Home / Blog

LANDSCAPEAUGUST 24, 2026

The AI agent runtime
security landscape.

An agent doesn't just process a request and return a response — it reasons across multiple steps, calls tools, touches internal systems, and can be steered by the content it reads along the way. Here's where each category of tool built for that problem actually operates.

AI agents create a different attack surface than the applications security teams are used to defending. Traditional application security, network security, and even most existing LLM guardrails weren't built to evaluate multi-step, tool-using behavior. This maps the tools built specifically for that problem, organized by where in the agent's execution path each one actually operates — not a ranked "best of" list, since most teams end up combining tools from more than one category rather than picking a single winner.

Perimeter and gateway enforcement

→

Palo Alto Prisma AIRSGateway-level policy enforcement for AI traffic, evaluating inputs and outputs as they pass through, cloud-deployed.

→

Cisco AI DefenseNetwork-level AI traffic policy and visibility, with an AI Bill of Materials for centralized governance over AI software assets.

→

Google Cloud Model Armor + Agent GatewayPerimeter-level filtering and policy enforcement integrated into Google Cloud's AI infrastructure.

→

FencioEnforces at the input-to-LLM boundary as one of its policy layers, covering the same edge perimeter-only tools protect, in addition to enforcing inside the agent's internal execution path.

WHAT THIS CATEGORY COVERS

Traffic crossing a defined boundary. What it doesn't see: what happens inside the agent between input and output, memory access, intermediate reasoning steps, and tool calls that never touch that boundary directly.

Observability and governance

→

WitnessAIGovernance visibility and policy management across AI agent activity.

→

Noma SecurityMonitoring and risk detection across AI agent and application usage.

→

Protect AIModel and pipeline security scanning, acquired by Palo Alto Networks in 2025.

→

HiddenLayerModel-layer security, focused on protecting models themselves from extraction and manipulation.

→

Prompt SecurityPrompt-level inspection and policy management, acquired by SentinelOne.

→

MindgardAI red-teaming and vulnerability assessment for models and agents.

→

FencioLogs every enforcement decision (allow, deny, redact) as exportable, tamper-ready evidence, giving audit trail visibility into what an agent attempted and why it was or wasn't allowed to proceed.

WHAT THIS CATEGORY COVERS

Knowing what's happening and flagging risk. What it doesn't do: stop an action from executing in the moment it's attempted.

Runtime enforcement

→

FencioDeterministic, rule-based enforcement running on the agent's execution path itself, not just at input/output. Evaluates every action against context, content, and intent before allowing it, using a whitelist model where only explicitly approved behavior is permitted by default. Runs on a purpose-built embedding model rather than a second generative model judging the first.

→

Straiker (Defend AI)Detection and policy management focused on agent traffic patterns.

→

Lasso SecurityLLM and MCP-focused security, including an open-source MCP security gateway.

→

Microsoft Agent Governance ToolkitOpen-source governance toolkit covering OWASP Agentic Top 10 controls across multiple frameworks.

WHAT THIS CATEGORY COVERS

Stopping an unsafe action before it happens, not just flagging it after. The tradeoff to evaluate: how the tool behaves during an outage (fail-open vs. fail-closed), and how much integration work is required to sit on the execution path.

Pre-production testing and red-teaming

→

Fencio (Shark)Automated red-teaming that builds a recon profile of an agent and runs structured attack simulations against it pre-deployment, feeding findings into runtime policy.

WHAT THIS CATEGORY COVERS

Most mature security postures combine a pre-production testing step with runtime enforcement, rather than relying on either alone.

Which category fits your gap

If you don't yet know whether your agents can be manipulated, start with pre-production testing. If you need visibility into what agents are doing across your organization, start with observability and governance. If you already know an agent is going live and needs a hard boundary on what it's allowed to do once it's there, that's runtime enforcement.

Most enterprise agent deployments end up needing more than one of these, not a single tool covering everything.