The AI Security Market Map
AI security spans three areas: protecting the AI your organization uses, buys, and builds; using AI to perform security work; and defending against AI-enabled attacks. Organized around security use cases, this map connects those needs to 26 capability categories, representative solutions, and evaluation criteria for extending existing controls or investing in new capabilities.
Security of AI
Start by finding where employees use AI, which AI systems and agents are deployed, and what data they can reach.
Then test the network, cloud, application, identity, and data controls already in place. Each category shows what to test and which gaps may justify an AI-focused product.
Control workforce AI use
Security of AI · Control workforce AI use
1 Workforce AI access and usage security
Who's using which AI services, and what do we allow?
Employees reach AI through public chatbots, SaaS copilots, desktop assistants, and IDE agents. Security needs to know who used each service, what they sent, and whether policy allowed it. A browser or proxy may see only part of that traffic.
- Find sanctioned and unsanctioned AI across browsers, SaaS copilots, desktop applications, extensions, IDEs, and APIs
- Tie each interaction to a user, device, service, and session
- Allow, block, coach, or grant an exception based on the user, group, service, and data involved
- Inspect prompts, uploads, responses, and copy-and-paste activity, then send a usable record to DLP, SIEM, and incident workflows
Ask your SSE, secure browser, CASB, and DLP vendors to demonstrate every route employees use. If an IDE agent can send source code to an external model without attribution or policy enforcement, you still have a gap.
Send a synthetic confidential file through a public chatbot, sanctioned copilot, SaaS feature, desktop application, IDE agent, and API. Set the expected result for each route: allow, coach, block, or escalate. Confirm that every event identifies the user, device, or service identity and leaves an investigation record.
Track the share of AI transactions tied to a user, device, or service identity. List unmonitored routes separately.
Use this category to control which AI services employees can use and what they can send. Use AI data access and exposure security to control what an AI application can retrieve or reveal.
Govern AI risk and posture
Security of AI · Govern AI risk and posture
2 AI governance and assurance
Who owns each AI use case, who approved it, and where's the evidence?
For every purchased, embedded, or internally built AI use case, record the owner, purpose, risk decision, required controls, and current evidence. Reassess it when the model, data, purpose, or deployment changes.
The EU AI Act’s general application date was 2 August 2026. Sections 1, 2, and 3 of Chapter III apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Record which obligations apply and why.
- Inventory AI use cases, models, agents, owners, and third parties
- Classify risk against the business purpose, affected people, and applicable obligations
- Run approval, exception, review, and retirement workflows
- Connect every use case to required controls and current evidence
- Trigger reassessment when the model, data, purpose, deployment, or applicable obligation changes
Test whether existing GRC, TPRM, privacy, and service-management platforms can inventory AI and reopen assessments after material changes. Add a platform when they cannot connect each use case to its owner, obligations, evidence, and review history.
Take one production use case through approval and a material change. Confirm that the product preserves the owner, decision, controls, evidence, exceptions, and next review.
Track the share of production AI with a named owner, completed assessment, current evidence, and scheduled review. Time a complete inventory for one business process or regulated decision.
This category records who approved an AI use case, which rules apply, and where the evidence lives. Technical controls are covered in AI security posture management and the following categories for components, applications, agents, and data. Model quality, fairness, moderation, and general ethics reviews belong elsewhere unless they test a security requirement. Using AI to review security evidence and assess controls belongs in AI compliance evidence and control assessment.
Security of AI · Govern AI risk and posture
3 AI security posture management
Which AI assets and configurations are exposing us right now?
The security inventory may miss a public model endpoint, a notebook running under an over-privileged identity, or an agent connected to a sensitive datastore. AI security posture management should find those deployed resources and show which configuration, identity, data connection, or network path creates the exposure.
- Maintain a current inventory of deployed AI applications, models, agents, services, notebooks, and endpoints
- Connect each asset to its code, model, data, identity, infrastructure, and owner
- Find configuration errors, vulnerable components, public exposure, and attack paths
- Detect drift when assets, connections, or permissions change
- Assign remediation and verify that the exposure was removed
- Aqua Security
- CrowdStrike Falcon Cloud Security AI-SPM
- Microsoft Defender for Cloud AI-SPM (Agent 365 for agent inventory)
- Orca Security
- Palo Alto Networks Prisma AIRS AI Posture Management Assesses AI components, data exposure, and access to deployed models.
- Tenable One AI Exposure
- Wiz AI-SPM
- Zscaler AI Asset Management
- Akto
- Cranium AI
- Cyera Agent Guardian AI-SPM Maps AI assets to identities, data access paths, and exposure risks.
- Noma Security
Test your CNAPP, CSPM, and cloud security platforms first. Add AI-specific coverage when they miss a model, notebook, agent, MLOps environment, or the identity and data exposed through it.
Expose a model endpoint or grant excessive notebook permission in an approved environment. Confirm that the product finds the asset, traces the identity and data at risk, assigns the fix, and verifies remediation.
Track owned and assessed AI assets, exposed or unmanaged endpoints, and time to verified remediation.
Use AI governance and assurance to record why an AI use case was approved. Use this category to find exposed AI assets and unsafe configurations. For employee use, start with workforce AI security; for model and tool dependencies, use AI component and supply-chain security.
Back to the map ↑Next: AI component and supply-chain security →
Secure AI applications across the lifecycle
Security of AI · Secure AI applications across the lifecycle
4 AI component and supply-chain security
Can we trust the models, tools, and data our AI systems depend on?
An AI application may load an executable model file, use a vulnerable library, ingest poisoned data, or connect to a malicious MCP server. Security needs to know where each component came from, whether it changed, and whether it passed an approved check before deployment.
- Inventory models, datasets, libraries, tools, plugins, and MCP servers
- Scan model files and dependencies for malware, secrets, and known vulnerabilities
- Verify signatures, hashes, provenance, and data lineage
- Check training, tuning, and retrieval data for poisoning or unauthorized change
- Enforce policy at hubs, registries, CI/CD pipelines, MLOps pipelines, and production promotion
- Cisco AI Defense, including Robust Intelligence
- Palo Alto Networks Prisma AIRS AI Model Security Scans third-party models for malicious code, tampering, and deserialization risks.
Test AppSec, supply-chain, container, cloud, and MLOps controls against AI components. Add coverage for model files, public model hubs, dataset provenance, AI bills of materials, and MCP components those tools cannot inspect.
Test a malicious or altered example of each supported component type, including an MCP server or tool description. Confirm that the check runs before promotion and records why it blocked the component.
Track the share of production components that followed an approved path, artifacts with unknown provenance, and time from failed check to removal or exception.
Use this category to verify the integrity and origin of models, data, libraries, and tools. Use AI security testing and red teaming to attack the assembled system and AI data access and exposure security to control the data it can reach.
Security of AI · Secure AI applications across the lifecycle
5 AI application runtime security
How do we catch and stop an attack in the middle of an AI interaction?
An attacker can hide instructions in a prompt, document, web page, image, or retrieved record. The model may expose sensitive context or produce output the application handles unsafely. Runtime controls inspect the interaction, enforce policy, and preserve the session for investigation.
- Inspect prompts, responses, retrieved content, files, images, and URLs
- Detect direct and indirect prompt injection, jailbreaks, and any additional attack types the vendor claims to cover
- Block sensitive disclosure and unsafe output before the application uses it
- Apply policy consistently across models and application teams
- Record the session, decision, latency, and alert for SIEM and incident workflows
- F5 AI Guardrails, built on CalypsoAI
- Lakera Guard by Check Point
- Lasso
- NeuralTrust
- Oligo Runtime AI Security
- Pillar Security
- Prompt Security by SentinelOne
- Straiker
- TrojAI by A10 Networks
- Cisco AI Runtime Protection
- FortiAIGate
- Netskope One AI Guardrails
- Palo Alto Networks Prisma AIRS AI Runtime Security Applies safeguards against manipulation and data exposure during live AI interactions.
- Trend Vision One AI Guard
- Zscaler AI Gateway
Test controls from the model provider or AI platform. Add a gateway or specialist when several providers need one policy, attacks go undetected, or security lacks centralized session records.
Place an indirect prompt injection in retrieved content. Check the enforcement decision and SIEM record, measure added latency, then repeat with similar benign content.
Measure attack success, false positives, false negatives, application coverage, and p95 latency.
Use this category to inspect prompts, retrieved content, and model responses. Use AI agent action control to control the tool calls, transactions, messages, and file changes that follow.
Back to the map ↑Next: AI security testing and red teaming →
Security of AI · Secure AI applications across the lifecycle
6 AI security testing and red teaming
How can our AI be manipulated, and do our defenses hold?
A model can pass a benchmark and fail once connected to the organization’s prompts, data, tools, and permissions. Security testing attacks the assembled system before release and after material changes. Findings must reproduce the failure and prove whether the fix holds.
- Build a threat model and test plan around the system’s purpose, data, and access
- Combine automated attack libraries with adaptive human-led testing
- Exercise prompts, models, RAG, tools, agents, and multimodal inputs
- Produce reproducible findings with evidence, impact, and remediation guidance
- Verify fixes and retain regression tests for releases and material changes
- Enkrypt AI
- Giskard
- Gray Swan
- HiddenLayer
- Lakera Red by Check Point
- Mindgard
- Netskope One AI Red Teaming
- SplxAI
- Trend Vision One AI Scanner
- Virtue AI
- Zscaler AI Security
Use built-in tests for regression. Bring in a specialist or independent assessment when the system can approve access, move money, affect employment or safety, support a regulated decision, or test its own controls.
Reproduce a failure in your application. Preserve the input, model, configuration, retrieval state, and permissions. Apply the fix, rerun the attack, and test nearby variations.
Track tested paths, reproducible findings, remediation time, successful retests, and failures that return after a system change.
Use this category to attack the AI system itself. Use AI-led security testing and validation to test infrastructure and conventional applications. General accuracy testing belongs elsewhere unless it tests a defined security failure.
Back to the map ↑Next: AI agent identity and authorization →
Control AI agents
Security of AI · Control AI agents
7 AI agent identity and authorization
Who does this agent act for, and what is it allowed to do?
An agent may use an API key, service account, OAuth token, or delegated user session. Security needs to identify the agent and its owner, record the user or application it represents, and restrict its authority to the task. A coding agent, for example, may hold repository credentials, cloud tokens, and MCP connections.
- Discover agents, credentials, owners, sponsors, and connected systems
- Give each agent or agent instance a distinct, verifiable identity
- Preserve delegated user and application context through the task
- Issue least-privilege, short-lived credentials scoped to the task
- Record provisioning, approval, use, expiry, revocation, and decommissioning
- Cisco (Astrix Security)
- Cyera Agent Guardian Maps agents to identities and access rights to inform authorization policies; evaluate identity lifecycle coverage separately.
- Microsoft Entra Agent ID, in Microsoft Agent 365
- Okta for AI Agents
- Palo Alto Networks Idira, built on CyberArk
- SailPoint Entro
- Saviynt Zuma
- ServiceNow Veza
Test IAM, PAM, secrets management, and non-human identity controls for agent coverage. Add agent-specific tooling when agents bypass provisioning, lose delegated context, or cannot receive credentials scoped to one task.
Let an agent read a record but not modify it. Confirm that the system preserves its sponsor, blocks the write, records the decision, and expires the credential after the task.
Track agents with verified identities, owners, sponsors, scoped credentials, and expiry dates. Measure standing privilege removed and unauthorized operations blocked.
Use this category to establish who an agent is, whom it represents, and its maximum access. Use AI agent action control to decide whether a specific action is allowed. Use existing non-human identity controls for workloads and service accounts that are not AI agents. Using AI to recommend access grants or removals belongs in AI access reviews and entitlement management.
Security of AI · Control AI agents
8 AI agent action control
What is this agent actually doing, and can we stop it mid-action?
An agent can change a file, commit code, call an API, issue a refund, or disable an account. A valid credential may allow an action that is wrong for the current task. Security must check each proposed action before execution and be able to stop, contain, or reverse it.
- Trace plans, prompts, tool calls, parameters, results, memory, and agent handoffs
- Check policy before a tool call or transaction executes
- Require human approval for destructive, privileged, financial, or external actions
- Enforce limits on tools, data, destinations, rates, costs, and transactions
- Pause or kill the agent, revoke credentials, contain the result, and support recovery
- Lumia Security
- Noma Agent Access Control Governs agent access to tools and monitors runtime behavior to stop risky actions.
- Operant AI
- Runlayer
- Zenity
- Check Point AI Agent Security
- Cyera Agent Guardian Monitors agent prompts and actions and applies runtime guardrails to risky data operations.
- Netskope One Agentic Broker
- Palo Alto Networks Prisma AIRS Agent Security Verifies agent identity and enforces runtime controls against unauthorized actions.
- Saviynt Zuma Access
- Zscaler AI Broker
Test controls in the agent platform, IAM system, API gateway, and AI runtime product. Add a control when the stack cannot reconstruct an agent’s actions, enforce policy before execution, or contain the result.
Trigger a prohibited action and confirm that it stops before execution. The record should connect the user, agent, prompt, session, tool call, and decision. Then allow a controlled unsafe action and test revocation, containment, reversal, and memory cleanup.
Track tool calls checked before execution, actions requiring approval, violations stopped, and time to contain and reverse an unsafe action.
Use AI application runtime security to inspect prompts and model responses. Use AI agent identity and authorization to set the agent’s identity and maximum access. Use this category to approve or block the action it is about to take. An MCP gateway is one possible control point.
Back to the map ↑Next: AI data access and exposure security →
Protect data exposed to AI
Security of AI · Protect data exposed to AI
9 AI data access and exposure security
What sensitive data can AI reach, retrieve, or leak?
An assistant may retrieve an over-shared document, expose sensitive text from a vector index, or retain regulated data in memory. Security must trace the data and its permissions through indexing, retrieval, prompts, responses, and memory.
- Discover and classify data connected to AI applications and copilots
- Trace lineage from source records through indexes, prompts, retrieval, responses, and memory
- Calculate effective permissions and identify overexposed information
- Scan RAG corpora, vector stores, copilot indexes, and agent memory
- Correct entitlements, enforce DLP, and preserve access, retention, deletion, and residency evidence
- Concentric AI
- Cyera Agent Guardian and Data Security Platform Combines data sensitivity and access context to assess agent data exposure and trace accessed files.
- Nightfall AI
- Securiti
- Sentra
- Varonis
Test DSPM, DLP, information protection, access governance, and repository permissions against AI data paths. Add AI-specific coverage when those products cannot see retrieval paths, vector stores, copilot indexes, agent memory, or inherited permissions.
Give an assistant access to a synthetic sensitive document that its user cannot open directly. Confirm that the product finds the exposure, prevents disclosure, traces the source permission, and verifies the fix.
Track classified AI data sources, overexposed objects, correction time, leakage-test results, and false positives.
Use Workforce AI access and usage security to control which AI services employees may use and what they may send. Use AI application runtime security to block attacks during an AI interaction. Use this category to control what data AI can reach, retain, and disclose. Evaluate AI-driven classification and protection across enterprise data in AI-assisted data protection; test attacker-driven collection and transfers in Data theft and exfiltration defense.
AI for Security
Use AI to investigate incidents, improve detections, automate security workflows, and find and fix weaknesses. It also supports access decisions, data protection, and assessment of security controls. These nine categories cover both established AI and machine learning and newer generative and agentic capabilities.
Start with the platforms you already operate. Test the specific AI capability against your current process, using the same evidence and task. Compare outcome quality, review effort, and completion time. Apply the tests relevant to its role, including approval and integration requirements; no listing implies complete category coverage. Evaluate specialists where existing capabilities leave a demonstrated gap.
Investigate, detect, and respond
AI for Security · Investigate, detect, and respond
10 AI SOC investigation and response
Can AI investigate an alert, explain its verdict, and stay within its authority?
What AI does: AI gathers incident evidence, assesses alerts, and supports case decisions. Capabilities range from triage assistance to investigation and permitted response. Test evidence collection, timelines, verdicts, and acknowledged gaps according to the claimed role. Response requires defined permissions, approval gates, and reversal or recovery procedures.
- Take in, group, and prioritize alerts without hiding the original signals
- Collect relevant evidence across the security stack and build a timeline
- Show the evidence and uncertainty behind each verdict
- Separate the permissions to recommend, approve, and execute each response action
- Record actions, analyst overrides, and reversal or recovery outcomes
- 7AI Agentic Security Platform Investigation agents gather evidence across connected tools and develop case findings.
- Arcanna.ai AI-assisted triage and decision support informed by analyst feedback.
- Crogl AI SOC Queries connected tools and documents investigations for analyst decisions.
- Dropzone AI SOC Analyst Investigates alerts and presents supporting evidence and reasoning.
- Intezer AI SOC Combines AI triage with forensic analysis and configurable response.
- Prophet AI SOC Analyst Investigates alerts and supports response through scoped Agent Actions.
- Qevlar AI Structured incident investigations use AI for bounded tasks such as evidence enrichment.
- Conifers CognitiveSOC Investigation and remediation agents within a broader SOC platform.
- D3 Security Morpheus Correlates alert evidence, investigates incidents, and drafts or executes response under configured approval gates.
- Exaforce Exabot Investigate and Respond Investigation and response agents, available in self-managed or MDR delivery.
- Simbian AI SOC Agent Investigates security alerts and develops verdicts using organizational context.
- Swimlane AI SOC Uses Hero AI for alert investigation and reasoning, with Turbine providing governed automation.
- Torq Socrates AI SOC agents investigate alerts and coordinate incident response with analyst oversight.
- CrowdStrike Charlotte AI Detection Triage Evaluates Falcon detections and supplies verdicts, confidence, and recommendations.
- Google SecOps Triage and Investigation agent Investigates alerts, adds threat intelligence, and explains its verdicts.
- Microsoft Security Copilot Supports incident analysis and response guidance using connected security context.
- Palo Alto Networks Cortex AgentiX Case Investigation Agent Enriches case indicators, queries logs, and assists investigation and response.
- SentinelOne Purple AI Agentic Investigation Analyzes alerts, surfaces evidence, and recommends investigation follow-ups.
Consider a specialist when AI in the SIEM, XDR, or SOAR stops at alert summarization, cannot investigate across products, or cannot control response actions.
Give the product closed cases with the dispositions hidden, including false positives, incomplete telemetry, identity incidents, and cases spanning several tools. Compare its work with experienced analysts, then run it in shadow mode. Before enabling response, test approved low-risk actions and verify that an out-of-policy request is refused without execution.
Measure missed evidence, incorrect dispositions, analyst time, rejected recommendations, time to containment, and unauthorized or reversed actions.
Evaluate investigation quality and incident decisions here. Use threat hunting and detection engineering for proactive searches and rules, and workflow automation for building and executing workflows, including on platforms such as Cortex AgentiX. Attack detection and containment tests defenses against AI-enabled attackers.
Back to the map ↑Next: AI threat hunting and detection engineering →
AI for Security · Investigate, detect, and respond
11 AI threat hunting and detection engineering
Can AI find activity our alerts missed and turn detection gaps into working rules?
What AI does: AI develops hunting hypotheses, queries security data, interprets results, and helps draft or tune detection logic. Hunting looks for activity that has not produced an alert; detection engineering turns relevant behaviors into repeatable monitoring. A threat summary or a rule that only looks plausible is not a completed result.
- Tie hypotheses and proposed detections to relevant adversary behavior and available telemetry
- Show queries, searched time ranges, evidence, and data sources that were unavailable
- Validate field names, query syntax, and rule logic against the deployed schema
- Test new detections on malicious and benign activity before approval
- Version rules, preserve reviewer changes, and retest after telemetry or parser changes
- Dropzone AI Threat Hunter Runs hypothesis-driven hunts across connected telemetry.
- SentinelOne Purple AI Supports analyst-led hunting through natural-language queries and follow-up analysis of security data.
- Anvilogic Agentic Detection Engineering Supports threat research, gap analysis, rule validation, and deployment.
- Google SecOps Detection Engineering Agent Preview: evaluates coverage and drafts YARA-L rules; publication requires human review and manual creation.
Evaluate the hunting and detection tools already connected to your telemetry. A specialist may help when they cannot query across the required environments, produce usable detection logic, or maintain it as the data changes.
Use an approved dataset containing known attack behavior, benign lookalikes, and a missing log source. For hunting, withhold the expected findings and inspect hypotheses, queries, evidence, and acknowledged gaps. For detection engineering, execute proposed rules against the real schema and malicious and benign events; change a field or parser and repeat.
Measure missed behavior, unsupported conclusions, and analyst effort for hunts; query failures, false positives, and maintenance effort for detections. Distinguish an empty result from an inability to search.
This work can begin without an alert. Use AI SOC investigation and response for case disposition and containment, and AI-led security testing and validation to execute attacks against systems. Threat-intelligence interpretation belongs here when it leads to a hunt or detection; summarization alone does not qualify.
AI for Security · Investigate, detect, and respond
12 AI security workflow automation
Can we automate security work across tools while controlling every consequential action?
What AI does: AI interprets unstructured inputs, selects tools or workflow branches, and helps build or execute security tasks. Deterministic steps remain useful for predictable checks and actions. Evaluate how the platform combines both approaches, including what happens when a task fails partway through.
- Define permitted tools, data access, execution identities, and action limits
- Keep approval checks outside the model’s discretion for consequential changes
- Combine AI decisions with explicit workflow rules and human review
- Handle retries, duplicate requests, partial completion, and unavailable integrations
- Record inputs, decisions, approvals, actions, and compensating changes
- BlinkOps Agentic security workflows and tool orchestration.
- D3 Security Morpheus Combines playbooks and agentic tasks with orchestration, integrations, and response approval controls.
- Swimlane Turbine Builds and executes workflows that combine deterministic steps, AI agents, and human approvals.
- Tines AI Agent Tool-using agents within task and interactive workflows.
- Torq Builds and orchestrates security workflows across integrated tools and AI agents.
Start with the orchestration and automation capabilities already integrated into your environment. Add another platform only when required permissions, integrations, approval controls, or recovery behavior cannot be implemented reliably.
Run a workflow that enriches a case, requests approval, and performs an approved containment action. Deny one approval, interrupt an API call after it succeeds, repeat the request, and introduce malicious instructions in an input document. Check that no step exceeds its authority and that partial completion is reported accurately.
Track unauthorized or duplicate actions, successful recovery from failures, integration maintenance, operator interventions, and time saved. Identify irreversible actions before enabling them.
This category evaluates the workflow platform and execution controls. AI SOC investigation and response evaluates investigation quality. AI agent action control covers controls that secure your AI agents across use cases; those controls may also be needed here.
Back to the map ↑Next: AI exposure analysis and remediation →
Find, fix, and validate weaknesses
AI for Security · Find, fix, and validate weaknesses
13 AI exposure analysis and remediation
Can AI identify which exposures matter most and help close them safely?
What AI does: AI combines exposure findings with asset, threat, and business context to support prioritization and remediation. Depending on the product, it may explain risk, recommend fixes, assign work, or coordinate approved actions. Require evidence for each step rather than treating a generated risk narrative as proof that an exposure is closed.
- Identify the evidence, asset context, and assumptions behind each priority
- Distinguish reachable exposures from findings mitigated by existing controls
- Propose fixes with affected dependencies, owners, and operational constraints
- Separate recommendations from approved changes and execution
- Verify closure using fresh evidence and reopen failed or incomplete fixes
- Qualys Risk Operations Center AI agents support threat prioritization and remediation strategies.
- Rapid7 Exposure Command AI risk insights and remediation guidance within exposure workflows.
- Tenable One with Hexa AI Agentic orchestration connects exposure context, human approvals, and actions.
- Wiz AI-powered remediation Generates cloud remediation guidance using resource context and attack-path combinations.
- Seemplicity Remediation Agent Provides asset-specific resolution guidance within findings and remediation workflows.
Test the relevant AI module in your exposure-management platform using your own assets and change process. Better data integration or remediation ownership may resolve the gap before another product is needed.
Provide a mixed exposure backlog with an internet-facing weakness, a high-severity but unreachable finding, a lower-severity attack path, and a business-critical asset with change restrictions. Hide the expected priorities. Review the evidence, approve a limited fix, and confirm closure independently.
Track missed material exposures, unsupported priorities, accepted and rejected recommendations, time to verified closure, failed changes, and reopened findings. Compare with the existing prioritization process.
Evaluate AI’s analysis and remediation work here. Rapid exploitation defense tests time to protection, whether or not the defender uses AI. Security testing and validation supplies attack evidence; application security analysis and remediation covers code-level fixes.
Back to the map ↑Next: AI application security analysis and remediation →
AI for Security · Find, fix, and validate weaknesses
14 AI application security analysis and remediation
Can AI find or assess a software weakness and produce a fix that remains secure and functional?
What AI does: AI helps analyze code and findings, explain vulnerable behavior, and propose security fixes. Some products use AI for discovery; others start with findings from static analysis and use AI for repair. The code may be written by people or AI. Evaluate the security outcome and supported languages rather than the origin of the code.
- Preserve the vulnerable code path, finding source, and relevant application context
- Show supported languages, issue types, and analysis limitations
- Generate reviewable patches with explanations and focused security tests
- Recheck the weakness after the change and run functional regression tests
- Keep repository access, pull requests, and merge authority within existing controls
- Semgrep Multimodal and Autofix Combines static analysis with AI detection and triage; Autofix proposes code changes for supported findings.
- Snyk Code with Snyk Agent Fix AI-generated fixes for Snyk Code vulnerabilities; formerly DeepCode AI Fix.
- GitHub Copilot Autofix Generates suggested fixes from code-scanning alerts.
- SonarQube AI CodeFix Suggests fixes for supported analysis findings, including security vulnerabilities.
- Mobb Fixer Uses hybrid AI and validated fix patterns to produce reviewable patches for supported SAST findings.
Evaluate the AI analysis and fix capabilities in your existing application-security and development platforms. A separate product should close a demonstrated language, context, finding-quality, or remediation gap.
For analysis, use representative repositories with confirmed weaknesses and benign lookalikes; measure valid findings and missed vulnerabilities. For repair, supply confirmed findings but withhold expected fixes. Review each patch, reproduce the original attack, and run security and functional tests. Include a finding that lacks enough context for a safe fix.
Measure remaining exploitable weaknesses, defects introduced, accepted fixes, and developer review time. Attribute discovery results to the scanner or AI analysis capability; evaluate a repair-only feature on the fixes it produces.
This category includes AI-assisted security analysis and repair of conventional software. Generic coding assistance and the full AppSec market are outside scope. AI component and supply-chain security covers AI-specific components; AI-led security testing and validation covers attacks against running systems.
Back to the map ↑Next: AI-led security testing and validation →
AI for Security · Find, fix, and validate weaknesses
15 AI-led security testing and validation
Can AI guide testing that proves exploitable paths and verifies our fixes?
What AI does: AI can select or generate tests, orchestrate validation, or adapt attack sequences to target responses. These are different contributions: a validation agent may direct a deterministic test engine. Require evidence of the named capability’s work; scan scheduling or fixed-library replay alone does not establish AI-led testing.
- Enforce scope, exclusions, rate limits, and an emergency stop
- Support credentialed and uncredentialed tests with explicit execution safeguards
- Validate exploitable weaknesses and the attack paths connecting them
- Tie evidence to affected assets, business impact, and remediation owners
- Retest fixes and show whether the path was closed
- Hadrian Agentic Penetration Testing AI-driven testing investigates weaknesses and validates exploitable attack paths.
- Horizon3.ai NodeZero Combines graph-based attack planning with ML and scoped generative AI assistance.
- RunSybil Sybil Tests application logic, chains weaknesses, and validates exploitability.
- XBOW Autonomous application testing validates findings through exploit execution.
- AttackIQ AVA Agentic OS Orchestrates AI agents for adversary emulation and security-control validation.
- Cymulate Cowork AI agents coordinate validation, analysis, and action across defense workflows.
- Pentera AI-powered exposure validation AI adapts payloads and attack progression within a deterministic execution engine.
- Picus Swarm Specialized AI agents coordinate pentesting, exposure validation, and attack simulation.
- SafeBreach Helm AI orchestration connects validation and analysis; Validate and Propagate supply underlying test capabilities.
Consider a separate product when current breach-and-attack simulation, penetration-testing, and exposure-validation tools cannot provide frequent, adaptive testing across the required environments.
In an approved test environment, provide an objective and scope while withholding a known attack path. Inspect AI-selected or generated tests, execution evidence, and human inputs. Then change a permission, reachable service, or application behavior. Check whether test selection, orchestration, or attack progression adapts as claimed, and whether the finding is reproducible. Apply a fix and verify closure.
Submit an out-of-scope request and verify refusal without execution. Measure validated findings, false positives, operator effort, retest accuracy, and scope violations against the existing testing process. Separate AI recommendations from actions the test engine actually performed.
Test conventional applications and infrastructure here. AI security testing and red teaming targets AI systems; application security analysis and remediation covers code-level fixes; exposure analysis and remediation prioritizes closure. Independent assessment remains necessary where business logic or consequences require judgment.
Back to the map ↑Next: AI access reviews and entitlement management →
Protect access and data
AI for Security · Protect access and data
16 AI access reviews and entitlement management
Can AI improve access decisions without preserving excessive privileges or removing access people need?
What AI does: AI and ML compare identities, roles, usage, and risk to recommend access grants, retention, or removal. Capabilities range from peer-based recommendations to assistants supporting review workflows. Human approval does not remove the need to test recommendation quality, and common access patterns are not proof that access is appropriate.
- Explain recommendations using identity, entitlement, usage, and risk evidence
- Identify missing, stale, or unsupported identity data and defer uncertain decisions
- Handle privileged access, exceptions, role changes, and separation-of-duties requirements
- Keep review, approval, and provisioning authorities explicit
- Verify changes in the target application and preserve the reviewer’s rationale
- Microsoft Entra ID Governance access-review recommendations ML-based user-to-group affiliation recommendations for supported reviews.
- Omada Identity AI capabilities Contextual access recommendations and entitlement assistance.
- SailPoint Access Recommendations Peer and identity analysis supporting access decisions.
- Saviynt Intelligence Risk- and behavior-informed access-review recommendations.
Check which recommendation and review capabilities your identity-governance platform already provides. Correct entitlement ownership and directory quality first when they prevent a reliable decision.
Create a review set with known excessive privileges, legitimate exceptions, recent role changes, and an overprivileged peer group. Withhold the expected decisions. Compare recommendations with owner review, then verify a limited set of approved revocations in the target systems.
Track inappropriate approvals, unnecessary revocations, unreviewable recommendations, verified access removal, reviewer overrides, and business disruption. Separate time saved from access risk reduced.
This category uses AI to improve access governance. AI agent identity and authorization secures the identities and delegated access of AI agents themselves. Identity and account protection addresses account compromise and adversarial session activity.
AI for Security · Protect access and data
17 AI-assisted data protection
Can AI recognize sensitive information in context and help protect it without disrupting legitimate work?
What AI does: AI and ML recognize sensitive content, infer context, and support labeling, exposure assessment, and protection decisions. Established classifiers belong here alongside newer generative capabilities. Protection may depend on policy engines or integrations: identifying a sensitive file does not by itself block a transfer or remove excessive access.
- Discover and classify supported structured and unstructured data, including organization-specific content
- Distinguish sensitivity using meaning, context, and business use, with reviewable evidence
- Connect classifications to labels, DLP policies, access changes, or remediation workflows
- Identify unsupported repositories, languages, encrypted content, and transfer paths
- Review uncertain results and retest classifications and policies as content changes
- BigID Prompt-Based Classification Uses natural-language criteria for contextual discovery and classification.
- Cyera AI-powered classification Classifies content and sensitivity, with labeling and downstream integrations.
- Microsoft Purview trainable classifiers Classifiers can support sensitivity labeling and DLP in supported workloads.
- Netskope One DLP file classifiers ML document and image classifiers usable in DLP profiles.
Test the classifiers, labeling, and enforcement integrations already available in your DLP, DSPM, and information-protection platforms. Add a specialist for a demonstrated content, repository, accuracy, or enforcement gap.
Use a held-out set of sensitive and non-sensitive documents, organization-specific material, and similar-looking public information. Include supported languages and formats plus an unsupported case. Review classifications, then attempt approved and prohibited actions to check the actual policy outcome.
Measure missed sensitive content and incorrect labels by data type, unnecessary blocks, successful unauthorized transfers in the test, verified access changes, review effort, and policy drift. Report discovery coverage separately from enforcement coverage.
Evaluate AI performing enterprise data-protection work here. AI data access and exposure security limits what AI systems can retrieve or disclose. Data theft and exfiltration defense tests controls against AI-enabled attackers. A shared platform still requires different evidence for each job.
Back to the map ↑Next: AI compliance evidence and control assessment →
Assess security controls
AI for Security · Assess security controls
18 AI compliance evidence and control assessment
Can AI assess security evidence and identify gaps without inventing assurance?
What AI does: AI collects or interprets security evidence, maps documents to control requirements, and identifies missing or contradictory information. It can support internal assessments and supplier reviews. A policy statement is not evidence that a control operates, and a generated response must not turn an unsupported claim into an approval.
- Link conclusions to source evidence, scope, dates, and applicable requirements
- Distinguish policy intent, control design, and evidence of operating effectiveness
- Flag missing, stale, conflicting, or out-of-scope material
- Record reviewer decisions, exceptions, and follow-up work
- Limit access to sensitive evidence and preserve a reproducible assessment trail
- Secureframe AI Evidence Validation Reviews uploaded evidence for missing, outdated, or mismatched material.
- Vanta Agent Supports evidence collection, document review, and assessment workflows.
- Drata AI Includes policy-to-control mapping, test-failure insights, and agentic third-party assessments.
- OneTrust AI Evidence Analysis Reviews submitted evidence against defined control requirements and identifies gaps. Availability depends on environment and packaging.
Evaluate the AI capabilities in your existing GRC and assurance platforms against actual evidence and control requirements. Another product is justified only if it improves coverage, traceability, or review quality in the required workflow.
Provide an evidence pack with an expired report, a control excluded from scope, an unresolved exception, and a policy contradicted by a technical test. Ask the tool to assess defined controls, cite its evidence, and identify what still needs verification. Have a qualified reviewer compare the results.
Track unsupported positive conclusions, missed exceptions, incorrect control mappings, source traceability, reviewer corrections, and assessment time. Human owners retain risk acceptance and final assurance decisions.
This category uses AI to assess cybersecurity controls and evidence. AI governance and assurance governs the organization’s AI use and systems. Generic report writing, questionnaire completion without assessment, and assurance outside cybersecurity do not establish category fit.
Back to the map ↑Next: AI impersonation and deepfake defense →
Defense Against AI-Enabled Attacks
Attackers use AI to improve reconnaissance, develop exploits, craft convincing deception, and automate parts of an intrusion. This area maps the defenses that protect people, systems, and data against those attacks.
Each category explains what AI changes, what to test, and where established platforms or specialist solutions fit. Start with the controls you already operate, then assess whether their coverage and response speed are sufficient and where additional capabilities are needed.
Verify identity against impersonation
Defense Against AI-Enabled Attacks · Verify identity against impersonation
19 AI impersonation and deepfake defense
Can we verify the person requesting access, money, employment, or another sensitive action?
What AI changes: Synthetic voices and video weaken recognition as an identity check. Evaluate media-manipulation detection alongside independent verification and a safe fallback. Test those controls inside the actual help-desk, payment, or hiring workflow, where compression, latency, and uncertainty affect the decision.
Reported campaign: The FBI documented AI-generated voice impersonation used to gain trust and pursue account access. Detection must be paired with independent verification.
- Detect replay, injection, and synthetic or altered audio and video in live and recorded media
- Correlate the result with identity, device, session, or prior-enrollment signals
- Show the result, verification step, and safe fallback inside the workflow where the decision is made
- Preserve evidence and report latency, false positives, false negatives, and performance drift
Add specialist detection where an access, payment, hiring, or recovery workflow relies on live audio or video and needs to recognize manipulation.
Use the real call or meeting path. Test genuine and cloned voices, video injection, replay, compression, noise, accents, languages, and poor connections. An uncertain result must give the employee a clear next step and record the decision.
Measure false acceptance and rejection by media, channel, and condition. Track added time, completed verification, and high-risk actions that continued after an uncertain result.
Use Email and collaboration security for phishing and business email compromise, and Identity and account protection for account protection. This category covers synthetic-media detection and verification in high-risk workflows, including supporting forensic analysis. General KYC, disinformation, and content provenance remain outside this map.
Defend enterprise systems and data
Defense Against AI-Enabled Attacks · Email and collaboration
20 Email and collaboration security
Can we stop convincing malicious messages without obvious warning signs?
What AI changes: Attackers can use AI to tailor persuasive messages to a person and context. Evaluation should include fluent, personalized conversations with no malicious attachment or obvious language errors. Test whether content, relationship, and account signals together reveal the deceptive request, including messages sent from a compromised trusted account.
Reported campaign: Microsoft documented AI-personalized phishing lures and automated account compromise. The tests below extend that evidence to the messaging channels in use.
- Analyze content, sender identity, relationships, and account activity together
- Detect phishing and BEC without a known malicious link or attachment
- Identify compromised accounts and remove malicious messages
- Verify protection across the email and collaboration channels in use
Ask for results on these scenarios using your licensed features and enabled channels. Supplement or replace only where a material gap remains.
In a controlled test, use personalized payment and credential requests, including a multi-message exchange from a simulated compromised account. Vary wording and language while preserving deceptive intent. Measure missed attacks, removal time, and false positives against matched legitimate requests. Test each licensed email and collaboration channel separately.
Use this category to inspect and stop deceptive messages. Use AI impersonation and deepfake defense for synthetic voice and video verification, and Identity and account protection for account and session protection.
Defense Against AI-Enabled Attacks · Identity and access
21 Identity and account protection
Can we prevent account takeover and stop misuse of a valid session?
What AI changes: AI-assisted social engineering puts more pressure on recovery processes that trust a plausible story or personal details. Evaluate whether an attacker can bypass strong authentication through a weaker reset or enrollment path. Then test detection and revocation of the resulting sessions: successful authentication does not establish that later activity is legitimate.
Reported campaign: Microsoft documented token theft and continued account access following AI-enabled phishing. Recovery and enrollment checks below are additional evaluation scenarios.
- Verify recovery requests independently of the evidence supplied by the requester
- Apply phishing-resistant authentication and least-privilege access
- Detect credential misuse, privilege escalation, and risky sessions
- Revoke affected credentials and sessions, and verify that access stops
Test recovery verification, IAM, PAM, and identity threat detection together. The examples cover different parts of this process. Phishing-resistant authentication and least privilege require the appropriate identity controls; an ITDR listing alone does not provide them.
Simulate a well-informed recovery request, attempted MFA re-enrollment, and subsequent misuse of a valid test account. Check whether fallback verification is independent of requester-supplied evidence. Measure time to detect and terminate access, including application sessions and tokens that may survive an identity-provider logout.
Use this category to protect accounts, credentials, and sessions. Protection against automated login and workflow abuse belongs in Automated application and API abuse defense. Synthetic-media verification belongs in AI impersonation and deepfake defense. Identities and delegated authority of your own AI agents belong in AI agent identity and authorization.
Defense Against AI-Enabled Attacks · Applications and infrastructure
22 Rapid exploitation defense
Can we protect an exposed system within a shortened exploitation window?
What AI changes: AI-assisted vulnerability research and exploit development can shorten the time available to protect an exposed system. Evaluate elapsed time from vulnerability disclosure or exposure discovery to verified protection. Scan frequency and a remediation SLA alone do not show whether a reachable attack path remains open while a fix is pending.
Threat assessment: NCSC assesses that AI will further shorten exploitation timelines. Test a defined response window; this assessment does not establish one universal patching deadline.
- Locate affected and reachable assets promptly when a relevant weakness becomes known
- Assign emergency remediation and mitigation owners using attack-path and business context
- Apply temporary protection where remediation cannot happen immediately
- Verify that remediation or mitigation closes the exploitable path
Connect exposure assessment to remediation and enforcement owners. Assessment products identify and prioritize weaknesses; a WAF can shield supported web attack paths. Neither proves that every infrastructure exposure can be mitigated before patching.
Use an isolated vulnerable test asset and a defined disclosure time. Measure discovery, prioritization, interim protection, and verified closure against a shortened exploitation window. Confirm that the mitigation blocks the relevant path, identify bypasses and unsupported assets, and compare the result with the published remediation SLA.
This category tests elapsed time to verified protection under an accelerated exploitation scenario. The defender does not have to use AI. AI exposure analysis and remediation evaluates AI’s prioritization and remediation work; AI-led security testing and validation supplies attack evidence. Abuse of legitimate workflows belongs in Automated application and API abuse defense; AI-specific asset posture belongs in AI security posture management.
Defense Against AI-Enabled Attacks · Endpoint and network
23 Endpoint and network defense
Can we detect malicious behavior when the code or attack sequence is unfamiliar?
What AI changes: AI can help attackers develop and vary malicious code. Evaluation should test whether protection holds across previously unseen variants of the same malicious behavior, including scripts and legitimate-tool abuse. A successful demonstration against one known sample does not establish coverage. Measure endpoint and network visibility separately.
Observed and experimental techniques: Google reported AI-generated commands in operational malware and experimental code regeneration. These support testing varied behaviors, not assuming every attack adapts autonomously.
- Detect malicious file, process, script, and network behavior
- Identify abuse of legitimate tools and lateral movement
- Correlate host and network evidence for investigation
- Isolate compromised systems and measure the effect on legitimate activity
- CrowdStrike Falcon Insight XDR
- Microsoft Defender for Endpoint
- Palo Alto Networks Cortex XDR
- SentinelOne Singularity Endpoint
Validate EDR and network coverage, including unmanaged systems. Require a reproducible result rather than an “AI-powered” product label.
Use an authorized simulation with held-out payload and script variants that preserve the same attack objective. Include legitimate-tool sequences and benign look-alikes. Measure misses, detection and isolation time, and false positives. Repeat on systems without endpoint agents to establish what the network product can detect and which integrated control can contain it.
Use this category for detection and enforcement on hosts and networks. Use Attack detection and containment to evaluate coordinated containment across systems. Securing your own AI application or agent belongs in AI application runtime security and AI agent action control.
Back to the map ↑Next: Data theft and exfiltration defense →
Defense Against AI-Enabled Attacks · Data security
24 Data theft and exfiltration defense
Can we interrupt sensitive-data theft through apparently legitimate access?
What AI changes: Attackers can use AI to identify valuable data and direct collection. Evaluate selective theft through valid accounts as well as bulk downloads: can controls recognize sensitive content and stop an unauthorized destination when volume alone is unremarkable?
Reported operations: Google documented AI-assisted document collection in PROMPTSTEAL; Anthropic reported database selection and extraction. The selective-transfer scenario below is an editorial test derived from these findings.
- Recognize sensitive content in the file types and channels being protected
- Evaluate transfers using content, user, destination, and available activity context
- Block or restrict unauthorized transfers through supported channels
- Preserve evidence of attempted and completed transfers
Test the DLP enforcement you already license, including unsupported file types and channels. Connect it to data classification, access governance, and activity monitoring where needed. The listed DLP products do not by themselves establish least privilege or visibility into every repository read.
With synthetic sensitive data and an authorized test account, attempt both a small, high-value transfer and a bulk export to controlled unauthorized destinations. Use the same channels as legitimate work. Measure data released before enforcement, blocking accuracy, evidence retained, and legitimate transfers interrupted.
Use this category to limit data theft through enterprise access and transfer paths. Use AI data access and exposure security for data exposed through AI applications, retrieval systems, or agent memory. Automated scraping and application workflow abuse belong in Automated application and API abuse defense. Discovery alone does not establish that exfiltration can be blocked. Use AI-assisted data protection to evaluate the AI performing classification and protection work, including the consequences of incorrect labels or policy decisions.
Defense Against AI-Enabled Attacks · Security operations
25 Attack detection and containment
Can we connect and contain an attack before it progresses across systems?
What AI changes: AI-assisted tools can chain attack steps with fewer manual handoffs. Evaluate whether coordinated containment finishes before the next harmful action in a defined scenario. Alert quality alone is insufficient when investigation queues, approvals, or disconnected controls leave the attack running.
Reported campaigns: Anthropic described AI-orchestrated intrusion steps; Microsoft described automated phishing and post-compromise activity. The compressed response window below is a test condition, not a universal observed attack speed.
- Connect evidence across security tools into one attack timeline
- Coordinate account, session, device, and network containment
- Control response permissions, approval requirements, and exceptions
- Verify containment and recover safely from mistaken response actions
Validate the deployed tools and managed services as one response process. Confirm product editions, connected telemetry, response integrations, and permissions. Detection coverage does not establish authority to revoke a session or isolate a device; automatic actions also have prerequisites and exceptions.
Run an approved account-to-endpoint-to-data scenario at progressively shorter intervals between steps. Measure elapsed time from the first actionable signal to verified containment and record which harmful actions finish first. Include a missing telemetry source and a delayed approval, then verify safe recovery from an incorrect containment decision.
This category evaluates coordinated containment across systems. Endpoint and network defense evaluates endpoint and network controls themselves. AI SOC investigation and response evaluates AI performing SOC work. A platform can serve both purposes, but using AI does not by itself demonstrate effective defense against AI-enabled attacks.
Back to the map ↑Next: Automated application and API abuse defense →
Defense Against AI-Enabled Attacks · Applications and APIs
26 Automated application and API abuse defense
Can we stop abusive automation while allowing legitimate users and authorized agents?
What AI changes: AI agents can navigate applications and act on a user’s behalf, creating a need to distinguish permitted automation from abuse. Evaluation should include adaptive, multi-step activity through normal application functions. Test the agent’s identity, claimed authority, and actions together; a bot score or successful login alone does not establish whether a workflow is authorized.
Capability evidence and evaluation: Cloudflare documents distinct AI crawler and agent behaviors. The tests below apply that distinction to OWASP’s established business-flow abuse risk; they do not assume all automation uses AI or that all AI agents are malicious.
- Detect automated credential attacks, abusive registrations, scraping, and sensitive-workflow abuse
- Correlate requests across sessions, accounts, devices, and workflow steps
- Apply allow, challenge, rate-limit, or block policies to the relevant action and risk
- Verify claimed agent identity where supported and preserve evidence without obstructing authorized use
Test existing CDN, WAF, bot, identity, and API controls as one workflow. Confirm which capabilities require separate modules. Ask what detects valid-request abuse beyond known signatures and rate thresholds, and how authorized agents are handled.
In a controlled application, compare a human user, an authorized agent, and abusive automation completing the same multi-step flow. Vary timing, session continuity, and account use, including activity below simple rate limits. Measure harmful actions completed, false blocks, challenge completion, and the time to enforce a changed policy.
This category covers abuse of application functions that may work as designed. Use Rapid exploitation defense for exploitable weaknesses, Identity and account protection for workforce account and session protection, and Data theft and exfiltration defense for sensitive-data transfer controls. Authorization of your own AI agents belongs in AI agent identity and authorization. General transaction fraud remains outside the map.
How this map is built and updated
Category rule. Each category identifies a security job, an accountable owner, distinct evaluation criteria, and relevant solution options. In Defense Against AI-Enabled Attacks, established defenses qualify when AI changes the scenarios, coverage requirements, or response window buyers should test; increased attack volume alone is insufficient. The 26 categories are evaluation areas, not a count of separate purchases. A platform may appear in several categories when documented capabilities address different security jobs. Each appearance is assessed separately; listing frequency is not a ranking or endorsement.
AI for Security rule. Include a category when AI performs or materially assists a defined security job, buyers must evaluate the quality and consequences of that work, and documented solution options exist. An AI interface or generated summary alone is insufficient; the capability must contribute to a security decision or action whose quality can be evaluated. Established machine learning, generative AI, and agentic capabilities can all qualify. Ask what security work is delegated to AI and how the buyer would know if it did that work incorrectly.
Vendor rule. Lists are selective, unranked, and independent of sponsorship. Each listing requires current public documentation for the named product or module and its role in the category. Selections illustrate relevant capabilities and deployment approaches across established platforms and specialists. Product names, capability groups, and notes identify each listing’s role; notes clarify broad or overlapping offerings where needed. Solutions are grouped by capability and alphabetized within each group; the lists are not exhaustive. Inclusion does not imply full category coverage, independently tested effectiveness, or a need to buy another product. Relevant editions, supported environments, availability, and integrations must be evaluated in the deployment being considered. Where provided, product notes describe documented capabilities, not independently verified results. Preview status and material availability limits are identified where documented.
Framework crosswalk. Each category links to relevant standards or threat frameworks. These connections identify control objectives and attack behaviors; they do not establish AI-specific effectiveness or compliance. The top-level areas also relate to the Secure, Defend, and Thwart focus areas in the NIST IR 8596 Cyber AI Profile initial preliminary draft.
Update rule. Reviews check product availability, ownership, public evidence, links, and category fit. Each category must retain a distinct security job and evaluation need. Categories are consolidated when their scope and tests substantially duplicate another; a new label or vendor launch alone does not justify an addition. AI threat assessments, including the NCSC assessment of AI-enabled threats, and reported incidents inform the scenarios. Area 3 evidence notes support changes in attack scenarios; Area 2 product documentation supports claims about the work AI performs. Neither establishes independently tested effectiveness. The suggested tests are editorial evaluation guidance, not product benchmarks.
Scope appendix
The map includes capabilities that secure AI systems, use AI to perform security work, or defend against AI-enabled attacks. The appendix distinguishes related capabilities, coverage within the 26 categories, and areas outside enterprise cybersecurity.
See what the map leaves out and why
Related capabilities and boundaries
- AI-enabled phishing, identity abuse, exploits, malware, data theft, and application abuse: Covered in the established defenses in Area 3; these markets are part of the map.
- Application security: AI-assisted analysis and remediation is included whether code was written by people or AI. The full market for conventional code, dependency, and pipeline security is outside scope. AI-specific components belong in AI component and supply-chain security.
- Workforce AI coding tools: Usage controls belong in workforce AI security; agent identity and actions belong in AI agent identity and action control.
- General payment and transaction fraud: Outside the map unless tied to a defined cyber control or verification workflow.
- General security copilots and reporting: Features within the platform doing the underlying work, rather than separate categories. Inclusion requires a defined security outcome that can be evaluated.
Covered within the map
- MCP, model, plugin, and tool scanning: AI component and supply-chain security.
- Prompt injection defenses and guardrails: AI application runtime security.
- Vector, embedding, RAG, and retrieval-permission risks: AI data access and exposure security.
- Agent tool use, plans, and handoffs: AI agent action control. Sensitive data in agent memory belongs in AI data access and exposure security.
- Model theft and extraction: Runtime, identity, and data controls cover this evaluation.
Outside enterprise cybersecurity scope
- Model quality, accuracy, and performance evaluation: AI quality and reliability.
- Bias, fairness, and general explainability: Responsible-AI governance, unless tied to a security control.
- General content moderation: Trust and safety.
- Synthetic-content creation: Content-production tools and services.
- General AI observability and performance monitoring: AI operations, unless it delivers a security outcome.
Boundary watchlist
Watchlist: incident response for compromised AI systems, enterprise content authenticity, and confidential AI computing. A separate category requires a distinct security job, clear evaluation criteria, and identifiable solution options.
Corrections and related research
To suggest a correction, send the product name, category, capability, and a link to public documentation. Submissions are reviewed editorially.
Related research
2026
AI Risk and Readiness Report · Cybersecurity
Insiders research library · AI security coverage