The AI Security Market Map
AI security spans three areas: protecting the AI your organization uses, buys, and builds; using AI to perform security work; and defending against AI-enabled attacks. The map covers 28 categories. For each one it shows the security job, how to test the controls you already own, and which products to consider if they fall short.
Security of AI
Start by finding where employees use AI, which AI systems and agents are deployed, and what data they can reach.
Then test the network, cloud, application, identity, and data controls already in place. Each category shows what to test and which gaps may justify an AI-focused product.
Control workforce AI use
Security of AI · Control workforce AI use
1 Workforce AI access and usage security
Who's using which AI services, and what do we allow?
Employees reach AI through public chatbots, SaaS copilots, desktop assistants, and IDE agents. Security needs to know who used each service, what they sent, and whether policy allowed it. A browser or proxy may see only part of that traffic.
- Find sanctioned and unsanctioned AI across browsers, SaaS copilots, desktop applications, extensions, IDEs, and APIs
- Tie each interaction to a user, device, service, and session
- Allow, block, coach, or grant an exception based on the user, group, service, and data involved
- Inspect prompts, uploads, responses, and copy-and-paste activity, then send a usable record to DLP, SIEM, and incident workflows
Ask your SSE, secure browser, CASB, and DLP vendors to demonstrate every route employees use. If an IDE agent can send source code to an external model without attribution or policy enforcement, you still have a gap.
Send a synthetic confidential file through a public chatbot, sanctioned copilot, SaaS feature, desktop application, IDE agent, and API. Set the expected result for each route: allow, coach, block, or escalate. Confirm that every event identifies the user, device, or service identity and leaves an investigation record.
Track the share of AI transactions tied to a user, device, or service identity. List unmonitored routes separately.
Use this category to control which AI services employees can use and what they can send. Use AI data access and exposure security to control what an AI application can retrieve or reveal. Use AI coding agent security to control what coding agents can do on developer machines.
Govern AI risk and posture
Security of AI · Govern AI risk and posture
2 AI governance and assurance
Who owns each AI use case, who approved it, and where's the evidence?
For every purchased, embedded, or internally built AI use case, record the owner, purpose, risk decision, required controls, and current evidence. Reassess it when the model, data, purpose, or deployment changes.
The EU AI Act has applied in general since 2 August 2026. Its rules for high-risk AI systems (Chapter III, Sections 1–3) apply later: from 2 December 2027 for stand-alone Annex III systems, and from 2 August 2028 for AI built into Annex I regulated products. Record which obligations apply to each use case and why.
- Inventory AI use cases, models, agents, owners, and third parties
- Classify risk against the business purpose, affected people, and applicable obligations
- Run approval, exception, review, and retirement workflows
- Connect every use case to required controls and current evidence
- Trigger reassessment when the model, data, purpose, deployment, or applicable obligation changes
Test whether existing GRC, TPRM, privacy, and service-management platforms can inventory AI and reopen assessments after material changes. Add a platform when they cannot connect each use case to its owner, obligations, evidence, and review history.
Take one production use case through approval and a material change. Confirm that the product preserves the owner, decision, controls, evidence, exceptions, and next review.
Track the share of production AI with a named owner, completed assessment, current evidence, and scheduled review. Time a complete inventory for one business process or regulated decision.
This category records who approved an AI use case, which rules apply, and where the evidence lives. Technical controls are covered in AI security posture management and the following categories for components, applications, agents, and data. Model quality, fairness, moderation, and general ethics reviews belong elsewhere unless they test a security requirement. Use AI compliance evidence and control assessment when AI reviews security evidence and assesses controls.
Security of AI · Govern AI risk and posture
3 AI security posture management
Which AI assets and configurations are exposing us right now?
The security inventory may miss a public model endpoint, a notebook running under an over-privileged identity, or an agent connected to a sensitive datastore. AI security posture management should find those deployed resources and show which configuration, identity, data connection, or network path creates the exposure.
- Maintain a current inventory of deployed AI applications, models, agents, services, notebooks, and endpoints
- Connect each asset to its code, model, data, identity, infrastructure, and owner
- Find configuration errors, vulnerable components, public exposure, and attack paths
- Detect drift when assets, connections, or permissions change
- Assign remediation and verify that the exposure was removed
- Aqua Security
- CrowdStrike Falcon Cloud Security AI-SPM
- Microsoft Defender for Cloud AI-SPM (Agent 365 for agent inventory)
- Orca Security
- Palo Alto Networks Prisma AIRS AI Posture Management Assesses AI components, data exposure, and access to deployed models.
- Tenable One AI Exposure
- Wiz AI-SPM
- Zscaler AI Asset Management
- Akto
- Cranium AI
- Cyera Agent Guardian AI-SPM Maps AI assets to identities, data access paths, and exposure risks.
- Noma Security
Test your CNAPP, CSPM, and cloud security platforms first. Add AI-specific coverage when they miss a model, notebook, agent, MLOps environment, or the identity and data exposed through it.
Expose a model endpoint or grant excessive notebook permission in an approved environment. Confirm that the product finds the asset, traces the identity and data at risk, assigns the fix, and verifies remediation.
Track owned and assessed AI assets, exposed or unmanaged endpoints, and time to verified remediation.
Use AI governance and assurance to record why an AI use case was approved. Use this category to find exposed AI assets and unsafe configurations. For employee use, start with workforce AI security; for model and tool dependencies, use AI component and supply-chain security.
Back to the map ↑Next: AI component and supply-chain security →
Secure AI applications across the lifecycle
Security of AI · Secure AI applications across the lifecycle
4 AI component and supply-chain security
Can we trust the models, tools, and data our AI systems depend on?
An AI application may load an executable model file, use a vulnerable library, ingest poisoned data, or connect to a malicious MCP server. Security needs to know where each component came from, whether it changed, and whether it passed an approved check before deployment.
- Inventory models, datasets, libraries, tools, plugins, and MCP servers
- Scan model files and dependencies for malware, secrets, and known vulnerabilities
- Verify signatures, hashes, provenance, and data lineage
- Check training, tuning, and retrieval data for poisoning or unauthorized change
- Enforce policy at hubs, registries, CI/CD pipelines, MLOps pipelines, and production promotion
- Cisco AI Defense, including Robust Intelligence
- Palo Alto Networks Prisma AIRS AI Model Security Scans third-party models for malicious code, tampering, and deserialization risks.
Test AppSec, supply-chain, container, cloud, and MLOps controls against AI components. Add coverage for model files, public model hubs, dataset provenance, AI bills of materials, and MCP components those tools cannot inspect.
Test a malicious or altered example of each supported component type, including an MCP server or tool description. Confirm that the check runs before promotion and records why it blocked the component.
Track the share of production components that followed an approved path, artifacts with unknown provenance, and time from failed check to removal or exception.
Use this category to verify the integrity and origin of models, data, libraries, and tools. Use AI security testing and red teaming to attack the assembled system and AI data access and exposure security to control the data it can reach.
Back to the map ↑Next: AI security testing and red teaming →
Security of AI · Secure AI applications across the lifecycle
5 AI security testing and red teaming
How can our AI be manipulated, and do our defenses hold?
A model can pass a benchmark and fail once connected to the organization’s prompts, data, tools, and permissions. Security testing attacks the assembled system before release and after material changes. Findings must reproduce the failure and prove whether the fix holds.
- Build a threat model and test plan around the system’s purpose, data, and access
- Combine automated attack libraries with adaptive human-led testing
- Exercise prompts, models, RAG, tools, agents, and multimodal inputs
- Produce reproducible findings with evidence, impact, and remediation guidance
- Verify fixes and retain regression tests for releases and material changes
- Enkrypt AI
- Giskard
- Gray Swan
- HiddenLayer
- Lakera Red by Check Point
- Mindgard
- Netskope One AI Red Teaming
- Trend Vision One AI Scanner
- Virtue AI
- Zscaler AI Security
Use built-in tests for regression. Bring in a specialist or independent assessment when the system can approve access, move money, affect employment or safety, support a regulated decision, or test its own controls.
Reproduce a failure in your application. Preserve the input, model, configuration, retrieval state, and permissions. Apply the fix, rerun the attack, and test nearby variations.
Track tested paths, reproducible findings, remediation time, successful retests, and failures that return after a system change.
Use this category to attack the AI system itself. Use AI-led security testing and validation to test infrastructure and conventional applications. General accuracy testing belongs elsewhere unless it tests a defined security failure.
Security of AI · Secure AI applications across the lifecycle
6 AI application runtime security
How do we catch and stop an attack in the middle of an AI interaction?
An attacker can hide instructions in a prompt, document, web page, image, or retrieved record. The model may expose sensitive context or produce output the application handles unsafely. Runtime controls inspect the interaction, enforce policy, and preserve the session for investigation.
- Inspect prompts, responses, retrieved content, files, images, and URLs
- Detect direct and indirect prompt injection, jailbreaks, and any additional attack types the vendor claims to cover
- Block sensitive disclosure and unsafe output before the application uses it
- Apply policy consistently across models and application teams
- Record the session, decision, latency, and alert for SIEM and incident workflows
- F5 AI Guardrails, built on CalypsoAI
- Lakera Guard by Check Point
- Lasso
- NeuralTrust
- Oligo Runtime AI Security
- Pillar Security
- Prompt Security by SentinelOne
- Straiker
- TrojAI by A10 Networks
- Cisco AI Runtime Protection
- Fortinet FortiAIGate
- Netskope One AI Guardrails
- Palo Alto Networks Prisma AIRS AI Runtime Security Applies safeguards against manipulation and data exposure during live AI interactions.
- Trend Vision One AI Guard
- Zscaler AI Gateway
Test controls from the model provider or AI platform. Add a gateway or specialist when several providers need one policy, attacks go undetected, or security lacks centralized session records.
Place an indirect prompt injection in retrieved content. Check the enforcement decision and SIEM record, measure added latency, then repeat with similar benign content.
Measure attack success, false positives, false negatives, application coverage, and p95 latency.
Use this category to inspect prompts, retrieved content, and model responses. Use AI agent action control to control the tool calls, transactions, messages, and file changes that follow. Use AI incident detection and response to investigate and contain attacks that get through.
Back to the map ↑Next: AI agent identity and authorization →
Control AI agents
Security of AI · Control AI agents
7 AI agent identity and authorization
Who does this agent act for, and what is it allowed to do?
An agent may use an API key, service account, OAuth token, or delegated user session. Security needs to identify the agent and its owner, record the user or application it represents, and restrict its authority to the task. A coding agent, for example, may hold repository credentials, cloud tokens, and MCP connections.
- Discover agents, credentials, owners, sponsors, and connected systems
- Give each agent or agent instance a distinct, verifiable identity
- Preserve delegated user and application context through the task
- Issue least-privilege, short-lived credentials scoped to the task
- Record provisioning, approval, use, expiry, revocation, and decommissioning
- Cisco (Astrix Security)
- Cyera Agent Guardian Maps agents to identities and access rights to inform authorization policies; evaluate identity lifecycle coverage separately.
- Microsoft Entra Agent ID, in Microsoft Agent 365
- Okta for AI Agents
- Palo Alto Networks Idira, built on CyberArk
- SailPoint Entro
- Saviynt Zuma
- ServiceNow Veza
Test IAM, PAM, secrets management, and non-human identity controls for agent coverage. Add agent-specific tooling when agents bypass provisioning, lose delegated context, or cannot receive credentials scoped to one task.
Let an agent read a record but not modify it. Confirm that the system preserves its sponsor, blocks the write, records the decision, and expires the credential after the task.
Track agents with verified identities, owners, sponsors, scoped credentials, and expiry dates. Measure standing privilege removed and unauthorized operations blocked.
Use this category to establish who an agent is, whom it represents, and its maximum access. Use AI agent action control to decide whether a specific action is allowed. Use existing non-human identity controls for workloads and service accounts that are not AI agents. Use AI identity governance and access reviews when AI recommends granting or removing access.
Security of AI · Control AI agents
8 AI agent action control
What is this agent actually doing, and can we stop it mid-action?
An agent can change a file, commit code, call an API, issue a refund, or disable an account. A valid credential may allow an action that is wrong for the current task. Security must check each proposed action before execution and be able to stop, contain, or reverse it.
- Trace plans, prompts, tool calls, parameters, results, memory, and agent handoffs
- Check policy before a tool call or transaction executes
- Require human approval for destructive, privileged, financial, or external actions
- Enforce limits on tools, data, destinations, rates, costs, and transactions
- Pause or kill the agent, revoke credentials, contain the result, and support recovery
- Lumia Security
- Noma Agent Access Control Governs agent access to tools and monitors runtime behavior to stop risky actions.
- Operant AI
- Runlayer
- Zenity
- Check Point AI Agent Security
- Cyera Agent Guardian Monitors agent prompts and actions and applies runtime guardrails to risky data operations.
- Netskope One Agentic Broker
- Palo Alto Networks Prisma AIRS Agent Security Verifies agent identity and enforces runtime controls against unauthorized actions.
- Saviynt Zuma Access
- Zscaler AI Broker
Test controls in the agent platform, IAM system, API gateway, and AI runtime product. Add a control when the stack cannot reconstruct an agent’s actions, enforce policy before execution, or contain the result.
Trigger a prohibited action and confirm that it stops before execution. The record should connect the user, agent, prompt, session, tool call, and decision. Then allow a controlled unsafe action and test revocation, containment, reversal, and memory cleanup.
Track tool calls checked before execution, actions requiring approval, violations stopped, and time to contain and reverse an unsafe action.
Use AI application runtime security to inspect prompts and model responses. Use AI agent identity and authorization to set the agent’s identity and maximum access. Use this category to approve or block the action it is about to take. An MCP gateway is one possible control point. Use AI coding agent security for coding agents on developer machines and in CI pipelines, and AI incident detection and response to investigate and contain an agent that has gone wrong.
Security of AI · Control AI agents
9 AI coding agent security
What can our coding agents touch, and can we stop a risky command before it runs?
A coding agent can read the repository, run shell commands, install packages, call MCP servers, and push code. It often runs with the developer’s own credentials, and a poisoned README, issue, or tool description can steer it. Security teams need an inventory of these agents and their settings, and a way to block a risky action before it runs.
- Discover coding agents, IDE extensions, MCP servers, skills, and rules files on developer machines and in CI
- Flag risky settings, such as skipped permission prompts, wildcard shell rules, and auto-approved MCP servers
- Check shell, file, network, package, and MCP actions against policy before they run
- Keep enforcement tamper-resistant and alert when a hook or policy stops working
- Send agent activity to the SIEM and incident workflows
Ask your endpoint, AI usage, and AppSec vendors which coding agents they can see and whether they can block an action before it runs. If a developer can switch off approvals or add an MCP server without anyone noticing, you still have a gap.
Plant instructions in a README and in an MCP tool description, turn on auto-approve, and ask the agent to read a credential and send it out. Confirm that the risky setting is flagged, the action stops before it runs, and the attempt is recorded. Then switch the control off and check that someone is alerted.
Track the share of coding agents in your inventory, risky settings fixed, actions blocked before they run, and the time it takes to notice a disabled control. Report unmanaged devices and CI runners separately.
Use this category to secure coding agents and the actions they take on developer machines and in pipelines. Use Workforce AI access and usage security to decide which AI services developers can use, AI agent identity and authorization to set an agent’s credentials and maximum access, and AI application security analysis and remediation to find and fix flaws in the code the agents write.
Back to the map ↑Next: AI data access and exposure security →
Protect data exposed to AI
Security of AI · Protect data exposed to AI
10 AI data access and exposure security
What sensitive data can AI reach, retrieve, or leak?
An assistant may retrieve an over-shared document, expose sensitive text from a vector index, or retain regulated data in memory. Security must trace the data and its permissions through indexing, retrieval, prompts, responses, and memory.
- Discover and classify data connected to AI applications and copilots
- Trace lineage from source records through indexes, prompts, retrieval, responses, and memory
- Calculate effective permissions and identify overexposed information
- Scan RAG corpora, vector stores, copilot indexes, and agent memory
- Correct entitlements, enforce DLP, and preserve access, retention, deletion, and residency evidence
- Concentric AI
- Cyera Agent Guardian and Data Security Platform Combines data sensitivity and access context to assess agent data exposure and trace accessed files.
- Nightfall AI
- Securiti
- Sentra
- Varonis
Test DSPM, DLP, information protection, access governance, and repository permissions against AI data paths. Add AI-specific coverage when those products cannot see retrieval paths, vector stores, copilot indexes, agent memory, or inherited permissions.
Give an assistant access to a synthetic sensitive document that its user cannot open directly. Confirm that the product finds the exposure, prevents disclosure, traces the source permission, and verifies the fix.
Track classified AI data sources, overexposed objects, correction time, leakage-test results, and false positives.
Use Workforce AI access and usage security to control which AI services employees may use and what they may send. Use AI application runtime security to block attacks during an AI interaction. Use this category to control what data AI can reach, retain, and disclose. Use AI-assisted data protection to evaluate AI-driven classification and protection across enterprise data, and Data theft and exfiltration defense to test attacker-driven collection and transfers.
Detect and respond to AI incidents
Security of AI · Detect and respond to AI incidents
11 AI incident detection and response
If one of our AI systems is attacked or goes rogue, can we see it, investigate it, and contain it?
Prompts, tool calls, and agent actions rarely reach the SIEM in a form an analyst can use. When an agent is hijacked or starts misbehaving, the SOC needs to see what it was asked, what it did, and what it touched, then pause it, revoke its access, and recover. Controls in the other categories reduce incidents. This category handles the ones that get through.
- Collect prompts, responses, tool calls, agent actions, identities, and data access in one record
- Detect prompt injection, data leakage, and behavior that departs from an agent’s normal baseline
- Reconstruct the chain from prompt to tool call to data access for each alert
- Pause or quarantine an agent, revoke its credentials and sessions, and recover without taking the whole application offline
- Send alerts and evidence to SIEM, SOAR, and case management tools
Check what AI telemetry your SIEM, XDR, and cloud security tools already collect. Add AI-specific detection and response when analysts can’t see prompts, tool calls, and actions, or can’t contain an agent without shutting down the application.
Hijack a test agent with an indirect prompt injection. Confirm that the alert carries the prompt, the tool calls, the identity, and the data touched. Then pause the agent, revoke its credentials, and check that the rest of the application keeps running.
Track time to detect, time to contain, the share of investigations completed without engineering help, and agent actions that can’t be reconstructed.
Use this category to detect, investigate, and contain incidents involving your own AI systems. Use AI application runtime security and AI agent action control to block attacks as they happen, and AI SOC investigation and response to evaluate AI that does SOC work.
AI for Security
Security teams use AI to investigate incidents, improve detections, automate security workflows, and find and fix weaknesses. AI also helps with access decisions, data protection, and assessing security controls. The nine categories below cover established AI and machine learning as well as newer generative and agentic capabilities.
Start with the platforms you already run. Give the AI the same task and evidence your team works from today, then compare the quality of the result, the review effort, and the time to finish. Run the tests that match the AI’s role, including its approval steps and integrations. Keep in mind that a listed product may not cover the whole category. Look at specialists where your current tools fall short in that test or leave a gap.
Investigate, detect, and respond
AI for Security · Investigate, detect, and respond
12 AI SOC investigation and response
Can AI investigate an alert, explain its verdict, and stay within its authority?
What AI does: AI gathers incident evidence, assesses alerts, and helps analysts decide how to handle each case. Products range from triage assistants to tools that investigate incidents and take approved response actions. Test the product against the vendor’s claims. Check which evidence the AI collects, how accurately it builds the incident timeline, whether its verdict holds up, and whether it tells you what it couldn’t see. Before the AI takes any response action, decide what it may do, who approves each step, and how your team undoes a mistake.
- Take in, group, and prioritize alerts without hiding the original signals
- Collect relevant evidence across the security stack and build a timeline
- Show the evidence and uncertainty behind each verdict
- Separate the permissions to recommend, approve, and execute each response action
- Log every action and analyst override, and whether each reversal or recovery worked
- 7AI Agentic Security Platform Investigation agents gather evidence across connected tools and develop case findings.
- Arcanna.ai AI-assisted triage and decision support informed by analyst feedback.
- Crogl AI SOC Queries connected tools and documents investigations for analyst decisions.
- Dropzone AI SOC Analyst Investigates alerts and presents supporting evidence and reasoning.
- Intezer AI SOC Combines AI triage with forensic analysis and configurable response.
- Prophet AI SOC Analyst Investigates alerts and supports response through scoped Agent Actions.
- Qevlar AI Runs structured incident investigations, using AI for bounded tasks such as evidence enrichment.
- AiStrike for Security Operations Triages and investigates alerts with identity, asset, and behavioral context; critical response actions require analyst approval.
- Conifers CognitiveSOC Investigation and remediation agents within a broader SOC platform.
- D3 Security Morpheus Correlates alert evidence, investigates incidents, and drafts or executes response under configured approval gates.
- Exaforce Exabot Investigate and Respond Investigation and response agents, available in self-managed or MDR delivery.
- Simbian AI SOC Agent Investigates security alerts and develops verdicts using organizational context.
- Swimlane AI SOC Uses Hero AI for alert investigation and reasoning, with Turbine providing governed automation.
- Torq Socrates AI SOC agents investigate alerts and coordinate incident response with analyst oversight.
- CrowdStrike Charlotte AI Detection Triage Evaluates Falcon detections and supplies verdicts, confidence, and recommendations.
- Google SecOps Triage and Investigation agent Investigates alerts, adds threat intelligence, and explains its verdicts.
- Microsoft Security Copilot Supports incident analysis and response guidance using connected security context.
- Palo Alto Networks Cortex AgentiX Case Investigation Agent Enriches case indicators, queries logs, and assists investigation and response.
- SentinelOne Purple AI Agentic Investigation Analyzes alerts, surfaces evidence, and recommends investigation follow-ups.
Consider a specialist when the AI in your SIEM, XDR, or SOAR stops at summarizing alerts, cannot investigate across products, or gives you no control over response actions.
Give the product closed cases with the dispositions hidden, including false positives, incomplete telemetry, identity incidents, and cases spanning several tools. Compare the results with how experienced analysts handled the same cases, then run the product in shadow mode. Before you switch on response actions, try a few approved low-risk ones and confirm the product refuses an out-of-policy request without carrying it out.
Measure missed evidence, incorrect dispositions, analyst time, rejected recommendations, time to containment, and unauthorized or reversed actions.
Use this category to judge the quality of AI investigations and incident decisions. Use AI threat hunting and detection engineering for proactive searches and detection rules, and AI security workflow automation for building and running workflows, including on platforms such as Cortex AgentiX. Use Attack detection and containment to test your defenses against AI-enabled attackers. Use AI incident detection and response when the incident involves your own AI systems.
Back to the map ↑Next: AI threat hunting and detection engineering →
AI for Security · Investigate, detect, and respond
13 AI threat hunting and detection engineering
Can AI find activity our alerts missed and turn detection gaps into working rules?
What AI does: AI proposes hunting hypotheses, queries security data, interprets what it finds, and helps draft or tune detection logic. Hunters look for activity that never triggered an alert. Detection engineers turn the behaviors worth watching into detections that keep running. A threat summary, or a rule that only looks right, is not finished work.
- Tie hypotheses and proposed detections to relevant adversary behavior and available telemetry
- Show the queries run, time ranges searched, evidence found, and any data sources that were unavailable
- Validate field names, query syntax, and rule logic against the deployed schema
- Test new detections on malicious and benign activity before approval
- Version rules, preserve reviewer changes, and retest after telemetry or parser changes
- Dropzone AI Threat Hunter Runs hypothesis-driven hunts across connected telemetry.
- SentinelOne Purple AI Supports analyst-led hunting through natural-language queries and follow-up analysis of security data.
- AiStrike Detection Engineering Identifies coverage and telemetry gaps, then creates and tunes detections.
- Anvilogic Agentic Detection Engineering Supports threat research, gap analysis, rule validation, and deployment.
- Google SecOps Detection Engineering Agent Preview: evaluates coverage and drafts YARA-L rules; a person must review each rule and create it manually before it goes live.
Start with the hunting and detection tools already connected to your telemetry. A specialist may help when those tools cannot query across the environments you need, produce detection logic your team can use, or keep that logic working as the data changes.
Use an approved dataset that contains known attack behavior, benign lookalikes, and one missing log source. For hunting, keep the expected findings hidden, then review the AI’s hypotheses, queries, evidence, and the gaps it admits to. For detection engineering, run the proposed rules against your real schema and against both malicious and benign events. Then change a field or parser and run them again.
For hunts, measure missed behavior, unsupported conclusions, and analyst effort. For detections, measure query failures, false positives, and maintenance effort. Make sure “nothing found” never hides “couldn’t search.”
Use this category for work that starts without an alert. Use AI SOC investigation and response for case verdicts and containment, and AI-led security testing and validation to run attacks against your systems. Threat-intelligence analysis belongs here when it leads to a hunt or a new detection; a summary on its own does not qualify.
AI for Security · Investigate, detect, and respond
14 AI security workflow automation
Can we automate security work across tools and still control every action that matters?
What AI does: AI reads unstructured inputs, chooses which tool or workflow branch to use, and helps build or run security tasks. Deterministic, rule-based steps still work best for predictable checks and actions. Check how the platform combines the two, and what happens when a task fails halfway through.
- Define permitted tools, data access, execution identities, and action limits
- Keep approval checks for significant changes out of the model’s hands
- Combine AI decisions with explicit workflow rules and human review
- Handle retries, duplicate requests, partial completion, and unavailable integrations
- Log inputs, decisions, approvals, actions, and any changes made to undo a step
- BlinkOps Agentic security workflows and tool orchestration.
- D3 Security Morpheus Combines playbooks and agentic tasks with orchestration, integrations, and response approval controls.
- Swimlane Turbine Builds and executes workflows that combine deterministic steps, AI agents, and human approvals.
- Tines AI Agent Agents that use tools inside task-based and interactive workflows.
- Torq Builds and orchestrates security workflows across integrated tools and AI agents.
Start with the orchestration and automation tools already connected to your environment. Consider another platform when your team can’t reliably set up the permissions, integrations, approvals, or recovery steps the workflow needs.
Run a workflow that enriches a case, requests approval, and performs an approved containment action. Deny one approval, interrupt an API call after it succeeds, repeat the request, and introduce malicious instructions in an input document. Check that no step goes beyond its permissions, and that the platform reports accurately when a workflow only partly completes.
Track unauthorized or duplicate actions, successful recovery from failures, integration maintenance, operator interventions, and time saved. Flag any action that can’t be undone before you switch it on.
Use this category to evaluate the workflow platform and how it controls execution. Use AI SOC investigation and response to judge investigation quality. Use AI agent action control for the controls that secure your AI agents across all use cases; you may need those controls here too.
Back to the map ↑Next: AI exposure analysis and remediation →
Find, fix, and validate weaknesses
AI for Security · Find, fix, and validate weaknesses
15 AI exposure analysis and remediation
Can AI identify which exposures matter most and help close them safely?
What AI does: AI combines exposure findings with asset, threat, and business context to help your team decide what to fix first and how to fix it. Depending on the product, the AI may explain the risk, recommend fixes, assign work, or coordinate approved actions. A well-written risk summary doesn’t prove an exposure is closed. Ask for evidence at each step.
- Identify the evidence, asset context, and assumptions behind each priority
- Separate exposures attackers can reach from findings your existing controls already mitigate
- Propose fixes with affected dependencies, owners, and operational constraints
- Keep recommendations, approvals, and executed changes separate
- Verify closure using fresh evidence and reopen failed or incomplete fixes
- Qualys Risk Operations Center AI agents support threat prioritization and remediation strategies.
- Rapid7 Exposure Command AI risk insights and remediation guidance within exposure workflows.
- Tenable One with Hexa AI Agentic orchestration connects exposure context, human approvals, and actions.
- Wiz AI-powered remediation Generates cloud remediation guidance using resource context and attack-path combinations.
- ArmorCode Anya Agents Purpose-built agents triage findings, score risk, and guide remediation and compensating controls.
- Seemplicity Remediation Agent Provides asset-specific resolution guidance within findings and remediation workflows.
- Zafran Agentic exposure management maps exposures to compensating controls and drives mitigation and remediation.
Test the AI module in your exposure-management platform on your own assets and change process. Better data integration or clearer remediation ownership may close the gap without another product.
Give the product a mixed backlog: an internet-facing weakness, a high-severity finding attackers can’t reach, a lower-severity attack path, and a business-critical asset with change restrictions. Keep the expected priorities hidden. Review the evidence, approve a limited fix, and confirm independently that the exposure is closed.
Track missed material exposures, unsupported priorities, accepted and rejected recommendations, time to verified closure, failed changes, and reopened findings. Compare the results with your current prioritization process.
Use this category to evaluate the AI’s analysis and remediation work. Use Rapid exploitation defense to test how fast you can protect an exposed system, whether or not your team uses AI. Use AI-led security testing and validation for attack evidence, and AI application security analysis and remediation for code-level fixes.
Back to the map ↑Next: AI application security analysis and remediation →
AI for Security · Find, fix, and validate weaknesses
16 AI application security analysis and remediation
Can AI find or assess a software weakness and produce a fix that stays secure and still works?
What AI does: AI helps analyze code and findings, explain why the code is vulnerable, and propose security fixes. Some products use AI to find weaknesses; others start from static-analysis findings and use AI to fix them. People or AI may have written the code. Judge the product on the security result and the languages it supports, not on who wrote the code.
- Preserve the vulnerable code path, finding source, and relevant application context
- Show supported languages, issue types, and analysis limitations
- Generate reviewable patches with explanations and focused security tests
- Recheck the weakness after the change and run functional regression tests
- Keep repository access, pull requests, and merge authority within existing controls
- Semgrep Multimodal and Autofix Combines static analysis with AI detection and triage; Autofix proposes code changes for supported findings.
- Snyk Code with Snyk Agent Fix AI-generated fixes for Snyk Code vulnerabilities; formerly DeepCode AI Fix.
- GitHub Copilot Autofix Generates suggested fixes from code-scanning alerts.
- SonarQube AI CodeFix Suggests fixes for supported analysis findings, including security vulnerabilities.
- Corgea Generates review-ready AI fixes for findings imported from other scanners.
- Mobb Fixer Uses hybrid AI and validated fix patterns to produce reviewable patches for supported SAST findings.
- Pixee Triages findings from many scanners and produces merge-ready fixes using codemods and AI.
Start with the AI analysis and fix features in the application-security and development platforms you already use. Consider a separate product where those features fall short on language coverage, context, finding quality, or remediation.
To test analysis, use representative repositories with confirmed weaknesses and benign lookalikes, and count valid findings and missed vulnerabilities. To test repair, give the product confirmed findings but keep the expected fixes hidden. Review each patch, rerun the original attack, and run security and functional tests. Include one finding that lacks enough context for a safe fix, and check whether the product says so.
Measure remaining exploitable weaknesses, defects introduced, accepted fixes, and developer review time. Credit each finding to the tool that made it, whether the scanner or the AI. If a product only fixes code, judge the product on the quality of its fixes.
Use this category for AI-assisted security analysis and repair of conventional software. General coding assistants and the wider AppSec market are outside this map. Use AI component and supply-chain security for AI-specific components, and AI-led security testing and validation for attacks against running systems. Use AI coding agent security to control the coding agents themselves.
Back to the map ↑Next: AI-led security testing and validation →
AI for Security · Find, fix, and validate weaknesses
17 AI-led security testing and validation
Can AI guide testing that proves exploitable paths and verifies our fixes?
What AI does: AI can choose or generate tests, coordinate validation runs, or adapt an attack sequence based on how the target responds. Products differ in which of these the AI does. In some, an AI agent only directs a conventional, deterministic test engine. Ask the vendor to show what the AI itself did. Scheduling scans or replaying a fixed attack library is not AI-led testing.
- Enforce scope, exclusions, rate limits, and an emergency stop
- Support credentialed and uncredentialed tests with explicit execution safeguards
- Validate exploitable weaknesses and the attack paths connecting them
- Tie evidence to affected assets, business impact, and remediation owners
- Retest fixes and show whether the path was closed
- Hadrian Agentic Penetration Testing AI-driven testing investigates weaknesses and validates exploitable attack paths.
- Horizon3.ai NodeZero Combines graph-based attack planning with ML and scoped generative AI assistance.
- RunSybil Sybil Tests application logic, chains weaknesses, and validates exploitability.
- XBOW Autonomous application testing validates findings through exploit execution.
- AttackIQ AVA Agentic OS Orchestrates AI agents for adversary emulation and security-control validation.
- Cymulate Cowork AI agents coordinate validation, analysis, and action across defense workflows.
- Pentera AI-powered exposure validation AI adapts payloads and attack progression within a deterministic execution engine.
- Picus Swarm Specialized AI agents coordinate pentesting, exposure validation, and attack simulation.
- SafeBreach Helm AI orchestration connects validation and analysis; SafeBreach Validate and Propagate run the underlying tests.
Consider a separate product when your current breach-and-attack simulation, penetration-testing, and exposure-validation tools can’t test often enough, adapt their tests, or reach all the environments you need.
In an approved test environment, give the product an objective and scope, but keep a known attack path hidden. Review the tests the AI chose or generated, the execution evidence, and any human input. Then change a permission, a reachable service, or an application behavior. Check whether the product adapts its test selection, orchestration, or attack steps as the vendor claims, and whether you can reproduce the finding. Apply a fix and confirm the path is closed.
Send an out-of-scope request and confirm the product refuses it without running it. Compare validated findings, false positives, operator effort, retest accuracy, and scope violations with your current testing process. Keep what the AI recommended separate from what the test engine did.
Use this category to test conventional applications and infrastructure. Use AI security testing and red teaming to test AI systems, AI application security analysis and remediation for code-level fixes, and AI exposure analysis and remediation to decide what to close first. You still need an independent assessment where business logic or the stakes call for human judgment.
Back to the map ↑Next: AI identity governance and access reviews →
Protect access and data
AI for Security · Protect access and data
18 AI identity governance and access reviews
Can AI recommend the right access without rubber-stamping excess privilege or cutting off people who need it?
What AI does: AI and ML compare identities, roles, usage, and risk to recommend whether to grant, keep, or remove access. Products range from peer-based recommendations to assistants that support review workflows. Test the quality of the recommendations even when a person approves each one. And the fact that most of a team has an entitlement doesn’t mean it’s appropriate.
- Explain recommendations using identity, entitlement, usage, and risk evidence
- Flag missing, stale, or unsupported identity data, and hold back decisions the AI isn’t sure about
- Handle privileged access, exceptions, role changes, and separation-of-duties requirements
- Make clear who reviews, who approves, and who provisions access
- Confirm each change in the target application and keep the reviewer’s reasoning
- Microsoft Entra ID Governance access-review recommendations ML-based user-to-group affiliation recommendations for supported reviews.
- Omada Identity AI capabilities Contextual access recommendations and entitlement assistance.
- SailPoint Access Recommendations Peer and identity analysis supporting access decisions.
- Saviynt Intelligence Risk- and behavior-informed access-review recommendations.
- Twine Security Alex AI digital employee that runs identity work end to end: access reviews, joiner-mover-leaver changes, account cleanup, and app onboarding to existing IGA tools.
Check which recommendation and review features your identity-governance platform already has. If unclear entitlement ownership or poor directory data stand in the way of a reliable decision, fix those first.
Create a review set with known excessive privileges, legitimate exceptions, recent role changes, and an overprivileged peer group. Keep the expected decisions hidden. Compare the recommendations with the owners’ own review, then confirm that a small set of approved revocations took effect in the target systems.
Track inappropriate approvals, unnecessary revocations, unreviewable recommendations, verified access removal, reviewer overrides, and business disruption. Report time saved separately from risk reduced.
Use this category when AI helps govern access. Use AI agent identity and authorization to secure the identities and delegated access of AI agents themselves, and Identity and account protection for account takeover and attacker misuse of live sessions.
AI for Security · Protect access and data
19 AI-assisted data protection
Can AI recognize sensitive information in context and help protect it without getting in the way of legitimate work?
What AI does: AI and ML recognize sensitive content, work out its context, and help with labeling, exposure checks, and protection decisions. Established classifiers belong here alongside newer generative AI. Spotting a sensitive file doesn’t block a transfer or remove excess access on its own; that usually takes a policy engine or an integration.
- Discover and classify supported structured and unstructured data, including organization-specific content
- Distinguish sensitivity using meaning, context, and business use, with reviewable evidence
- Connect classifications to labels, DLP policies, access changes, or remediation workflows
- Identify unsupported repositories, languages, encrypted content, and transfer paths
- Review uncertain results and retest classifications and policies as content changes
- BigID Prompt-Based Classification Uses natural-language criteria for contextual discovery and classification.
- Cyera AI-powered classification Classifies content and sensitivity, with labeling and downstream integrations.
- Microsoft Purview trainable classifiers Classifiers can support sensitivity labeling and DLP in supported workloads.
- Netskope One DLP file classifiers ML document and image classifiers usable in DLP profiles.
Test the classifiers, labeling, and enforcement integrations already available in your DLP, DSPM, and information-protection platforms. Consider a specialist where those tools leave a gap in content types, repositories, accuracy, or enforcement.
Use a held-out set of sensitive and non-sensitive documents, organization-specific material, and similar-looking public information. Include supported languages and formats plus an unsupported case. Review the classifications, then try both approved and prohibited actions to see what the policy does in practice.
Measure missed sensitive content and incorrect labels by data type, unnecessary blocks, successful unauthorized transfers in the test, verified access changes, review effort, and policy drift. Report discovery coverage separately from enforcement coverage.
Use this category to evaluate AI doing data-protection work across the enterprise. Use AI data access and exposure security to limit what AI systems can retrieve or disclose, and Data theft and exfiltration defense to test controls against AI-enabled attackers. Even when one platform covers all three, each job needs its own evidence.
Back to the map ↑Next: AI compliance evidence and control assessment →
Assess security controls
AI for Security · Assess security controls
20 AI compliance evidence and control assessment
Can AI assess security evidence and identify gaps without inventing assurance?
What AI does: AI collects or interprets security evidence, maps documents to control requirements, and spots missing or contradictory information. AI can support internal assessments and supplier reviews. A policy statement doesn’t prove a control works, and an AI-generated answer must never turn an unsupported claim into an approval.
- Link conclusions to source evidence, scope, dates, and applicable requirements
- Tell apart what a policy intends, how a control is designed, and evidence that the control works in practice
- Flag missing, stale, conflicting, or out-of-scope material
- Record reviewer decisions, exceptions, and follow-up work
- Limit access to sensitive evidence and preserve a reproducible assessment trail
- Secureframe AI Evidence Validation Reviews uploaded evidence for missing, outdated, or mismatched material.
- Vanta Agent Supports evidence collection, document review, and assessment workflows.
- Drata AI Includes policy-to-control mapping, test-failure insights, and agentic third-party assessments.
- Hyperproof AI evaluates vendor evidence, maps controls, and identifies gaps with a written rationale.
- OneTrust AI Evidence Analysis Reviews submitted evidence against defined control requirements and identifies gaps. Availability depends on environment and packaging.
- Whistic AI Reviews vendor evidence, maps it to controls, and flags contradictions with cited sources.
Test the AI features in your existing GRC and assurance platforms against your real evidence and control requirements. Consider another product where it would improve coverage, traceability, or review quality in the workflow you need.
Provide an evidence pack with an expired report, a control excluded from scope, an unresolved exception, and a policy contradicted by a technical test. Ask the tool to assess the defined controls, cite its evidence, and say what still needs checking. Have a qualified reviewer compare the results.
Track unsupported positive conclusions, missed exceptions, incorrect control mappings, source traceability, reviewer corrections, and assessment time. People, not the AI, keep the final say on risk acceptance and assurance.
Use this category when AI assesses cybersecurity controls and evidence. Use AI governance and assurance to govern how your organization uses AI. Tools that only write reports, fill in questionnaires without assessing anything, or cover assurance outside cybersecurity don’t belong here.
Back to the map ↑Next: AI impersonation and deepfake defense →
Defense Against AI-Enabled Attacks
Attackers use AI to improve reconnaissance, develop exploits, craft convincing deception, and automate parts of an intrusion. This section maps the defenses that protect your people, systems, and data from those attacks.
Each category explains what AI changes, what to test, and where established platforms or specialists fit. Start with the controls you already run. Check whether they cover enough and respond fast enough, and look at additional capabilities where they fall short or leave a gap.
Verify identity against impersonation
Defense Against AI-Enabled Attacks · Verify identity against impersonation
21 AI impersonation and deepfake defense
Can we verify the person requesting access, money, employment, or another sensitive action?
What AI changes: A cloned voice or a live deepfake means you can no longer verify someone by recognizing them. Evaluate manipulated-media detection together with an independent way to verify the person and a safe fallback. Test these controls inside the real help-desk, payment, or hiring workflow, where compression, latency, and uncertain results shape the decision.
Evidence: In May 2025, the FBI documented attackers using AI-generated voices to impersonate trusted people, gain trust, and pursue account access. Pair detection with independent verification.
- Detect replay, injection, and synthetic or altered audio and video in live and recorded media
- Correlate the result with identity, device, session, or prior-enrollment signals
- Show the result, verification step, and safe fallback inside the workflow where the decision is made
- Preserve evidence and report latency, false positives, false negatives, and performance drift
Consider specialist detection where an access, payment, hiring, or recovery workflow relies on live audio or video and needs to spot manipulation.
Use the real call or meeting path. Test genuine and cloned voices, video injection, replay, compression, noise, accents, languages, and poor connections. An uncertain result must give the employee a clear next step and record the decision.
Measure false acceptance and rejection by media, channel, and condition. Track added time, completed verification, and high-risk actions that continued after an uncertain result.
Use this category for synthetic-media detection and verification in high-risk workflows, including the forensic analysis that supports them. Use Email and collaboration security for phishing and business email compromise, and Identity and account protection for protecting accounts and sessions. General KYC, disinformation, and content provenance are outside this map.
Defend enterprise systems and data
Defense Against AI-Enabled Attacks · Defend enterprise systems and data
22 Email and collaboration security
Can we stop a convincing malicious message that carries no obvious warning signs?
What AI changes: Attackers can use AI to tailor a persuasive message to the person and the situation. Include fluent, personalized conversations in your tests, with no malicious attachment and no obvious language errors. Check whether content, relationship, and account signals together expose the deceptive request, including when it comes from a compromised trusted account.
Evidence: In April 2026, Microsoft documented AI-personalized phishing lures and automated account compromise. The tests below apply those findings to the messaging channels you use.
- Analyze content, sender identity, relationships, and account activity together
- Detect phishing and BEC without a known malicious link or attachment
- Identify compromised accounts and remove malicious messages
- Verify protection across the email and collaboration channels in use
- Abnormal AI Email Security
- Check Point Email Security
- Microsoft Defender for Office 365
- Mimecast Advanced Email Security
- Proofpoint Core Email Protection
Ask your vendor for results on the test scenarios below, using the features you license and the channels you have enabled. Add to or replace the product where a significant gap remains.
In a controlled test, use personalized payment and credential requests, including a multi-message exchange from a simulated compromised account. Vary the wording and language but keep the deceptive intent. Measure missed attacks, time to remove them, and false positives against similar legitimate requests. Test each licensed email and collaboration channel separately.
Use this category to inspect and stop deceptive messages. Use AI impersonation and deepfake defense for synthetic voice and video verification, and Identity and account protection for account and session protection.
Defense Against AI-Enabled Attacks · Defend enterprise systems and data
23 Identity and account protection
Can we prevent account takeover and stop misuse of a valid session?
What AI changes: Attackers use AI to craft a convincing story with personal details, which puts more pressure on recovery processes that trust a plausible story. Check whether an attacker can get around strong authentication through a weaker reset or enrollment path. Then test whether your team detects and shuts down the session that follows; a successful login doesn’t prove that what happens next is legitimate.
Evidence: In April 2026, Microsoft documented token theft and ongoing account access after AI-enabled phishing. The recovery and enrollment checks below are extra test scenarios that go beyond that evidence.
- Verify recovery requests without relying on evidence the requester supplies
- Apply phishing-resistant authentication and least-privilege access
- Detect credential misuse, privilege escalation, and risky sessions
- Revoke affected credentials and sessions, and verify that access stops
Test recovery verification, IAM, PAM, and identity threat detection together. The products listed cover different parts of this process. Phishing-resistant authentication and least privilege come from your identity controls; an ITDR product on its own doesn’t provide them.
Simulate a well-informed recovery request, an attempt to re-enroll MFA, and then misuse of a valid test account. Check that fallback verification doesn’t rely on evidence the requester supplied. Measure how long it takes to detect and cut off access, including application sessions and tokens that may survive an identity-provider logout.
Use this category to protect accounts, credentials, and sessions. Use Automated application and API abuse defense for automated login and workflow abuse, AI impersonation and deepfake defense for synthetic-media verification, and AI agent identity and authorization for the identities and delegated authority of your own AI agents.
Defense Against AI-Enabled Attacks · Defend enterprise systems and data
24 Rapid exploitation defense
Can we protect an exposed system before attackers exploit it?
What AI changes: Attackers can use AI to research vulnerabilities and build exploits faster, which leaves you less time to protect an exposed system. Measure the time from disclosure, or from discovering the exposure, to verified protection. Scan frequency and a remediation SLA don’t tell you whether a reachable attack path stays open while you wait for a fix.
Evidence: In May 2025, the UK’s NCSC assessed that AI will shorten exploitation timelines further. Set a response window for your test; the assessment doesn’t imply one patching deadline that fits every organization.
- Find affected, reachable assets quickly when a relevant weakness becomes known
- Assign emergency remediation and mitigation owners using attack-path and business context
- Apply temporary protection when a fix can’t be applied right away
- Verify that remediation or mitigation closes the exploitable path
Connect exposure assessment to the people who own remediation and enforcement. Assessment products find and prioritize weaknesses; a WAF can shield supported web attack paths. Neither proves you can mitigate every infrastructure exposure before a patch is in place.
Use an isolated vulnerable test asset and set a disclosure time. Time each step against a shortened exploitation window: discovery, prioritization, interim protection, and verified closure. Confirm the mitigation blocks the relevant path, note any bypasses and unsupported assets, and compare the result with your published remediation SLA.
Use this category to test how fast you reach verified protection when exploitation speeds up. Your team doesn’t have to use AI. Use AI exposure analysis and remediation to evaluate the AI’s prioritization and remediation work, and AI-led security testing and validation for attack evidence. Use Automated application and API abuse defense for abuse of legitimate workflows, and AI security posture management for the posture of AI-specific assets.
Defense Against AI-Enabled Attacks · Defend enterprise systems and data
25 Endpoint and network defense
Can we detect malicious behavior when the code or attack sequence is unfamiliar?
What AI changes: Attackers can use AI to write and vary malicious code. Test whether protection holds against new variants of the same malicious behavior, including scripts and abuse of legitimate tools. Blocking one known sample in a demo proves little. Measure endpoint and network visibility separately.
Evidence: In November 2025, Google reported AI-generated commands in malware used in live attacks, and experimental malware that regenerates its own code. These findings support testing varied behaviors; they don’t mean every attack adapts on its own.
- Detect malicious file, process, script, and network behavior
- Identify abuse of legitimate tools and lateral movement
- Correlate host and network evidence for investigation
- Isolate compromised systems and measure the effect on legitimate activity
- CrowdStrike Falcon Insight XDR
- Microsoft Defender for Endpoint
- Palo Alto Networks Cortex XDR
- SentinelOne Singularity Endpoint
Validate EDR and network coverage, including unmanaged systems. Require a reproducible result rather than an “AI-powered” product label.
Run an authorized simulation with payload and script variants the product hasn’t seen, all pursuing the same attack objective. Include sequences that abuse legitimate tools, plus benign look-alikes. Measure misses, time to detect and isolate, and false positives. Repeat on systems without endpoint agents to see what the network product can detect and which connected control can contain it.
Use this category for detection and enforcement on hosts and networks. Use Attack detection and containment to evaluate coordinated containment across systems. Use AI application runtime security and AI agent action control to secure your own AI applications and agents.
Back to the map ↑Next: Data theft and exfiltration defense →
Defense Against AI-Enabled Attacks · Defend enterprise systems and data
26 Data theft and exfiltration defense
Can we stop theft of sensitive data that looks like legitimate access?
What AI changes: Attackers can use AI to find valuable data and decide what to collect. Test selective theft through valid accounts as well as bulk downloads. Can your controls recognize sensitive content and block an unauthorized destination when the volume alone looks normal?
Evidence: In November 2025, Google documented AI-assisted document collection by PROMPTSTEAL, malware used by the Russian state-backed group APT28, and Anthropic reported an AI-orchestrated espionage campaign in which AI selected databases and extracted data. The selective-transfer scenario below is our own test, built from these findings.
- Recognize sensitive content in the file types and channels being protected
- Evaluate transfers using content, user, destination, and available activity context
- Block or restrict unauthorized transfers through supported channels
- Preserve evidence of attempted and completed transfers
Test the DLP enforcement you already license, including unsupported file types and channels. Connect it to data classification, access governance, and activity monitoring where needed. The DLP products listed don’t, on their own, give you least privilege or visibility into every repository read.
With synthetic sensitive data and an authorized test account, attempt both a small, high-value transfer and a bulk export to controlled unauthorized destinations. Use the same channels as legitimate work. Measure data released before enforcement, blocking accuracy, evidence retained, and legitimate transfers interrupted.
Use this category to limit data theft through enterprise access and transfer paths. Use AI data access and exposure security for data exposed through AI applications, retrieval systems, or agent memory, and Automated application and API abuse defense for automated scraping and workflow abuse. Use AI-assisted data protection to evaluate the AI doing classification and protection work, including what happens when it mislabels data or makes the wrong policy call. Finding sensitive data doesn’t prove you can stop it from leaving.
Defense Against AI-Enabled Attacks · Defend enterprise systems and data
27 Attack detection and containment
Can we piece an attack together and contain it before it spreads across systems?
What AI changes: Attackers can use AI tools to chain attack steps with fewer manual handoffs. In a defined scenario, check whether your coordinated containment finishes before the attacker’s next harmful action. A good alert does not help if the attack keeps running while the case waits in a queue or for an approval.
Evidence: In November 2025, Anthropic described AI-orchestrated intrusion steps; in April 2026, Microsoft described automated phishing and post-compromise activity. We shorten the response window to stress-test your process. Real attacks will not all move this fast.
- Connect evidence across security tools into one attack timeline
- Coordinate account, session, device, and network containment
- Control response permissions, approval requirements, and exceptions
- Verify containment and recover safely from mistaken response actions
- Google Security Operations
- Microsoft Defender XDR
- Palo Alto Networks Cortex XSIAM
- Splunk Enterprise Security Premier
Test your deployed tools and managed services together as one response process. Confirm product editions, connected telemetry, response integrations, and permissions. Detecting an attack doesn’t give a tool the authority to revoke a session or isolate a device, and automatic actions come with their own prerequisites and exceptions.
Run an approved scenario that moves from an account to an endpoint to data, shortening the gap between steps each time. Measure the time from the first actionable signal to verified containment, and note which harmful actions finish first. Include a missing telemetry source and a delayed approval, then confirm you can safely recover from a wrong containment decision.
Use this category to evaluate coordinated containment across systems. Use Endpoint and network defense to evaluate endpoint and network controls themselves, and AI SOC investigation and response to evaluate AI doing SOC work. One platform can serve both purposes, but using AI doesn’t, on its own, prove you can defend against AI-enabled attacks.
Back to the map ↑Next: Automated application and API abuse defense →
Defense Against AI-Enabled Attacks · Defend enterprise systems and data
28 Automated application and API abuse defense
Can we stop abusive automation while letting legitimate users and authorized agents through?
What AI changes: AI agents can navigate applications and act on a user’s behalf, so you need to tell permitted automation from abuse. Include adaptive, multi-step activity through normal application functions in your tests. Check the agent’s identity, claimed authority, and actions together; a bot score or a successful login doesn’t tell you whether the workflow is authorized.
Evidence: Cloudflare documents how AI crawlers and agents behave differently. The tests below use that difference to probe OWASP’s established business-flow abuse risk. Not all automation uses AI, and not all AI agents are malicious.
- Detect automated credential attacks, abusive registrations, scraping, and sensitive-workflow abuse
- Correlate requests across sessions, accounts, devices, and workflow steps
- Apply allow, challenge, rate-limit, or block policies to the relevant action and risk
- Verify an agent’s claimed identity where supported, and keep evidence without blocking authorized use
Test your existing CDN, WAF, bot, identity, and API controls together as one workflow. Confirm which capabilities need separate modules. Ask the vendor what catches abuse that uses valid requests, beyond known signatures and rate limits, and how it handles authorized agents.
In a controlled application, compare a human user, an authorized agent, and abusive automation completing the same multi-step flow. Vary timing, session continuity, and account use, including activity below simple rate limits. Measure harmful actions completed, false blocks, challenge completion, and the time to enforce a changed policy.
Use this category for abuse of application functions that may be working exactly as designed. Use Rapid exploitation defense for exploitable weaknesses, Identity and account protection for workforce account and session protection, and Data theft and exfiltration defense for sensitive-data transfer controls. Use AI agent identity and authorization to authorize your own AI agents. General transaction fraud is outside this map.
How this map is built and updated
Category rule. Each category names a security job, an accountable owner, its own evaluation criteria, and relevant solution options. In Defense Against AI-Enabled Attacks, an established defense earns a place when AI changes the scenarios, coverage, or response window buyers should test; more attack volume on its own isn’t enough. The 28 categories are areas to evaluate, not 28 separate purchases. A platform can appear in several categories when its documented capabilities cover different security jobs. We assess each appearance separately, and appearing more often is not a ranking or an endorsement.
Security of AI rule. A category belongs here when the risk is specific to AI your organization uses, buys, or builds (its models, agents, components, or the data they reach) and existing network, cloud, application, identity, and data controls may not cover it on their own.
AI for Security rule. A category belongs here when AI does or substantially helps with a defined security job, buyers need to judge the quality and consequences of that work, and documented products exist. An AI interface or a generated summary isn’t enough on its own; the AI must contribute to a security decision or action whose quality you can evaluate. Established machine learning, generative AI, and agentic AI can all qualify. Ask two questions: what security work are you handing to AI, and how would you know if it got that work wrong?
Vendor rule. Our lists are selective, unranked, and independent of sponsorship. To be listed, a product or module needs current public documentation that shows its role in the category. The selections show a range of relevant capabilities and deployment approaches, from established platforms to specialists. Product names, capability groups, and notes show each listing’s role; notes explain broad or overlapping offerings where needed. Products are grouped by capability and listed alphabetically within each group, and the lists are not exhaustive. A listing doesn’t mean we tested the product, that the product covers the whole category, or that you need to buy the product. Check editions, supported environments, availability, and integrations for your own deployment. Product notes describe what vendors document, not results we verified independently. We flag preview status and significant availability limits where vendors document them.
Framework crosswalk. Each category links to relevant standards and threat frameworks. These links point to control objectives and attack behaviors; they don’t prove AI-specific effectiveness or compliance. The three areas also line up with the focus areas in the initial preliminary draft of the NIST IR 8596 Cyber AI Profile: Security of AI with Secure, AI for Security with Defend, and Defense Against AI-Enabled Attacks with Thwart.
Update rule. Each review checks product availability, ownership, public evidence, links, and category fit. Every category must keep a distinct security job and a distinct reason to evaluate. We merge categories when their scope and tests largely overlap; a new label or a vendor launch alone doesn’t justify a new category. AI threat assessments, including the NCSC’s assessment of AI-enabled threats, and reported incidents shape the test scenarios. In Defense Against AI-Enabled Attacks, the evidence notes explain why we changed a test scenario. In AI for Security, vendor documentation backs up what we say the AI does. Neither is independent proof that a product works. The suggested tests are our editorial guidance, not product benchmarks.
Scope appendix
The map covers capabilities that secure AI systems, use AI to do security work, or defend against AI-enabled attacks. This appendix explains which related capabilities are covered, where they sit among the 28 categories, and which areas fall outside enterprise cybersecurity.
See what the map leaves out and why
Related capabilities and boundaries
- AI-enabled phishing, identity abuse, exploits, malware, data theft, and application abuse: Covered through established defenses in Defense Against AI-Enabled Attacks; these markets are part of the map.
- Application security: AI-assisted analysis and remediation is included whether code was written by people or AI. The wider market for conventional code, dependency, and pipeline security is outside this map. AI-specific components are covered in AI component and supply-chain security.
- Workforce AI coding tools: Coding agents and their actions are covered in AI coding agent security. Usage controls are covered in Workforce AI access and usage security, and agent credentials in AI agent identity and authorization.
- Customer account takeover: Automated attacks on customer logins are covered in Automated application and API abuse defense. Broader customer identity (CIAM) fraud and account recovery are outside this map.
- General payment and transaction fraud: Outside the map unless tied to a defined cyber control or verification workflow.
- General security copilots and reporting: Treated as features of the platform doing the underlying work, not as separate categories. To be included, they need a defined security outcome that can be evaluated.
Covered within the map
- MCP, model, plugin, and tool scanning: AI component and supply-chain security.
- Prompt injection defenses and guardrails: AI application runtime security.
- Vector, embedding, RAG, and retrieval-permission risks: AI data access and exposure security.
- Agent tool use, plans, and handoffs: AI agent action control. Sensitive data in agent memory: AI data access and exposure security.
- Coding agents, IDE extensions, and MCP servers on developer machines: AI coding agent security.
- Investigating and containing attacks on AI systems: AI incident detection and response.
- Model theft and extraction: Covered by the runtime, identity, and data-access categories, with AI security posture management covering exposed model files and storage.
Outside enterprise cybersecurity scope
- Model quality, accuracy, and performance evaluation: Not covered. That is the AI quality and reliability market.
- Bias, fairness, and general explainability: Not covered unless tied to a security control. That is responsible-AI governance.
- General content moderation: Not covered. That is trust and safety.
- Synthetic-content creation: Not covered. That belongs to content-production tools and services.
- General AI observability and performance monitoring: Not covered unless it delivers a security outcome. That is AI operations.
Boundary watchlist
We’re watching two areas that may become categories: enterprise content authenticity and confidential AI computing. Each would need a distinct security job, clear evaluation criteria, and identifiable products.
Corrections and related research
To suggest a correction, send the product name, category, capability, and a link to public documentation. Our editors review every submission.
Related research
2026
AI Risk and Readiness Report · Cybersecurity
Insiders research library · AI security coverage