AI Security Fabric: Introduction and Overview

Short Summary

Organizations often ask which product secures AI agents, but that framing is incomplete because agents hold identities, receive access, call tools, delegate work, behave differently across runs, and can be manipulated through the same channels that carry instructions. No single product category covers the full risk, and the market fragments across identity and access management, guardrails, observability, threat detection/response, generative AI defense, and risk/audit/compliance—often with different buyers and no clear end-to-end owner. The core issue is therefore architecture and ownership, not procurement.

The KuppingerCole AI Security Fabric reframes the problem around required capabilities: ensuring AI does what the organization intends, clarifying who delivers the needed controls, and selecting tools last. It applies the “fabric” principle (capabilities → services → tools) and organizes capabilities into five groups—AIdentity, AI Governance, AI Safety, AI Protection, and AI Transparency—delivered via six services and implemented by seven tool categories. The fabric must span all areas because gaps arise between domains: identity without runtime control leaves behavior unchecked; monitoring without enforcement observes incidents it cannot stop; model-layer defenses ignore what credentialed agents do in business systems.

A key rationale is that agents act (tool/API calls, code execution at machine speed), delegate (authority chains can amplify permissions), and vary (non-deterministic action sequences), while their reasoning channel enables content-based manipulation that substitutes persuasion for credential theft. The fabric emphasizes discovery of governed and “shadow” agents, enforcement at resource/tool-call points even for unregistered agents (default deny/low trust), and making the governed path easiest to prevent bypass. It supports practical adoption via “core first, extend by risk,” grounded in risk/autonomy classification, and it is designed for assessments, gap analysis, requirements, roadmaps, tool selection, and operating-model clarity.

Interesting Facts

• The AI Security Fabric organizes capabilities into five groups: AIdentity, AI Governance, AI Safety, AI Protection, and AI Transparency.
• The reference architecture contains 68 capabilities distributed as 14 (AIdentity), 14 (AI Governance), 13 (AI Safety), 14 (AI Protection), and 13 (AI Transparency).
• Capability layering in the reference architecture assigns 28 capabilities to core, 25 to extended, 8 to integration, and 7 to privileged layers.
• The agentic AI security market is split into six categories with three different buyer groups: CISO, CIO/identity team, and risk/legal/compliance leaders.
• The fabric delivers capabilities through six services and implements them via seven tool categories.
• The seven tool categories are AIAM, APGE, AVOP, ATDR, GAD, ARC, and AORC.
• The fabric’s integration frame includes an AI Security API Layer covering registry and policy APIs, token exchange, shared signal protocols, OpenTelemetry, and MCP and A2A interfaces.
• The fabric separates “resources” from “actions” and “data,” and many controls attach to the action at the resource rather than to the agent.
• The checklist assessment recommends answering each question with yes/partly/no using evidence rather than intention.
• The fabric’s adoption approach is summarized as “classify, cover the core, extend by risk.”

Notable Quotes

• “Securing AI is not a product problem. It is a capability problem, and the capabilities must be defined before tools are selected.”
• “AI security is therefore an architecture and ownership problem before it is a procurement problem.”
• “The reasoning of the agent is part of the attack surface.”
• “This substitutes persuasion for credential theft, and it cannot be countered by identity controls alone.”
• “The gaps are not at the edges of the areas but between them.”
• “Monitoring alone only documents a problem, and this group makes the difference between observing an incident and ending it.”
• “The fabric is not a reference poster. It is a working tool…”
• “A policy document is not evidence of enforcement, and a pilot is not evidence of coverage.”
• “Organizations that begin with the tool selection typically define their capabilities by what the tool delivers.”
• “A complete fabric does not mean a complete rollout.”