useful for learning how a predeployment finding becomes a runtime control, without treating the two as the same test.

Make it observable: The record contains the original test case, validation result, configured policy and observable runtime outcome.

Inspect scope & evidence ↗

HiddenLayer

HiddenLayer AI Attack Simulation

HiddenLayer AI Attack Simulation tests AI systems with adversarial cases, including prompt manipulation, data leakage and unsafe tool use. Its value to an evaluation is the reproducible failing interaction and resulting repair, not the existence of a report or an aggregate score.

Make it observable: The result identifies an observable unauthorized mock action, and a corrected policy prevents it on retest without breaking permitted use.

Inspect scope & evidence ↗

CONTROL PURPOSE 04

AI inventory and supply-chain assessment

Identify AI assets and inspect model artifacts, dependencies and configuration before deployment.

Where the boundary lies: Artifact scanning cannot establish that a deployed agent has appropriate business authority or that every generated answer is correct.

Palo Alto Networks

Palo Alto Networks Prisma AIRS

Prisma AIRS spans several AI security modules. AI Model Security examines model artifacts and their supply chain before use, while runtime APIs inspect interactions after integration. A learner should keep an artifact finding separate from evidence that a deployed agent can access too much data.

Make it observable: The review preserves artifact identity, the finding and promotion decision; it makes no claim that the scan certifies runtime behavior.

Inspect scope & evidence ↗

APPLY IT / AGENTIC SOC

The alert is evidence. It is not authority.

An investigation agent reads a suspicious message, gathers context, and proposes a response. Trace which component checks the content, which identity authorizes each tool call, and which policy governs the proposed action.

In a lab, place conflicting instructions in synthetic evidence. Record whether the agent attempts an unauthorized action and whether the tool boundary prevents it. A model refusing the request and an authorization control denying it are different observations.

Explore the Agentic SOC architecture ↗

Build an evaluation ↗Browse all 8 profiles ↗