Agent security, in depth.
Research, guides, and commentary on AI agent security from the Wing team.
12 Security Best Practices for LLM Tool Integration
Abstract LLM tool integration security is the practice of controlling how tool-enabled LLMs use identities, permissions, and external systems to take action. Tool access shifts risk from model output to execution, making identity, authorization, and tool capability central security boundaries. Effective controls combine least privilege, secure credentials, trust-boundary isolation, input validation, human approval, and end-to-end […]
The Agentic Shift Already Happened. Where’s Security?
The agentic shift isn’t coming. It’s already here. AI agents are moving out of the developer sandbox and into the rest of the enterprise. Tools that were initially built for software engineers are being redesigned for finance, operations, communications, sales, and virtually any other function where people spend their days moving information between applications and […]
What is AI Agent Observability? An Infosec Guide
Abstract: AI agent observability gives security teams a contextual view of agents as business actors, linking each agent to ownership, identities, effective access, observed actions, initiators, purpose, and risk. Logs and traces show execution, but governance depends on knowing whether an action was authorized, appropriate, and aligned with the agent’s approved role. Effective programs combine […]
Wing Security becomes WithWings
After tackling SSPM and building a unique identity-centric platform, we’ve landed in the agent era. We’ve gone through an evolution into AISPM [AI Security Posture Management] and we’ve decided to rebrand all the way down to our name to match our new offering. An agent-powered security platform WithWings takes a fundamentally different approach to securing […]
6 Least Privilege Examples in an AI World
Abstract Least privilege for AI agents is a control model that confines each agent’s identity paths, data reach, tools, and actions to its defined purpose, then verifies that production behavior stays inside those boundaries. Effective control must account for both the agent’s permissions and the requesting user’s context, especially where shared or high-privilege agents create […]
GitLost isn’t a bug but it is your problem
When researchers disclosed GitLost, a critical prompt injection vulnerability within GitHub’s new Agentic Workflows on July 7, the headlines made it sound like a bug. But the real story is about agent permissions, access and authorization. GitLost exposed a much broader security problem that extends far beyond GitHub: AI agents are operating with legitimate access […]
Agentic AI Governance: The InfoSec Guide
Abstract: Agentic AI governance gives InfoSec teams a way to discover which agents exist, who owns them, what identities and permissions they rely on, what actions they take, and whether their behavior still matches their intended purpose. This guide explains how security teams can: Discover which AI agents exist across the environment Identify who owns […]
AI Agent Security: An Essential Guide
Abstract: AI agent security is the practice of discovering, governing, and controlling AI agents that can access systems, use tools, trigger workflows, interact with SaaS apps, and act through user-delegated sessions, service accounts, OAuth grants, API keys, or other non-human identities. This guide covers: How AI agent security works Why agents create new identity and […]
10 AI Agent Security Best Practices to Implement Today
Chances are, your organization has AI agents running right now with access levels that your security team didn’t approve. In fact, even the agent’s user didn’t approve them. Today, 79% of senior executives report AI adoption, yet 92% are concerned about the security implications. Gartner expects 40% of enterprise applications will embed task-specific agents (up […]
15 Top Tools for Monitoring Non-Human Identity Activity
Tools for monitoring non-human identity activity help security teams discover, inventory, govern, and investigate the activity of machine identities, service accounts, OAuth apps, API keys, workload identities, integrations, and AI agents. Top Monitoring Non-Human Identity Activity Tools Include: Wing Security Cyberhaven MCPTotal / Autonomous Security Operant AI Endpoint Protector Akeyless GitGuardian Entro Security Astrix Security […]
Why Every Enterprise Needs an AI Agent Inventory
Artificial intelligence is no longer limited to chatbots and productivity assistants. Across organizations, employees are building, deploying, and sharing AI agents that can access business data, make decisions, trigger workflows, and act on behalf of users. What started as experimentation has quickly evolved into a new operational layer inside the enterprise. Today, employees can create […]
How an AI Agent Wiped 5 Years of Data in 9 Seconds and Why You Should Care
AI agents are quickly becoming part of the modern development stack. They write code, fix bugs, run commands, and increasingly interact with production environments. For many teams, they are already embedded in daily workflows. But what happens when those agents make the wrong decision? A recent incident involving PocketOS, a SaaS platform serving rental businesses, […]