Article
November 12, 2026
AI Security Isn’t One Problem. It’s Five.
Just Announced: Kallarity by Opkalla!
Every technology conversation right now starts with the same two letters: AI. And the follow-up question, almost without fail, is how to secure it.
The trouble is that “AI security” means very different things depending on who you ask. To one vendor, it’s stopping employees from pasting client data into ChatGPT. To another, it’s locking down which files Microsoft Copilot can surface. To a third, it’s using AI agents to clear the alert backlog in your security operations center. Each is a real problem. None of them, on its own, is AI security.
Why AI Security Is Its Own Landscape Now
Agentic AI, the Model Context Protocol (MCP), and shadow AI usage have created an attack surface that pre-AI security tools were never built to see. Employees adopt GenAI tools whether or not IT has approved them. AI agents carry credentials, call external tools, and touch downstream systems with no human at the keyboard. And enterprise AI search will happily surface any file a user technically has access to, whether they should see it or not.
At the same time, the vendor market is moving fast. Point solutions are being acquired into larger platforms almost monthly, and every provider is relabeling its portfolio around AI. For IT leaders, the result is noise.
The way through is to stop treating AI security as one category and start treating it as five distinct control points. Each solves a different problem, fits a different situation, and points to a different set of providers.
Start with Three Questions, not a Product
Before deciding which control point matters most, it helps to step back and answer three questions about your organization:
- How does your organization view AI? Fear, opportunity, or both? The answer shapes who needs to be in the room, from security and IT to legal, compliance, and business leaders.
- How does your organization use AI today? This surfaces sanctioned tools, shadow usage, and agentic workflows that may already be running, whether IT knows about them or not.
- What risk has this opened the business up to? This turns a broad topic into a specific problem you can point at a control point and, eventually, a provider.
The answers usually make it clear which of the five lenses below deserves attention first.
The Five Lenses of AI Security
Four of these lenses are about securing how your organization uses AI. The fifth flips the script: it’s about AI helping to secure your organization. Keeping that distinction clear is the first step to a productive conversation.
1. Usage Governance: Guardrails for How People and Agents Use AI
Employees, and increasingly their AI agents and copilots, use GenAI whether or not it’s sanctioned. Sensitive data can leave through a chat box or an agent’s tool call with no one watching. Usage governance gives you visibility into, and control over, what people and agents share and do with GenAI tools.
This is the control point closest to the moment of exposure. It catches the leak as it happens, before data reaches a model, an agent, or the open internet.
Signs this is your starting point: Someone has already pasted client data into ChatGPT. You have no visibility into which AI tools are in use. Your GenAI acceptable-use policy exists on paper only.
Providers in the space: SentinelOne (via Prompt Security), CrowdStrike, Nudge Security, Drata, Upguard, Liminal AI, and Expedient. Some focus on blocking and detecting while others focus on safely enabling sanctioned AI with guardrails. Knowing which outcome you want points to a different provider.
The question to ask: If someone pasted client data into ChatGPT right now, would you find out?
2. Data: AI Security Starts with Data Security
An AI system can only expose what it can reach. Without proper guardrails, GenAI and LLM searches surface anything a person already has access to, sensitive or not. That’s why the most common real-world trigger for an AI security conversation is the over-permissive access of systems and users.
This isn’t a brand-new category. It’s data security posture management (DSPM) with an AI-specific lens. Fixing access and classification upstream reduces the risk of data leakage before data ever enters the prompt. When security is built into the data source itself, it becomes much harder for a model or agent to disclose information improperly.
Signs this is your starting point: Poor data hygiene with no classification currently in place. An AI rollout strategy that lacks a solve for data in motion and data in use. A Copilot rollout without applying AI guardrails. Handling of sensitive/regulated data.
Providers in the space: Cyera, Concentric AI, Sentra, Cyberhaven, Varonis, and Microsoft Purview, MIND.
The question to ask: What happens when Copilot or AI search indexes everything you have today?
3. Identity: Agents Don’t Log In, They Act
Traditional identity and access management assumes a person logging in. AI agents don’t work that way. An agent can carry a credential issued upstream, call an MCP server, and reach a downstream system with no human involved. Identity for AI moves the control point from a human login to machine runtime, and it’s the only lens that governs what an agent is allowed to do, not just what a person can see.
Identity answers three questions: who is this, what can it do, and should this proceed right now?
Signs this is your starting point: You are standing up agentic workflows or MCP servers. You can’t say what your agents touch. Your environment is full of service accounts and API keys nobody owns.
Providers in the space: Cloud and IAM incumbents are extending natively (Microsoft Entra Agent ID, Okta), PAM vendors are expanding or acquiring their way in (Delinea, BeyondTrust), Wiz brings a cloud entitlements angle, and Clutch Security offers a purpose-built platform for non-human identities.
The question to ask: Who owns the service accounts and API keys your agents run on? Most organizations don’t have that inventory, and that is usually the place to start.
4. AI Runtime Protection: Inspect Every AI Interaction
Every GenAI session and agentic tool call, sanctioned or not, passes through a proxy, gateway, or SASE stack most enterprises already own. Most have no policy written for AI traffic yet. Runtime protection inspects prompts, responses, and agent tool calls in real time and enforces policy as it happens.
The appeal is that it extends infrastructure you already own and manage, so coverage can start on day one with no new endpoint software and no new console.
Signs this is your starting point: You can’t see what AI traffic hits your network. A SASE or SSE renewal is coming up. There is no gateway policy for ChatGPT, Claude, or Gemini.
Providers in the space: Netskope, Zscaler, Palo Alto Networks, Cato Networks, Cloudflare, and Check Point. One gap to watch: most of these platforms do not yet police agent-to-tool calls as thoroughly as chat sessions.
The question to ask: Do you know everything that is flowing through your AI tools and agents right now?
5. AI-SOC: AI Defending You, Not AI You Defend
This lens is different from the other four. Alert volume keeps climbing while SOC headcount doesn’t, and analysts spend most of their time gathering evidence instead of deciding what to do. AI-SOC tools use AI to work alerts so your team does not have to.
The metric that matters most here is time-to-remediate, not just time-to-detect. Vendors in this space compete in four distinct ways:
- Investigation-focused AI SOC (Dropzone AI, Intezer, 7AI, Artemis): agents work an alert end to end and hand an analyst a finished case file with evidence and a verdict. A strong fit when you want to keep a human in the approval loop.
- Hyperautomation (Torq, Tines, BlinkOps): agents don’t stop at a recommendation. They carry out the response, such as containing a host or disabling an account.
- Managed AI-SOC (eSentire, Agile Blue): a fully outsourced SOC, run by a provider using agentic AI under the hood. Built for organizations with no internal SOC to augment.
- Platform-native copilots (CrowdStrike Charlotte AI, SentinelOne Purple AI, Microsoft Security Copilot): AI built into a platform you already run. Easy to adopt, but only as good as that one platform’s visibility.
Whichever path you take, ask whether you can audit the agent’s reasoning or are being asked to trust a black box. Bold autonomy claims are everywhere. The AI SOC you can trust is the one that lets you verify every call it makes.
The question to ask: Do you need faster answers, faster action, or to hand the whole thing off?
The Lines Are Already Blurring
Two realities hold at once. First, the lenses overlap. Netskope and Zscaler, for example, now sell runtime protection and a version of usage governance as one bundled platform, an AI guard module added to the SSE stack they already sell.
Second, the market is consolidating quickly. Point solutions are being absorbed into platforms in real time:
Expect this map to look different in six months. Logos will change hands. Your problem will not. Choose for the problem and lean on an advisor who tracks the market every day. The providers named throughout this post are illustrative, not endorsements or a full market scan.
A Quick AI Security Glossary
- Shadow AI: employees using AI tools without IT’s knowledge or approval; the AI-era version of shadow IT.
- Agentic AI: AI that takes multi-step actions on its own, calling tools and completing tasks with little human approval per step.
- MCP (Model Context Protocol): an open standard that lets AI models plug into external tools and data. Think of it as the USB-C port for AI agents.
- Non-human identity: a credential, service account, or API key not tied to a person, increasingly issued to AI agents and rarely inventoried.
- AI-SPM / DSPM: AI or data security posture management; finding, classifying, and locking down sensitive data before AI can reach it.
- Guardrails: policy and technical controls that constrain what an AI model or agent can say, access, or do.
- Prompt injection: an attack that hides malicious instructions inside content an AI reads, such as a document, email, or webpage.
- Hallucination: a model stating something false with full confidence; a quality problem that becomes a security problem once agents act on it.
- Human-in-the-loop: a required human approval before an AI agent’s action takes effect.
Where to Go from Here
Most organizations are already making AI decisions, whether or not security has a seat at the table. The smartest first move isn't choosing a category. Start with naming the problem in front of you: shadow AI fear, an agent rollout, SOC capacity, or a compliance deadline. The answer picks the lens, and the lens narrows the field of providers.
Because this landscape is complex and changes fast, it also pays to keep an architect in the loop from the start, shaping the questions rather than just scoring a shortlist at the end.
Opkalla’s vendor-neutral advisors and cybersecurity architects can help you map your AI risk across all five lenses and find the right fit for your environment. Talk to an Opkalla Advisor to get started.
Frequently Asked Questions
What is AI security?
AI security is the set of controls that protect how your organization uses AI, plus the growing use of AI to protect your organization. Rather than one category, it spans five distinct control points: usage governance, data, identity, AI runtime protection, and AI-SOC.
Is AI security different from traditional cybersecurity?
It builds on familiar disciplines such as data security, identity, and network inspection, but it adds an attack surface those tools were never built to see. Shadow AI usage, agents that act with their own credentials, MCP connections to external tools, and AI search that surfaces overshared files all call for AI-specific policy and visibility.
Where should my organization start with AI security?
Start with the problem, not a product. Ask how your organization views AI, how it uses AI today, and what risk that use has opened up. The answers usually point to one lens first, whether that’s shadow AI, a Copilot rollout, an agentic workflow, or SOC capacity.
How do I secure Microsoft Copilot before rolling it out?
Start with the data lens. Copilot can surface anything a user already has access to, so fixing permissions and classification upstream is the most effective safeguard. Data security posture management (DSPM) tools help find and lock down overshared sensitive files before Copilot indexes them.
How do AI agents change identity and access management?
Traditional IAM assumes a person logging in. AI agents carry credentials, call tools, and reach downstream systems with no human involved, so identity controls have to govern what an agent is allowed to do at runtime. A practical first step is inventorying the service accounts and API keys your agents run on.
What is an AI-SOC?
An AI-SOC uses AI to investigate and respond to security alerts so analysts don’t have to gather evidence by hand. They vary in solve between Tier 1 and Tier 2 while bringing an element of speed to the incident response lifecycle. Options range from investigation-focused tools that hand an analyst a finished case file, to hyperautomation that carries out the response, to fully managed services and copilots built into platforms you already own.
Do I need a separate tool for each of the five lenses?
Not necessarily. The lenses overlap, and many platforms now bundle more than one, such as SSE vendors that combine runtime protection with usage governance. Because the market is consolidating quickly, choose for the problem you need to solve rather than the logo, and expect the provider landscape to keep shifting.
