The thinking behind AI security review.
Threat models, governance evidence, and the decisions that hold up under scrutiny. Written for security architects and the committees they report to.
New posts in your inbox,
when they publish.
Threat modeling, governance evidence, and what AI Committees actually need — written for security architects and AI governance leads. No cadence promises.
Reviewing Workday Illuminate agents — what the Agent System of Record actually governs
A dedicated governance system for first- and third-party HR and Finance agents is a real step forward. What a review still has to confirm before trusting it.
ISO 42001 certification — what the external audit actually checks
What an ISO 42001 external auditor samples at Stage 2, the nonconformity categories, and evidence gaps that recur most.
Reviewing Kiro — the steering-file CVE, and four more disclosures
AWS's agentic IDE keeps specs as the unit of work and reads persistent "steering files" on every interaction. The trust-boundary risk that raised was hypothetical when first flagged — CVE-2026-10591 confirmed it.
Reviewing Replit Agent — the lesson from a rogue production database deletion
An autonomous agent ignored an explicit "code freeze" instruction, deleted a production database, and then tried to cover it up. What was missing, and what a review has to require before an agent gets that kind of access.
Reviewing Devin deployments — shell, browser, and editor access with near-zero review window
Devin plans, codes, tests, and deploys with minimal supervision, holding shell, browser, and editor access simultaneously. What a review has to bound before that autonomy reaches production.
Multi-tenant RAG — the isolation boundary a security review must verify
Shared RAG serving multiple tenants creates a retrieval boundary user-level ACLs cannot cover. Verify it before sign-off.
Reviewing Cursor deployments — Privacy Mode is off by default
Cursor's Background Agents and Workspace Trust controls are real. Privacy Mode, which stops code from being stored or used for training, isn't on by default — not unless someone turns it on.
Reviewing GitHub Copilot's coding agent — the rules-file supply chain
A sandboxed cloud agent that opens its own pull requests still trusts the rule files in your repo — and hidden Unicode in one can silently steer what code it writes. The review questions that catch it.
Reviewing ServiceNow AI Agents — the lesson from a hardcoded shared secret
CVE-2025-12420 let any attacker with an email address impersonate a ServiceNow user and run AI agents with their privileges — via a static token shipped identically on every instance. What that teaches a review.
Reviewing Google's Gemini Enterprise Agent Platform — the Vertex AI and Agentspace merger
Vertex AI Agent Builder and Agentspace consolidated into one platform in 2026, with A2A in production and MCP native to BigQuery and Maps. What changed, and what a review needs to check.
Agent-to-agent protocol security — what A2A adds beyond MCP
A2A governs what agents ask each other to do -- capability-card spoofing, delegation without provenance, transitive access risks.
Reviewing IBM watsonx Orchestrate — the Agentic Control Plane's actual reach
One control plane governing agents from any framework, with MCP support and least-privilege token exchange. What a review has to confirm it's actually covering, not just onboarding.
Free resources
Practical templates for every framework covered here.
AI Security Review Template
Full evidence pack with threat model, controls, and evidence grading.
OWASP Agentic Top 10 Controls
Each risk mapped to required controls and lifecycle gates.
Decision Memo
Clearance decision template with rationale and sign-off log.
AI Go-Live Security Checklist
Production gate checklist for security architects and CISOs.