All Research tracks

Defensive AI Security & Governance

Building the discipline of autonomous defense — detecting drift, governing intent, and containing AI threats at machine speed, with the human kept where judgment matters.

14 series · 69 articles

Series are numbered in a suggested watching order — start with 1.

1AI Security Baseline

1Why a Baseline: The 80/20 of AI Security and the Cost of Having No FloorWatch

2The Baseline Control Set: The Minimum Controls Every AI System Must HaveWatch

3Input, Retrieval, and Tool Boundaries: The Non-Negotiable Runtime GuardrailsWatch

4Identity, Logging, and Human-in-the-Loop: The Governance FloorWatch

5Adopting the Baseline: A Maturity Ladder, a Checklist, and a CI GateWatch

2Agent Identity & Lifecycle

1Non-Human Identity for Agents: Why Agents Break Human IAM and What a Machine Identity NeedsWatch

2Provisioning and Attestation: Issuing, Binding, and Proving an Agent's IdentityWatch

3Credential Lifecycle: Short-Lived Tokens, Rotation, and Delegation Chains at RuntimeWatch

4Decommissioning and Revocation: Killing an Agent's Authority Cleanly and ProvablyWatch

5Governing the Fleet: Identity Inventory, Least-Privilege Drift, and Lifecycle AuditWatch

6Revocation Drills: Measuring When Every Verifier Says NoWatch

3Intent-Based Governance

1The Intent-Governance Model: Governing by Declared Intent Rather Than Enumerated PermissionsWatch

2Capturing and Verifying Intent: Intent Specs, Provenance, and the Intent-Action GapWatch

3Policy as Intent: Compiling Intent into Enforceable Runtime Guardrails and Where It Fails OpenWatch

4Measuring Intent Conformance: Did the Agent Do What Was Asked, and Only That?Watch

5Governance at Scale: Intent Ledgers, Audit Trails, and Mapping to NIST AI RMF and the EU AI ActWatch

4Managed Identity & Federation

1The Resource Is the Credential: Who Can Become a Managed IdentityWatch

2Credentials Without Secrets: Federated Identity Credentials as an Unwatched Trust PathWatch

3When Removing Access Doesn't: Token Caching and the Revocation Window for Managed IdentitiesWatch

5Agent Observability

1The Observability Gap: Why Traditional APM Fails on Non-Deterministic AI SystemsWatch

2The Pillars for AI: Traces, Metrics, and Evals as First-Class TelemetryWatch

3Semantic Telemetry: Capturing Reasoning, Tool Calls, and Decision Provenance with OpenTelemetry GenAIWatch

4Detecting Regressions Without Ground Truth: Reference-Free Evals and Drift SignalsWatch

5An Observability Reference Architecture: Sampling, Cost, Privacy, and the Feedback LoopWatch

6Agent Behavior Security

1From Signatures to Behavior: Why Static and Permission Controls Fail on Non-Deterministic AgentsWatch

2Building a Behavioral Baseline: Action Distributions, Tool-Call Profiles, and Sequence ModelsWatch

3Anomaly Detection on Agent Traces: Sequence Models, Embeddings, and the Cold-Start ProblemWatch

4Behavior as Enforcement: Allow and Deny by Observed Behavior, Not Just Static PermissionWatch

5Evasion and Robustness: Mimicry Attacks on Behavioral Detectors and Their Provable LimitsWatch

7Agent Goal-Drift Detection

1The Goal-Drift Problem: What Drift Is, Why Non-Determinism Makes It Inevitable, and the Detection ObjectiveWatch

2Specifying Intended Behavior: Goal Representations, Invariants, and the Reference Policy to Drift FromWatch

3Detecting Drift at Runtime: Trajectory Distance, Reward-Model Monitors, and Statistical Change DetectionWatch

4The Base-Rate Problem: False-Positive Cost, Drift Budgets, and Calibrated Escalation ThresholdsWatch

5Closing the Loop: Correction, Rollback, and Human Re-Grounding Without Halting the FleetWatch

8Multi-Agent Trust Models

1The Multi-Agent Trust Problem: Why Agent Meshes Break Perimeter and Single-Identity AssumptionsWatch

2Trust Models for Agents: Capability-Based, Reputation-Based, and Zero-Trust for MeshesWatch

3Delegation and Transitive Trust: Trust Propagation, Confused-Deputy at Scale, and Chain-Length LimitsWatch

4Verifiable Inter-Agent Claims: Attestation and Signed Provenance Between AgentsWatch

5A Reference Architecture: Trust Brokers, Policy Meshes, and Failure ContainmentWatch

9Layered Outcome Assurance

1Layered Outcome Assurance: An Architecture for Securing Agents That ActWatch

2Layer 1, Continuous Pressure: Designing for Attackers Who Never TireWatch

3Layer 2, Agents as Actors: Knowing an Agent's True ReachWatch

4Layer 3, The Action Chain: Keeping Untrusted Content Away from Privileged ActionsWatch

5Layer 4, Whole Behavior: When Allowed Steps Compose into HarmWatch

6Layer 5, Explanatory Evidence: The Record Every Consequential Action OwesWatch

7Layer 6, Deterministic Enforcement: Guardrails the Model Cannot Argue WithWatch

8Adopting Layered Outcome Assurance: Conformance, Maturity, and Build OrderWatch

10Models as Insiders

1The Insider Playbook, Transferred: Which Insider-Risk Controls Survive Contact with a ModelWatch

2Diversity Is Not Independence: When a Second Model Actually Reduces RiskWatch

3Assume Subversion: AI Control Protocols and How to Evaluate ThemWatch

4The Emergency Brake: Stopping an Agent Mid-Task Without Making Things WorseWatch

5Disclosure Without a Code Path: Reporting Incidents in Model-Driven SystemsWatch

6Trusting the Model the Least: Scaling Containment with CapabilityWatch

11Autonomous Response

1The Case for Autonomous Response: Machine-Speed Threats Need Machine-Speed ContainmentWatch

2Investigation as a Pipeline: Signal Triage, Evidence Gathering, and Hypothesis TestingWatch

3Containment Primitives for Agents: Quarantine, Capability Revocation, and Safe RollbackWatch

4Guardrails on the Responder Itself: The Autonomy-Safety Trade-offWatch

5Measuring Response: MTTD, MTTR, and the False-Containment CostWatch

12Autonomous SOC: Authority

1The Irreversibility Spectrum: A Taxonomy of Autonomous SOC ActionsWatch

2Principal Hierarchies in AI-Automated Response: Who Governs the Responder?Watch

3Chain-of-Custody in AI-Mediated ForensicsWatch

4Playbook Drift as an Attack Surface: When SOAR Updates ItselfWatch

5Measuring Autonomous SOC Readiness: An Assessment FrameworkWatch

13Uncertain Tool Outcomes

1When a Tool Cannot Tell You Whether It ActedWatch

14Autonomous SOC: Detection Limits

1Statistical Limits of Autonomous Anomaly DetectionWatch

2Concept Drift in Production Detection Models: The Defender's Red QueenWatch

3Cross-Tenant Leakage in Shared Detection ModelsWatch

4The Causal Gap: Why Correlation-Based Triage Fails Low-and-Slow AttacksWatch

5Evaluating Detection Fidelity Without Ground TruthWatch