The thinking behind AI security review.
Threat models, governance evidence, and the decisions that hold up under scrutiny. Written for security architects and the committees they report to.
New posts in your inbox,
when they publish.
Threat modeling, governance evidence, and what AI Committees actually need — written for security architects and AI governance leads. No cadence promises.
Reviewing Cursor deployments — Privacy Mode is off by default
Cursor's Background Agents and Workspace Trust controls are real. Privacy Mode, which stops code from being stored or used for training, isn't on by default — not unless someone turns it on.
Reviewing GitHub Copilot's coding agent — the rules-file supply chain
A sandboxed cloud agent that opens its own pull requests still trusts the rule files in your repo — and hidden Unicode in one can silently steer what code it writes. The review questions that catch it.
Reviewing ServiceNow AI Agents — the lesson from a hardcoded shared secret
CVE-2025-12420 let any attacker with an email address impersonate a ServiceNow user and run AI agents with their privileges — via a static token shipped identically on every instance. What that teaches a review.
Reviewing Google's Gemini Enterprise Agent Platform — the Vertex AI and Agentspace merger
Vertex AI Agent Builder and Agentspace consolidated into one platform in 2026, with A2A in production and MCP native to BigQuery and Maps. What changed, and what a review needs to check.
Agent-to-agent protocol security — what A2A adds beyond MCP
A2A governs what agents ask each other to do -- capability-card spoofing, delegation without provenance, transitive access risks.
Reviewing IBM watsonx Orchestrate — the Agentic Control Plane's actual reach
One control plane governing agents from any framework, with MCP support and least-privilege token exchange. What a review has to confirm it's actually covering, not just onboarding.
Reviewing SAP Joule agents — BTP integration and the A2A protocol surface
Joule agents run governed through SAP BTP, but pro-code agents built on LangGraph, CrewAI, and others connect in over A2A. What that hybrid model means for review.
Reviewing Salesforce Agentforce — the Trust Layer and what it doesn't cover
The Einstein Trust Layer sits between every prompt and every LLM. It's real security — and it's not the whole review. What still depends on the agent's running-user permissions.
Prohibited AI practices under the EU AI Act — what Article 5 actually bans
Article 5 now bans ten AI practices outright, including two additions from the 2026 AI Omnibus. What falls inside the line and how reviews distinguish.
Reviewing Microsoft Foundry Agent Service — hosted agents and hypervisor isolation
Every hosted agent session gets its own VM-isolated sandbox and an auto-provisioned Entra Agent ID. What that buys a review, and what it doesn't.
Reviewing AWS Bedrock AgentCore — Runtime isolation, Identity, and the Agent Registry
microVM-per-session isolation and enterprise identity federation solve real problems. What a review still has to check across Runtime, Identity, Memory, and the new Agent Registry catalog.
Reviewing Microsoft Agent Framework — the AutoGen and Semantic Kernel successor
AutoGen and Semantic Kernel are both in maintenance mode. Microsoft Agent Framework is what replaces them, with native MCP and A2A support — and the review questions that follow from that.
Free resources
Practical templates for every framework covered here.
AI Security Review Template
Full review pack with threat model, controls, and evidence grading.
OWASP Agentic Top 10 Controls
Each risk mapped to required controls and lifecycle gates.
AI Risk Disposition Memo
Clearance decision template with rationale and sign-off log.
AI Go-Live Security Checklist
Production gate checklist for security architects and CISOs.