AI agent security
AI agents read untrusted content, call tools and act with real credentials, so they need security controls that chatbots never did. The frameworks that describe the risk are public: the OWASP Top 10 for Agentic Applications 2026, the OWASP Top 10 for LLM Applications 2025 and the security guidance in the Model Context Protocol specification.
What we do
- Agent threat modelling against the OWASP agentic and LLM risk lists
- Prompt-injection and jailbreak testing with PyRIT, garak and promptfoo
- One identity per agent with least-privilege scopes
- MCP server review: token audience, consent, SSRF and sandboxing
- Scanning of MCP servers and agent skills before connection
- Audit trails for agent and Copilot activity
- Agent inventory, ownership and retirement process
- Findings written up with fixes and a re-test
Our team works with these frameworks and with the tooling around them. On the Microsoft side that means Entra Agent ID for agent identities, Microsoft Purview audit for Copilot and AI application activity, and Microsoft Agent 365 for observing, governing and securing agents. For adversarial testing we use open-source red-team tools such as PyRIT, garak and promptfoo, and we scan MCP servers and agent skills with Snyk Agent Scan, Cisco mcp-scanner and the Cloud Security Alliance's mcpserver-audit.
This work sits beside our Cybersecurity and Cyber Automation services and our Clayton Secure offer. We give every agent its own identity, least-privilege scopes and an audit trail, test prompt-injection and tool-misuse paths before launch, and review MCP servers before they are connected. These are tools and frameworks our team has experience with, not partnerships, and scope is discussed during scoping.
Leading platforms we work with
- OWASP Top 10 for Agentic Applications 2026
- OWASP Top 10 for LLM Applications 2025
- Model Context Protocol security (spec 2026-07-28)
- Microsoft Entra Agent ID
- Microsoft Purview audit for Copilot
- Microsoft Agent 365
- PyRIT
- garak
- promptfoo
- Snyk Agent Scan
- Cisco mcp-scanner
- CSA mcpserver-audit
Platforms and practices
- Prompt injection testing
- Agent identity and least-privilege scopes
- MCP server review and sandboxing
- Token audience validation
- Agent audit trails
- Agent registry and lifecycle
- Tool-misuse and excessive-agency testing
- Agent skill scanning
References
- OWASP GenAI Security Project: Top 10 for Agentic Applications for 2026
- OWASP GenAI Security Project: LLM Top 10 (2025 edition)
- Model Context Protocol: security best practices (spec 2026-07-28)
- Microsoft Learn: What are agent identities (Entra Agent ID)
- Microsoft Learn: Audit logs for Copilot and AI applications (Purview)
- Microsoft Learn: Microsoft Agent 365 overview
- GitHub: microsoft/PyRIT
- GitHub: NVIDIA/garak
- GitHub: promptfoo/promptfoo
- GitHub: snyk/agent-scan
- GitHub: cisco-ai-defense/mcp-scanner
- GitHub: ModelContextProtocol-Security/mcpserver-audit
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use AI agent security for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCyber Automation
Custom AI agents that do repetitive work around the clock, with human review where it matters.
Learn moreClayton Secure
One view of your entire cybersecurity program, in near real time.
Learn moreSuper Intelligence
American‑made Super Intelligence: AI your team can learn, trust and deploy.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhy do AI agents need different security from chatbots?
Agents read untrusted content, call tools and act with real credentials, so a manipulated agent can take actions, not just produce text. That adds risks such as prompt injection, tool misuse and excessive agency. Public frameworks describe them, including the OWASP Top 10 for Agentic Applications 2026 and the OWASP Top 10 for LLM Applications 2025.
How does your team test agents before launch?
We threat-model the agent against the OWASP agentic and LLM risk lists, then, under a written scope and rules of engagement, test prompt-injection, jailbreak and tool-misuse paths using open-source red-team tools such as PyRIT, garak and promptfoo. Findings are written up with fixes and a re-test. These are tools we have experience with, not partnerships.
What does one identity per agent mean?
Each agent gets its own identity, not a shared or borrowed human account, with least-privilege scopes limited to the systems and actions its job needs. That makes its activity separable in logs and its access easy to remove. On Microsoft platforms this can use Entra Agent ID.
Do you review MCP servers?
Yes. We review Model Context Protocol servers before they are connected, covering token audience validation, consent, server-side request forgery and sandboxing, following the MCP specification's security guidance. We also scan servers and agent skills with tools such as Snyk Agent Scan, Cisco mcp-scanner and the Cloud Security Alliance's mcpserver-audit.
Can you show what our agents have done?
We set up audit trails for agent and Copilot activity and tell you in writing what your platforms log and what they do not. Some records hold activity metadata but not full prompt text. Visibility depends on your licenses and any logging layer placed in the path.
Do you guarantee an agent cannot be manipulated?
No. No test or rule set stops every unsafe action. We reduce risk with least privilege, human approval points, testing and logging, and we document the limits. Scope is discussed during scoping, and the free security assessment is a good first step.