AI Agent Runtime Security Moves Into Production

Hey guys, thanks for the throw. 5 million to develop a runtime that makes it possible to safely run AI agents. Nadeem, welcome to the show.

Great to be here. Everybody lately seems to be very much obsessed with the runtime now as the place to focus on. So what is shifting here, and what makes the runtime the place to secure AI agents, and just how secure is this going to be?

The reason runtime is becoming that important is it's just been the forcing factors of your ability to connect AI agents to various systems very easily using protocols like MCP. And now the un-thought of or what I don't know what I don't know factor of what these AI agents are going to do with those systems creates a lot of heartburn for the security team. And this is not something that could be traditionally with other systems like cloud will detect vulnerabilities and let you fix them in your leisure.

" We've seen this happen before. What I think has been a catalyst lately is we've heard of models that have been able to act in an unpredictable way on production, meaning there were good guardrails in place. People thought that they would behave in a certain manner, then suddenly they found themselves being able, in the runtime, to access different systems and provide themselves access to things that you didn't think they really should have access to, or that wasn't your intention.

And therefore, that's all been drivers towards the question of, how do I make sure that this agent, when it's talking to these systems, will only perform these actions and not accidentally decide to do something else? And that's where you need to then be able to provide a solution in the runtime that gives you the governance, okay, and enforceability at that specific juncture. So how hard will it be to set something like that up?

Because, as we've seen, there's clearly a lot of concern about what AI agents may or may not be able to do these days. In fact, it's even now a debate in the halls of Congress. But can we deploy a runtime?

How do we go do that? And how complicated is that ever going to be? So it depends, obviously, on the provider, but I think for our approach, a lot of the infrastructure exists, okay?

And there are two, what I consider two main components for enforcing in the runtime. You need a smart decision point and you need an enforcement point. Enforcement points exist.

It's an API gateway, MCP gateway. It could be hooks on an agent, et cetera. The most challenging thing is you need to have the right decision point in place to be able to understand what the agent is trying to do, compare that with a policy, and do all of that in a performant manner as well.

Just to give an example, we have as part of our solution, a non-deterministic layer that has a learning deterministic layer on top of that. The value of that is the deterministic layer is very performant, okay? And it can handle what we always call the N plus one requests.

Agents tend to perform the same type of requests and actions over and over again. Okay? We treat anomalies in a different way.

But then we can build a very smart deterministic layer that is performant on cost and time. Okay? So when I talk about a smart decision point, in order to deploy this, we already have today in organizations a lot of infrastructure that allows us to deploy this quickly.

All you need is the right decision point that we provide in a timely manner. Mm-hmm. And will that be fast enough?

Because some of the concerns that you hear from folks about AI agents is these things are operating at machine speed. So how do I inject something in front of that that prevents them from doing something that I don't want? That is a great question, and that is exactly why we built what I described before.

When you start deploying, our deterministic layer gets built, it becomes very performant from a time perspective, sub 50 milliseconds. That is something that it's an industry standard when you integrate with APIs or capabilities as part of your critical path, that is acceptable. " And we have a very robust workflow that quantifies the risk of operations when we see anomalies, how they can impact financially, from a compliance perspective, reputation, et cetera.

So the intention is not to stop the agent from performing known and approved use cases. It's to take another few seconds to examine what happens when they're getting out of norm. Do you think that we're at the point now where organizations are going to be proactive about securing these AI agents?

Or are we still waiting maybe for some sort of catastrophic event before everybody wakes up? Or door number three, are we just going to maybe experience death by a thousand cuts before we do something about it next year? Listen, from what we're seeing today, definitely people have not held back on adopting AI for their organizations, okay, before putting the security harness in place.

However, I'm not going to mention names, but the recent events of experiments that have happened and the way AI can get out of control is raising a lot of eyebrows, okay? And at the end of the day, security is there to prevent an operational catastrophe, okay? And people understand that they're starting to get exposed to potential operational catastrophes, and that's why we're having more and more conversations.

This is definitely something that people want to act on this year and have in place the harness that will again, reduce their risk. Okay, definitely in 2027. We're seeing in 2026, this has been the transformational year where this becomes from a nice to have to a must have, okay?

It's already a budget line item in this year, definitely in that year. I think this year it's maybe just eating from one specific line item. I think next year it's going to be just a section by itself.

And the reason why I say that, I think that there's no longer, it's not a hunch. Okay? Or to your point, could we live without this?

People are actively now looking to start putting security components in place that can handle this challenge. And the issue is not just that the AI might go rogue, right? There's also the threat that some sort of malicious actor is going to get a hold of the credentials and start using that AI to do things it wasn't designed to do in the first place.

But we can prevent that at runtime as well? Exactly. And I'll mention, I think the two main concerns that came from CSOs that we interviewed were, one, unintended actions by agents, as you mentioned, and the malicious kind of intention to cause the agents to perform unintended actions.

I talked to a company in the UK that does penetration testing for AI agents. They mentioned that they don't even do prompt injections anymore as a test because it's just too easy to do. AI agents, as a fact, are going to be either close to perform unintended actions or going to perform unintended actions.

" So if they accidentally think that they should do something different or somebody tries to manipulate them to do something different, we can catch that. Now, how do we catch this? We catch this in a variety of options.

We can see if this is a new type of behavior that they've never done before. We treat this as anomaly. We can look inside of a session itself and see procedures that happen if there's any anomalies in the procedures that are happening.

And we can even look at this as what's called on a daily basis, how agents operate on a daily basis, and see if there are any spikes in even behaviors that they do. That gives us a good coverage to try to understand when agents are trying to be manipulated. We're covering it from multiple angles to understand that not only are they trying to do a behavior that they're not intended to or hasn't been done before, even if somebody's trying toPull the database by getting user a million times, okay, in a session.

We can find that. We can call that out and say, "No, sorry. You're blocked from doing this.

" So that's how, yes, in the runtime, you can prevent those malicious actions from happening. As you kind of pull all this together, will the AI agents in their rise kind of finally force us to revisit cybersecurity and governance and all these things the way we've been doing it for the many years? Because, well, I think there's going to be tens and hundreds of thousands of AI agents in our existing systems were not designed for that level of scale.

100%. And I think, listen, the biggest change that I'm seeing is applications used to augment employees, okay? You brought in an application, it made your life easier.

I have an ID for programming, it makes it easier for me to program. I think this is the first time where we're seeing software really as the employee itself, okay? And you hire a lot of employees, okay?

And the difference between employees, if you have in a department 100 employees, these are 100 distinct, unique people that operate in different ways, and maybe one of them can accidentally make a mistake. Here with AI agents, to your point, this could be 1,000 workers that think the same, do the same, okay, and have the ability to perform anomaly actions. That could be suddenly this is the entire department going rogue, okay?

How do we manage that now in an organization? How do we detect in the speed as well, okay? When if you're at a bank and a worker accidentally walks to walk towards the safe, it takes them some time to walk towards the safe and you can maybe catch it, right?

With AI agents, everything is happening in milliseconds. You need to now start putting in place the software components that could be that manager in runtime and work at the same pace, okay? And understand that you have multiple employees.

So we bring to security all of the paradigms from the physical workforce. AI agents have job descriptions. They even have managers.

How do we screen them? How do we understand what they're supposed to, and not supposed to do from different lenses inside the organization? I think that is to your point, that change in paradigm, okay, of before it was access authorization, okay, was really the main thing.

I think now we have to shift to the behavior. Well, how do we make that shift to the behavior? Because some folks would point out that AI agents are generative and by definition probabilistic, and they never do the same thing the same way twice.

So how do I know what's normal and not normal? And I think that's a great point. At the end of the day, when we define behaviors, behaviors are defining a pattern of just maybe the world of a request and a response.

And I'll give an example. If you have an agent that's connected to Jira, it might use one time a tool that's called Get Ticket by ID. Maybe one time it'll call a tool called Get All Tickets where ID equals.

And there could be multiple ways for it, to your point, to perform the same task. When we look at a behavior, it's accumulating different types of ways, okay, to perform the same objective, okay? " So when we examine requests coming in, we want to make sure that those type of requests comply with these type of behaviors.

And that's why it can do things in many different ways, but at the end of the day, it needs to comply with a behavior that it's allowed to do, okay? And that is the difference between static rules, okay, and the ability to examine behaviors in runtime and then build a dynamic deterministically on top of that. And that is really the main core difference.

To your point, agents are going to perform things differently. We need to fully understand what they're doing, see that it truly maps to something that's approved, and then build on top of that. Yeah.

So right now, a lot of people are appalled about what an AI agent might do. But I have to wonder, how quickly are we going to get to a world where, if there is a security incident involving an AI agent, it's more a reflection of poor IT and security hygiene than it is a function of that something that the AI agent went out and maliciously did on its own. Listen, I will answer this back and I'll say, let's look at the physical world.

We, for years now, have been investing on securing the physical world, right? We provide employees with identity and access and badges and even different physical areas where people sit. We still have security breaches every single day.

Is it because the specific person was trying to be malicious about it? Or is it because, no, the world is not perfect. People are deploying things and our environment is dynamic.

It changes all the time, okay? Suddenly we had to hire more people to the finance organization. There was no room in the finance room.

We have to put them together with the developers. Now suddenly we've got finance people sitting next to developers. What happens then?

What does that mean? The reason I'm just bringing these examples up is the complexity of the real world has never been now 100% secure. It's always been about how much resistance do we want to put in place to mitigate risk.

The same thing is going to happen with AI agents. AI agents, we're going to put security measures in place. We're going to do our best to confine.

You can't, at the end of the day, control everything, okay? The point there is you want to make sure that you are covering your main bases. " Because we know as well, the biggest security breaches that we've seen in the past have been a chain of approved actions.

This IT person was allowed to do this, so he provided that credential. Then they took it to this department, to this department, and then somehow that resulted in somebody getting $500,000 out of the bank account. That's how I think CISOs are going to be measured.

Did you take the right measures to secure this AI and still resolving this, or were you negligent in putting the right control to do? " Whenever I see an AI agent being approved to connect to a critical system with no governance, that for me is like, and where I hear the justification is we're making calculated risks. Okay.

That for me is, that's a leap of faith, okay? This, at the end of the day, we've seen this already. I've written enough articles about this already.

AI agents have deleted production environments. Nobody bought that agent and said, "You know what? " Nobody ever said that, but it happened.

" No, no, no. So when I see people, I can understand people connecting to, let's say, development environments or staging environments, running tests to see the value that agents can provide. When you start giving autonomy to agents to operate in these most critical systems for you without governance, it's like telling people, I'm going to leave the safe of the bank open, and I trust everybody here that nobody's going to go and walk in there and take money.

It's the same exact same thing. All right. Well, folks, you heard it here.

Hey, the question is not so much maybe whether or not the AI agents are the problem, or rather, is it the humans that deploy them in the first place? Hey, Nadav, thanks for being on the show. Thank you so much.

And back to you guys in the studio.