What is AI agent security?
GUIDE · 3 MIN READ
AI agent security is the set of controls that let an organization see which AI agents are running, decide what each one may do, stop actions that break policy, and keep a record of who did what.
UNIVERSITY · SEPTEMBER 2026
AI security university: lessons and glossary
The verdict
A reference shelf for teams new to AI agent security: a glossary of 46 terms and twelve lessons and guides in three tracks. Start with Basics (what agents do and where controls sit), move to Buying (how to read claims and scores), then Running it (EDR, managed settings and the activity record).
Basics: what agents do and where controls sit
Start here if you are new to AI agents and MCP.
How an MCP tool call works
LESSON · 3 MIN READ
How an agent finds and calls an MCP tool, and where a control can step in.
Where AI agent security controls sit
LESSON · 2 MIN READ
The four places a control can sit, and what each one sees.
Indirect prompt injection and why agent controls sit at the action layer
LESSON · 3 MIN READ
How hidden instructions in content become agent actions, and where a control can stop them.
MCP security: how to control what MCP servers let AI agents do
GUIDE · 3 MIN READ
MCP security means knowing which MCP servers your agents connect to, limiting what each one can do, and checking tool calls before they run.
What is shadow AI, and how do you find it?
GUIDE · 2 MIN READ
Shadow AI is any AI tool, agent, extension or MCP server that employees use without the organization's approval or visibility.
Buying: reading claims, scores and vendor answers
For teams building a shortlist.
How to read AI security vendor claims
LESSON · 2 MIN READ
What vendor-stated and Not published mean, and how to test a claim.
How to read an endpoint AI control score
LESSON · 2 MIN READ
What the seven criteria measure, how weights and ties work, and how to re-weight them.
AI agent security buyer's checklist: 30 questions to ask vendors
GUIDE · 3 MIN READ
Ask every vendor to show, on your own devices, the four checkpoints: what it sees, how it decides before an action runs, what it can do besides block, and what it logs.
Running it: controls in daily operation
For teams rolling out and operating agent controls.
AI agent security and EDR: how they work together
GUIDE · 2 MIN READ
EDR and AI agent security do different jobs, and most organizations will run both.
Managed settings and hooks: controlling coding agents from the inside
LESSON · 3 MIN READ
Controlling coding agents from the inside with managed settings, hooks and MCP allow lists.
How to build an AI agent activity record your SOC can use
LESSON · 3 MIN READ
What to log for every agent action, and how to separate agent actions from human ones.
What is in the glossary?
46 terms used across this site, from agent hooks to token passthrough. Where a term comes from a standard, such as the MCP specification or the OWASP GenAI Security Project, the entry links to it.
Open the glossary
46 TERMS
Want the whole picture first? Read the rankings, the FAQ, or our notes.