A Look Inside Lasso's AI Security Platform

Security is fundamentally about knowing what a system is supposed to do, then catching it when it does something else. For software with deterministic execution paths, that is a tractable problem. For AI agents, it is not.

An agent does not follow a fixed code path. It reasons toward a goal, selects tools based on that reasoning, and adapts its next action based on what those tools return. The same input can produce a different sequence of actions depending on context, session history, and what an external tool happened to return. Behavior is the attack surface, and behavior changes.

Traditional proxies and AI firewalls were built to inspect content: what a user sent, what a model returned. Intent security asks a different question: is this agent doing what it was built to do, in this context, for this user, right now? Answering that requires building a behavioral baseline for every agent and measuring deviation from it continuously.

That is the problem Lasso was built to solve. In this article, we will go over Lasso's AI Security Platform, from discovery and AI risk management to red teaming and runtime enforcement, and how each stage feeds the next.

The Philosophy: A Closed Defensive and Offensive Loop

Before walking through the capabilities, it is worth understanding the structural argument Lasso makes.

Most organizations that take AI security seriously today have assembled a collection of point solutions: a scanner for posture, a red teaming tool for pre-launch testing, some runtime logging. Each of these operates in isolation. Posture findings do not inform what gets tested. Test findings do not automatically update runtime policies. The result is that risk accumulates in the handoffs.

Lasso's architecture closes those handoffs. Discovery feeds directly into posture analysis. Posture findings shape what red teaming targets. Red team findings automatically generate guardrail updates for runtime enforcement. The loop is continuous, and each stage makes the next one more precise. The intelligence layer that runs across all of it is intent, constantly learning and improving the baseline of what the agent should and shouldn't do.

Discovery and Inventory

AI agent discovery is the most common gap security teams report, and it is getting harder as organizations move from subscribing to AI tools to building their own agents.

Using a third-party AI tool means accepting someone else's security model. Building an agent means owning the model selection, the system prompt, the tool access, the guardrails, and the behavior at runtime. Security teams need to know what their organization is building, not just what it is subscribing to.

The agents being built today are not all coming from engineering teams writing code. A compliance team might use Microsoft Copilot Studio to build an internal agent that queries HR data and summarizes policy documents. An engineering team might use AWS Bedrock to build a customer-facing support agent with access to a production database. Each has a different model, a different tool surface, a different permission set, and a different risk profile. None of them live in the same place, and no single cloud platform provides cross-environment visibility.

Lasso solves this across three distinct sources:

Low-code and no-code agent builders. The fastest-growing source of new agents in most organizations is business teams building directly in managed platforms without writing code. Lasso connects natively to AWS Bedrock, Microsoft Azure AI Foundry, Microsoft Copilot Studio, Google Vertex AI, Salesforce Agentforce, Anthropic Managed Agents, and more, surfacing every agent built in these environments into a single security inventory.

Cloud environments. Many organizations assemble agents directly inside their cloud infrastructure, in AWS, Google Cloud, or Azure, without using a managed AI service. Lasso connects to every cloud environment to discover agents and applications that would otherwise have no path into a security inventory.

CI/CD pipelines and code repositories. Lasso scans repositories and CI/CD pipelines to discover homegrown agents at the point they are being built, before they reach production, and catalogs them alongside everything found in cloud and no-code environments.

The output is an AI Bill of Materials (AIBOM): a complete, continuously updated record of every agent and AI application in the organization, each profiled across its model, system prompt, tools, guardrails, policies, and configurations. It is the foundation every subsequent stage of the platform builds on.

AI Security Posture Management (AI-SPM)

Once the inventory exists, Lasso builds a security graph of every application and maps its connected agents, LLMs, databases, and APIs. This visual representation makes attack paths visible: you can see how a threat actor could move through the system before they do.

Lasso's AI Security Posture Management (AI-SPM) runs static analysis of each application's configurations and correlates findings against NIST, OWASP, and MITRE frameworks. Misconfigurations are surfaced with framework coverage gaps, so security and development teams have both the technical finding and the compliance context in one place.

This matters because the most common AI security failures are not sophisticated attacks. They are misconfigured system prompts, overly permissioned tool access, and guardrails that were never tested against anything adversarial. AI-SPM finds these before an attacker does.

Automated AI Red Teaming

Testing an agentic application is a fundamentally different problem than testing a traditional API or web app. AI applications are non-deterministic. They retain memory across turns, chain tool calls in ways that create emergent behavior, and respond differently to the same input depending on context. A static payload sweep misses nearly all of this.

Lasso's Automated AI Red Teaming is built from the ground up for this attack surface. Before any attack fires, Lasso performs reconnaissance: reverse engineering the application across its model, system prompt, tools, guardrails, and behavioral scope. Posture findings from AI-SPM feed directly into red team targeting, so testing goes after the actual risk surface of each application, not a generic attack checklist.

Three attack modes operate independently or in combination:

Static attacks draw from a library of 300,000+ continuously updated payloads with 100% OWASP LLM and Agentic Top 10 coverage and 500+ new variants added weekly, covering jailbreak patterns, content moderation bypasses, and obfuscation techniques.

Dynamic attacks use multi-turn probing to test where an application's intent becomes fragile under sustained adversarial pressure. Single-turn testing misses the majority of exploitable conditions in agentic applications.

High-agency attacks deploy autonomous adversaries with specialized roles that run bespoke, multi-turn attack sequences tailored to each application's specific design. These adversaries adapt across turns, exploit context windows and agent memory, and chain tool calls to probe the full agentic attack surface.

Every finding maps directly to a remediation action: the exact misconfiguration, the guardrail update recommended, and a re-test to confirm the fix. Red team findings automatically generate guardrail updates that feed into runtime enforcement without a manual handoff.

Because red teaming runs natively in CI/CD and triggers on every deployment, security teams get this feedback loop at engineering speed. Risky builds can be blocked before they reach production with configurable pass/fail gates, without requiring a separate assessment cycle or a manual handoff between security and engineering.

Runtime Protection with Inline Guardrails

Lasso enforces inline guardrails at the proxy, API, or AI Gateway layer with real-time blocking in under 50ms, without requiring code changes, source code access, or agents deployed into the application environment.

The depth of what gets enforced is where this capability separates from basic guardrail tools. Lasso runs thousands of classifiers across every interaction, covering the full OWASP LLM and Agentic Top 10, sensitive data exposure and data leakage prevention, prompt injection and jailbreak attempts, and the full range of AI-specific attacks that do not map to traditional security signatures.

For cases requiring semantic understanding, LLM-as-a-judge evaluation runs inline, assessing whether a response is appropriate given the application's intended scope, not just whether it matches a known bad pattern.

Policies can be deployed out-of-the-box or built as custom rules tailored to each application's specific use case. Both map directly to OWASP, NIST, and MITRE controls so every enforcement decision has a framework reference attached.

Continuous Purple Teaming to Auto-Update Guardrails

The closed loop between offense and defense is what makes the platform self-reinforcing. Red team findings can automatically generate guardrail updates, closing the loop between what was found in testing and what gets enforced in production without a manual handoff between teams. Security teams can review and approve updates, with the platform moving toward increasingly autonomous policy refinement over time.

This continuous purple teaming model means the platform does not require a human to connect the dots between a discovered vulnerability and a runtime fix. The system handles that connection automatically.

Intent Security: Govern What Agents Do, Not Just What They Say

Content filtering and permission models are necessary but insufficient in an agentic environment. The same agent, with the same permissions, operating in the same session, can represent completely normal behavior or a compromised execution chain depending on context. Content inspection alone cannot tell the difference.

At the core of Lasso's platform is the Intent Security Engine, the intelligence layer that runs across every stage. Rather than evaluating isolated prompts or individual outputs, it builds a behavioral baseline for every agent and application based on full interaction history, then continuously measures deviation from that baseline.

Two signals drive detection:

In-chain intent misalignment evaluates whether the user request, system prompt, agent reasoning, and tool action all align within a single execution flow. If any step deviates from the others, even without crossing a permission boundary, the intent integrity is compromised. When misalignment is detected, the response is tiered (alert, block, or mask) depending on confidence and risk level, and blocking happens in under 50ms.

Behavioral intent anomaly identifies when an action deviates from historical patterns or workflow norms, even when the internal chain looks consistent. An agent that normally calls one tool and suddenly chains five has shifted behaviorally in a way that warrants investigation regardless of whether each individual action was permitted. This is the category of risk that content inspection cannot reach, and it is where the baseline earns its value. The engine completes session analysis in under 5 seconds and runs at 570x the speed of legacy approaches, which means it governs behavior as it happens rather than reconstructing what occurred after the fact.

The result is 98.6% detection accuracy at a false positive rate of 1.4%, which is precise enough to enforce in production without generating the alert noise that causes security teams to tune controls down.

Compliance and Reporting

Security findings are only as useful as the decisions they enable. Lasso connects every finding, from AI-SPM misconfigurations to red team vulnerabilities to runtime detections, to OWASP LLM Top 10, NIST, and MITRE ATLAS controls. This means a security team reviewing a red team report and a compliance team preparing for an audit are working from the same mapped evidence, not reconciling results across separate tools.

Audit-ready dashboards give security leaders a complete picture across the lifecycle: what was discovered, what posture gaps exist, what was tested and how, what was found, what was fixed, and what the residual risk looks like. Exports are structured for board reporting and regulatory submissions.

For organizations in regulated industries, including financial services, healthcare, and government, Lasso can be deployed on-premises or in a VPC, giving teams full control over sensitive data, prompts, and proprietary models. The platform does not require source code access or agents deployed into the application environment, which matters for organizations with strict data residency requirements.

The compliance story Lasso enables is not just "we ran tests." It is a documented chain of evidence from discovery through remediation, mapped to recognized frameworks, with every decision traceable.

A Platform Built for Where AI Security Is Going

Organizations deploying AI applications at scale today are not waiting for security tooling to catch up. The ones doing it responsibly have already concluded that observability alone is not sufficient, that pre-deployment testing needs to run continuously rather than on a schedule, and that runtime protection needs to govern agent behavior, not just log it.

Lasso's AI Security Platform is built to cover that full scope, from the first line of a system prompt through every interaction in production, as a continuous closed loop.

To learn more about Lasso's AI Security Platform, contact us today.

About the author: Ophir is a seasoned product and security leader, who led AI and strategy efforts for startups and enterprises. Ophir was the co-founder of a startup aiming to manage and visualize human interactions with generative AI products. In 2023, recognizing the need for GenAI adoption, he co-founded Lasso to address emerging challenges. Lasso offers a full GenAI Cyber Security suite to enable organizations to safely embrace the GenAI technology.