Agent security and cybersecurity
Follow hostile input to the action it could influence.
Agent security connects untrusted content, delegated authority and real system effects. Build a threat model around those relationships so that testing and controls address the deployment you actually have.
Follow hostile input to the action it could influence
- Untrusted source
- A document, message or tool result an attacker may influence.
- Agent decision
- The point where content can affect a plan or instruction.
- Privileged tool
- The interface capable of reading data or changing state.
- Containment control
- The mechanism that limits, detects or stops the effect.
Discipline model
A threat becomes consequential through the action path
The relationships that define the discipline
- Untrusted source
- External content enters through a surface with a particular trust level.
- Agent decision
- Planning can carry that influence towards a privileged operation.
- Privileged tool
- The interface connects a request to data access or an external effect.
- Containment control
- Prevention and containment belong beside the effect they are intended to limit.
A threatening instruction matters because of the action it might induce. Map the path from an external document or connector description to data access, memory changes or tool execution. This places prompt injection beside identity, dependency trust, memory poisoning and incident response instead of treating a persuasive answer as the only security outcome.
Illustrative situation
A hostile document can reach a privileged interface
A constructed situation to reason through
Illustrative scenario
- Hostile document
A retrieved page asks for customer data to be sent externally.
- Privileged request
The agent attempts a connector action using its delegated identity.
- Control question
Inspect whether authorisation and egress rules prevent the effect.
Use this situation to identify the evidence that would change the decision. The proposed examination must stay within the agreed scope, and any conclusion must describe the conditions actually inspected.
Working approach
Separate model behaviour from the actual security effect
Proposed investigation sequence
- Define untrusted source
State the decision and conditions the work must address.
- Map agent decision
Connect the relevant actors, configuration and evidence.
- Examine privileged tool
Use agreed evidence and controlled cases where appropriate.
- Review containment control
Record limits, ownership and the condition for a next decision.
Agree the deployment boundary, rules of engagement and evidence handling. Derive scenarios from exposed inputs and effective authority, review the controls, then exercise selected paths only as authorised. Separate the model response, attempted tool call, enforcement decision and resulting state. Reproduce material observations and define how a mitigation would be retested.
Working artefact
Connect each finding to a control and consequence
Illustrative working record
Illustrative working format
- Untrusted source
- Define the subject and the requirement the record addresses.
- Evidence reference
- Link source, version and observed condition without copying sensitive material.
- Privileged tool
- Explain the finding or choice and its consequence.
- Containment control
- Assign the next action and state what remains unresolved.
A security finding connects an entry point to an affected component and plausible business consequence. Record the observed evidence, conditions required, limits of confirmation and recommended control change. Severity needs a stated rationale; a dramatic prompt or screenshot alone does not establish exploitability or impact.
Scope and next decision
Keep testing inside the authorised threat boundary
Prepare a bounded next discussion
- Untrusted source
- Bring one concrete workflow question and its accountable owner.
- Agent decision
- Identify the evidence and access that can be made available.
- Privileged tool
- Agree the specialist involvement and responsibilities required.
- Written scope
- Confirm activities, evidence, readiness and acceptance before commitment.
Security testing must stay within authorised systems and methods. A scoped review does not guarantee the absence of vulnerabilities or confer certification. Infrastructure remediation, specialist penetration testing and incident operation need explicit responsibility and a separate commitment where applicable.
Explore the discipline
Specialist areas within this capability
Choose a question to explore its methods, boundaries and indicative outputs.
- Agentic AI threat modelling
- Secure agent architecture assessment
- Prompt-injection testing
- Indirect prompt-injection assessment
- Tool and capability abuse testing
- Agent privilege-escalation testing
- Cross-agent attack analysis
- Agent identity spoofing assessment
- Memory poisoning tests
- Retrieval poisoning tests
- Data-exfiltration testing
- Agent supply-chain security
- Model and dependency security
- MCP server security review
- Adversarial agent testing
- AI incident-response planning
- Agent kill-switch and containment design
- AI security monitoring
- Secure coding review for agent systems
- Security release assurance
Related services
Agent Release Readiness Review
The Agent Release Readiness Review is a fixed-scope, three-week independent test of one AI agent workflow that shows a release board what the agent does, what it is allowed to do and what happens when it is wrong, and ends in a signed recommendation.
AI Agent Runtime Security Review
Make every delegation explicit. Examine who the agent acts for, where it can execute and which tools it can reach when instructions alone are not enough.
AI Agent Red Team
Challenge the boundaries that matter to your workflow. Test agreed attack scenarios against agent instructions, tools and data access.
AI Agent Sandbox Assurance
Examine the boundary between agent execution and the systems around it, including files, networks, secrets and cleanup.
AI Secure Agent Architecture Review
Design authority and isolation into the system. Review trust boundaries, credentials, tools and recovery before deployment choices become difficult to change.
AI Secure Agent Deployment Review
Look beyond a successful demonstration. Examine the permissions, dependencies and operational controls that shape an agent’s behaviour in deployment.
Relevant insights
The permission boundary behind every agent action
An agent can only be evaluated in the context of what its tools allow. Examine identity, delegated authority and action boundaries before you put a workflow in motion.
Before your agent can act, define its authority
A working paper for the moment an AI system moves from advice to action. Map identity, permissions, approvals and recovery into an authority model your team can review and test.
Testing an agent’s network-egress boundary
“Internet access” is too broad a permission for an agent. Define destinations, protocols, data-release rules and failure behaviour, then test bypasses against the deployed network path.