Category Archives: AI and Machine Learning

Three Field Guides for the Security Problems Showing Up Right Now

Posted on by
Reply

Over the last several months, we have released three longer-form guides around problems we keep seeing in real environments:

  • The Antifragile SOC Book
  • The AI Agents Management Framework
  • The Security Leader’s Operating System

They cover different areas, but they share a common theme: how to operate effectively as complexity, automation, and pressure increase.

Books

Why We Created These Materials

These guides did not begin as content projects.

They came from working problems.

Over the years, we have accumulated a lot of models, processes, questions, and operating approaches that we use when helping organizations solve difficult security problems. Some came from client work, some from research, and plenty came from lessons learned the hard way.

Much of that knowledge lived in conversations, notes, presentations, and experience.

We decided it was time to write more of it down.

Not as theory, and not as another collection of cybersecurity predictions.

As practical field material people can use, challenge, adapt, and apply.

Continue reading →

The Top Three Things Security Teams Need to Understand About AI-Driven Attacks

Posted on by
Reply

The easiest mistake security teams can make about AI-driven attacks is to imagine a completely new species of adversary.

That is not what most organizations are facing.

The objectives remain familiar: steal credentials, gain access, persist, move laterally, collect data, commit fraud, extort the victim, or conduct espionage. What AI changes is the economics of the attack. It reduces the time, expertise, and attention required to move from one step to the next.

That distinction matters because it tells defenders where to act.

Google Threat Intelligence Group reported this week that it has observed adversaries moving beyond basic prompting into agentic workflows and AI-enabled automation. In one Q2 2026 case, a threat actor used an AI coding chatbot and agent instructions to help plan, build, and execute a mass credential-harvesting campaign in less than six hours. The framework automated scanning, troubleshooting, and IP rotation with limited human involvement. (Google Threat Intelligence Group, September 8, 2026)

That does not mean every attacker has become an autonomous machine. It means the constraints that used to slow attackers down are weakening.

OnlineScammer

Security teams need to understand three things.

Continue reading →

AI Agents Need Autonomy Budgets, Not Just Governance Policies

Posted on by
Reply

Most organizations are granting AI agents authority faster than they are defining the limits of that authority.

That is the problem.

We have already started treating AI agents as digital workers. That is the right mental model. An agent that can access data, call tools, trigger workflows, generate artifacts, influence decisions, or alter enterprise state is not just another application. It needs identity. It needs boundaries. It needs oversight. It needs evidence. It needs a human owner. It needs a kill switch. That has been the right foundation for agent governance.

But it is not enough.

There is another question that needs to be asked much earlier:

How much damage is this agent allowed to cause before a human must approve the next action?

Not theoretically.

Not in vague risk language.

In actual economic terms.

How much money can it spend?
How many systems can it change?
How many records can it touch?
How much customer impact can it create?
How much privacy exposure can it cause?
How much reputational risk can it accumulate?

If we cannot answer those questions, we have not governed autonomy.

Continue reading →

Rational Security in the AI Era: How Attackers Are Evolving and How We Must Respond

Posted on by
Reply

The weaponization of artificial intelligence by cybercriminals and nation-state actors has crossed a critical inflection point. We no longer live in a world where we can rely solely on traditional perimeters; the threat landscape has fundamentally shifted into what we might call “Extremistan,” where the speed and scale of attacks demand a completely new level of resilience.

SadKitty

At MicroSolved, our mission is to provide rational cybersecurity for an irrational world. To do that effectively, we must look unflinchingly at the data.

The Problem and the Metrics

The numbers tell a stark story of industrialization at machine speed. According to recent threat reports, AI-enabled adversaries increased their attack volume by 89% year-over-year. More concerning is the velocity: the average eCrime breakout time has collapsed to just 29 minutes, with the fastest recorded intrusion moving from initial access to lateral movement in a staggering 27 seconds.

The financial impact is equally severe. The FBI IC3 recorded over 22,000 AI-related complaints with adjusted losses exceeding $893 million in 2025 alone, including tens of millions lost to AI-enabled Business Email Compromise (BEC). AI is accelerating attack speeds by 4x, making human-speed incident response no longer viable.

Continue reading →

AI Agents Are Already Working for You. Who’s Managing Them?

Posted on by
Reply

AI Agents Are Not Applications. They Are Digital Workers.

Most organizations are adopting AI agents faster than they are learning how to govern them.

That is the problem.

A chatbot that answers questions is one thing. An AI agent that can access business data, use tools, trigger workflows, generate artifacts, make recommendations, or alter enterprise state is something else entirely.

At that point, the organization is no longer just deploying software.

It is introducing a new kind of operational actor.

That actor needs identity.

It needs boundaries.

It needs oversight.

It needs evidence.

It needs a human owner.

It needs a kill switch.

In other words, AI agents must be managed more like digital workers than ordinary applications.

AIAgentBanner

Continue reading →

Why My AI Agents Needed CaneCorso as a Security Control Plane

Posted on by
Reply

AI agents are powerful because they can read, reason, summarize, decide, and act across a wide range of information sources.

That is also what makes them dangerous.

The more useful an agent becomes, the more likely it is to consume data I do not fully trust. Emails. Newsletters. RSS feeds. API responses. Documents sent as attachments. Social media. YouTube transcripts. Scraped search results. Web pages. Translated content. Random bits of text pulled from places where I do not control the author, the formatting, the intent, or the payload.

That is a very different security model than the one most of us are used to.

In traditional applications, we spend a lot of time separating code from data, users from administrators, trusted networks from untrusted networks, and internal systems from the internet. With LLMs and agents, all of those boundaries start to blur. Instructions, context, content, and intent all arrive in the same stream. The model has to reason over that stream, and the agent has to decide what to do with the result.

That is exactly why I wanted a security control plane in front of my own AI agents.

For me, that control plane became CaneCorso™.

CaneCorsoAI

Continue reading →

CaneCorso™ and the Real Problems AI Is Creating for the Business

Posted on by
Reply

AI didn’t sneak into the enterprise.

It walked in through productivity.

Email triage. Document handling. Support workflows. Internal copilots. Retrieval systems. Early agentic use cases. All of it made sense at the time. All of it still does.

But something changed along the way.

We didn’t just adopt AI—we embedded it into workflows that can influence decisions, expose data, and take action.

That’s where the problem starts.

And it’s exactly where CaneCorso™ is designed to operate.

CaneCorsoAI

AI Risk Isn’t a Model Problem — It’s a Workflow Problem

There’s a persistent misunderstanding in the market right now.

Most conversations about AI security still center on the model—what it knows, how it behaves, whether it can be tricked.

That’s not where the real risk lives.

The real risk shows up when:

  • Untrusted content enters a workflow
  • That workflow uses AI to interpret or transform it
  • And the output influences business operations

That content might come from:

  • Email
  • Documents
  • OCR pipelines
  • Retrieved knowledge (RAG)
  • Support tickets
  • External data sources

Once it’s in the workflow, it’s no longer just data.

It’s influence.

CaneCorso™ exists to control that influence—before it becomes an operational problem.

Continue reading →

Introducing CaneCorso: An AI Application Firewall Built for Real Workflows

Posted on by
Reply

AI has officially crossed the line from experiment to infrastructure.

Email flows into copilots. Documents feed RAG pipelines. Support tickets trigger agents that can take action. The convenience is real—and so is the risk.

What hasn’t caught up is security.

Most security models were built for a world where inputs were predictable and trust boundaries were well-defined. That world doesn’t exist anymore. Today, untrusted content flows directly into systems that can reason, decide, and act.

That’s exactly where things get interesting—and dangerous.

When Good Data Carries Bad Instructions

One of the biggest misconceptions about AI security is that it’s a model problem. It’s not. It’s a workflow problem.

Attackers don’t need to break in anymore. They ride along with legitimate data—emails, PDFs, tickets, knowledge base entries—and inject instructions that your AI system may interpret as truth.

Think about what that means in practice:

  • A support ticket that contains hidden instructions
  • A PDF with embedded prompt injection
  • A knowledge base entry that poisons RAG outputs
  • An approval workflow manipulated through summarization

Layer in human behavior—blind trust, over-privileged access, weak validation—and you’ve got a system primed to fail in ways that traditional controls simply won’t catch.

CaneCorsoAI

A More Rational Approach to AI Security

CaneCorso™ takes a different path.

Instead of trying to block everything suspicious (and breaking workflows in the process), it follows what’s described in the Rational AI Security model —security that behaves more like an immune system than a wall.

That means:

  • Detecting and isolating threats without stopping the system
  • Treating all inbound content as untrusted by default
  • Preserving business continuity while reducing risk
  • Producing measurable, auditable outcomes

This isn’t theoretical. It’s a direct response to how AI systems actually behave in production.

One Control Plane for AI Workflows

At its core, CaneCorso gives you a shared AI Application Firewall—a single control plane that sits between your workflows and your models.

Instead of every team building its own brittle filters, you get consistent, reusable protection across:

  • Email triage and analysis
  • RAG pipelines and knowledge systems
  • Document AI and OCR ingestion
  • Support and ticketing workflows
  • Agent-driven automation

The platform delivers:

  • Runtime decisions: allow, sanitize, tokenize, or block
  • Privacy controls: redact or tokenize sensitive data before model exposure
  • Audit-ready logs: reasons, scores, and evidence you can actually use
  • Adversarial validation: Injection Scanner proves controls before and after deployment

This isn’t just about stopping attacks—it’s about making security operationally usable.

Continue reading →

Update on PromptDefense Suite and AI Security Research

Posted on by
Reply

Last week, I discussed why and some of how we built the new PromptDefense Suite. 

This week, we are discussing the product’s future internally and how we might go to market. This is mainly due to two new capabilities we have built into the product. 

The first is an API and workflow automation mechanism. This allows organizations to stand up a single instance of PromptDefense and then use it to protect multiple AI/agent workflows. The code no longer has to be embedded directly in the project; instead, all defensive capabilities and logging can be accessed via an API instance. The API is robust and supports API key restrictions that tie into a rules engine, so that different workflows can have different trust models and actions pre-assigned in an audit-friendly way. 

Secondly, we have developed a licensing mechanism that covers protected workflows and skips the per-seat, per-token models that seemed too confusing for most firms looking for these kinds of tools. They told us they wanted a simpler licensing approach, and we developed a new licensing mechanism to make it easy, manageable, and auditable. Our testers have been calling it a win! 

As we continue with the beta-testing process and lock down our decisions about where the product is going, the news that drove us to create it continues to flow in. More of our clients are working on agents and AI-integrated workflows, which require this level of protection. While we continue to develop PromptDefender, we are also working to develop and release extended frameworks for AI model, agent, and product management, along with policies, procedures, and vendor risk assessment tools for these frameworks, for our vCISO clients. We’re also busy researching ongoing compliance implementation for AI workflows and agents, and should have more on that shortly. 

In the meantime, if you want to discuss AI or agent security, risk management, or other relevant topics, please reach out. We would love to talk with you and help align our modernization capabilities with your emerging needs. You can always email us at info@microsolved.com or call us at +1-614-351-1237. 

As always, thanks for reading. Stay safe out there, and stay tuned for more updates. 

Building MSI PromptDefense Suite: How a Safety Tool Became a Security Platform

Posted on by
Reply

The Impetus: Wanting Something We Could Actually Run

Like many security folks watching the rise of LLM-driven workflows, I kept hearing the same conversations about prompt injection. They were thoughtful discussions. Smart people. Solid theory.

But the theory wasn’t what I wanted.

What I wanted was something we could actually run.

The moment that really pushed me forward came when I started testing real prompt-injection payloads against simple LLM workflows that pull content from the internet. Suddenly, the problem didn’t feel abstract anymore. A malicious instruction buried in retrieved text could quietly override system instructions, leak data, or coerce tools.

At that point, the goal became clear: build a practical defensive layer that could sit between untrusted content and an LLM — and make sure the application didn’t fall apart when something suspicious showed up.

AISecImage

What I Set Out to Build

The initial concept was simple: create a defensive scanner that could inspect incoming text before it ever reached a model. That idea eventually became PromptShield.

PromptShield focuses on defensive controls:

  • Scanning untrusted text and structured data

  • Detecting prompt injection patterns

  • Applying context-aware policies based on source trust

  • Routing suspicious content safely without crashing workflows

But I quickly realized something important:

Security teams don’t just need blocking.

They need proof.

That realization led to the second tool in the suite: InjectionProbe — an offensive assessment library and CLI designed to test scripts and APIs with standardized prompt-injection payloads and produce structured reports.

The goal became a full lifecycle toolkit:

  • PromptShield – Prevent prompt injection and sanitize risky inputs

  • InjectionProbe – Prove whether attacks still succeed

In other words: one suite that both blocks attacks and verifies what still slips through.

The Build Journey

Like many engineering projects, the first version was far from elegant. It started with basic pattern matching and policy routing.

From there, the system evolved quickly:

  • Structured payload scanning

  • JSON logging and telemetry

  • Regression testing harnesses

  • Red-team simulation frameworks

Over time the detection logic expanded to handle a wide range of adversarial techniques including:

  • Direct prompt override attempts

  • Data exfiltration instructions

  • Tool abuse and role hijacking

  • Base64 and encoded payloads

  • Leetspeak and Unicode confusables

  • Typoglycemia attacks

  • Indirect retrieval injection

  • Transcript and role spoofing

  • Many-shot role chain manipulation

  • Multimodal instruction cues

  • Bidi control character tricks

Each time a bypass appeared, it became part of a versioned adversarial corpus used for regression testing.

That was a turning point: attacks became test cases, and the system started behaving more like a traditional secure software project with CI gates and measurable thresholds.

The Fun Part

The most satisfying moments were watching the “misses” shrink after each defensive iteration.

There’s something deeply rewarding about seeing a payload that slipped through last week suddenly fail detection tests because you tightened a rule or added a new heuristic.

Another surprisingly enjoyable part was the naming process.

What started as a set of ad-hoc scripts slowly evolved into something that looked like a real platform. Eventually the pieces came together under a single identity: the MSI PromptDefense Suite.

That naming step might seem cosmetic, but it matters. Branding and workflow clarity are often what turn a security experiment into something teams actually adopt.

Lessons Learned

A few practical lessons emerged during the process:

  • Defense and offense must evolve together. Building detection without testing is guesswork.

  • Fail-safe behavior matters. Detection should never crash the application path.

  • Attack corpora should be versioned like code. This prevents security regressions.

  • Context-aware policy is a major win. Not all sources deserve the same trust level.

  • Clear reporting drives adoption. Security tools need outputs stakeholders can understand.

One practical takeaway: prompt injection testing should look more like unit testing than traditional penetration testing. It should be continuous, automated, and measurable.

Where Things Landed

The final result is a fully operational toolkit:

  • PromptShield defensive scanning library

  • InjectionProbe offensive testing framework

  • CI-style regression gates

  • JSON and Markdown assessment reporting

The suite produces artifacts such as:

  • injectionprobe_results.json

  • injectionprobe_findings_todo.md

  • assessment_report.json

  • assessment_report.md

These outputs give both developers and security teams a consistent way to evaluate the safety posture of AI-integrated systems.

What Comes Next

There’s still plenty of room to expand the platform:

  • Semantic classifiers layered on top of pattern detection

  • Adapters for queues, webhooks, and agent frameworks

  • Automated baseline policy profiles

  • Expanded adversarial benchmark corpora

The AI ecosystem is evolving quickly, and defensive tooling needs to evolve just as fast.

The good news is that the engineering model works: treat attacks like test cases, keep the corpus versioned, and measure improvements continuously.

More Information and Help

If your organization is integrating LLMs with internet content, APIs, or automated workflows, prompt injection risk needs to be part of your threat model.

At MicroSolved, we work with organizations to:

  • Assess AI-enabled systems for prompt injection risks

  • Build practical defensive guardrails around LLM workflows

  • Perform offensive testing against AI integrations and agent systems

  • Implement monitoring and policy enforcement for production environments

If you’d like to explore how tools like the MSI PromptDefense Suite could be applied in your environment — or if you want experienced consultants to help evaluate the security of your AI deployments — contact the MicroSolved team to start the conversation.

Practical AI security starts with testing, measurement, and iterative defense.

 

 

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.