If you can’t figure out what needs to be protected. You are dead in the water.
It sounds simple. A lot of people in the industry will even tell you it’s a solved problem. Names, numbers, IDs, a basic rules engine, a classifier here or there, and a pretty dashboard. That worked perfectly fine in a world where data just sat still. It even worked when we were carefully curating batches to train models or dumping data into a test sandbox.
However, in the world of AI it’s an entirely different challenge and one that is notoriously hard. This isn’t an encryption or tokenization problem, nor is it one that’s easily solved with a gateway and some filters. In AI, it’s all about context.
Unfortunately, that word context has been bandied about so much that it’s become common to associate it with large language models and how many tokens they can keep in their head. But that’s not the case in the real world. Real meaning gets lost in the math of a model. It does not get lost in a deal room, a courtroom, or a regulatory exam. Real business is about returns, and real risk is a liability with someone getting held accountable. So context in the real world is who may see what, under which circumstance, for which purpose, and what happens if a sentence that looks innocent enough becomes the missing piece you didn’t want the wrong people to figure out.
Legacy Security
The security space is full of good legacy IP, solid technology and knowledge that impresses even to this day. I’ve been in this space for decades, I love it, and I don’t want to minimize what’s been done. Because firewalls, isolation, identity, authorization, data loss prevention remain relevant as we move forward. That infrastructure investment is important, but it’s not near enough to tackle the challenges of securing AI.
We need to have a very honest, uncomfortable conversation about the current state of enterprise AI security. And it’s not pretty given that every single vendor in the market is scrambling to bolt “AI security” onto their platforms. The industry is yet again drowning in market-washing. Governance. Safety. And even throwing out terms such as MCP as if that will convince buyers they can lock down their AI connected systems.
The opposite of lock down is what’s being recognized and even the proliferation of MCP gateways has created a new wave of exploitable risks.
Our customers use all of these tools. Our own team evaluates them constantly and we even apply some of this tooling internally. We know how they perform in real world scenarios and the warning signals are frankly terrifying. Traditional methods and approaches to solving the AI security problem are not up to the job. And on top of it, your single biggest vulnerability is already behind the firewall.
Like AI, agents are proliferating. But instead of humans chatting with passive text responses, these agents are now code that acts. They are code that loops. And they are code armed with a powerful cheat sheet to give the model an easy way to stretch its legs … that’s sarcasm masked in prose.
What this is to the world of security is a massive Remote Code Execution risk. Inside your firewall with access to your data, systems and instructions to act.
Do not act surprised when the media advertises that an AI escaped, went rogue, or broke down a firewall. Not even the frontier model vendors have the discipline or structure to get AI security right.
The Hard Thing About Hard Things
I better get to the point before going too far. Given the complexity in AI, agents, data and instructions, you now have a perfect storm of:
Communications from agents to models and agents to agents containing both data and instructions.
Multi-threaded communications from agents to models and agents to agents where state needs to be understood and tracked across communication threads.
Multi-threaded and independent communications from agents and models to your internal systems and data … where yet again, state and business context must be established and understood
I hope this is becoming clear, because it’s a complex spider web of sh*t you have to worry about. And this is exactly where context matters. If these agents are participating in a contract review, are they acting on behalf of the broker or the underwriter? The buyer or the seller? That matters … deeply. What data needs to be redacted? What part of this communication thread connects to a completely separate thread to suddenly expose sensitive information? What instructions are accompanying the data so we know the risks, and when to pull the plug? And how the heck do you apply real-world regulatory policies across all this?
Back on the original thesis … if you can’t figure out what to protect, you are dead in the water. Full stop.
This is the hard thing. When you actually put these systems through the paces in a real-world, high-stakes environment, where data, instructions and multiple parties are involved they fail. They completely miss highly confidential statements that need to be redacted, and unfortunately it becomes a hit-or-miss operation. This is why organizations end up in demoware and pilot purgatory.
Here’s the easy thing. A frontier model vendor crafting an agent to test whether it can score a win by breaking out of a sandbox. That’s trivial in comparison. F*k, that’s trivial.
The Paradigm Shift Required
You cannot secure a probabilistic system by stacking yet another probabilistic system.
We continue to watch as vendor after vendor leans on ML classifiers or regex to guess which data should be protected before it reaches an LLM or an agent. They may even apply an LLM-before-LLM design approach. The thought is that you can point a model at some text, apply a rule, and voila it’s protected. You may have guessed from earlier that this text is no longer about simple names, numbers and IDs. And that this is not security, it’s just stacking guess upon guess.
If you dig past the rosy abstracts of recent academic research and look at the actual enterprise-oriented tests, the reality sets in. Take the recent SafeGPT paper (Desai et al., 2026). Some of the headline results look great on paper, but when they ran their synthetic EnterpriseScenarios test, SafeGPT’s recall fell to just 68.2%. Precision was a genuinely ugly 40.5%, accompanied by a 78.6% false-positive rate. That is nowhere near good enough to serve as a production security boundary.
The implications of this approach can be disastrous to the bottom line, but they also weaken the architecture and keep AI out of mainstream enterprise production systems.
Given that data protection is an absolute requirement and that business context, not model context, matters, how do you become expert at identifying data and understanding what it means?
Context Distillation and Command & Control
For AI security to be world class, you need, at minimum, to be an expert at the following AI Command & Control principles:
Context Distillation: Pinpoint, resolve, and lock down business meaning outside of the primary LLM models and agents. Business context must be deterministic, not a statistical guess. Trying to solve this with regex and lightweight ML classifiers is like bringing a water pistol to a five-alarm fire. It completely misses the transactional reality.
State Management: Track identity, authorization, context, and intent across the entire web of interactions. When agents start looping, multi-threading, and passing messages to each other, state gets messy fast. You need an independent layer mapping these communication threads to catch reasoning drift and cascade failures before a bad agent step snowballs.
Flow Control: Hard runtime policy enforcement across every single hop. This isn’t passive logging or pretty dashboards; it is active, inline surveillance governing what an agent can touch, read, or execute in real time. If an agent tries to touch a database, pull a RAG vector, or execute an instruction it shouldn’t, the control plane shuts it down mid-stride. And knows how and why to do that because it has context and state.
Your ability to determine and understand context and state needs to be far better than any LLM. In fact LLMs are terrible at understanding the business meaning in the context of transactions and workflows. They, put simply, are good at semantic token state that is devoid of transactional meaning and causal impacts. Likewise you need to ensure that control is enforced at the Flow level and that means understanding the state of communications between agents, models, systems and data.
Not everything in the enterprise world goes through a magical MCP. In fact, MCP at its core is little more than a dressed-up RPC layer. By its most rudimentary definition, it simply attempts to standardize how models and agents interact with tools and resources, and it’s pretty weak as a security boundary … hence the frantic pace to fill the gaps and stop the leaking. MCP might be an enforcement point, but it’s ill-equipped to decide what should actually be enforced.
For anyone that is old-school, you might remember the early days of Microsoft and SOAP, and you will remember how that exploded into a vast and complex ecosystem. That might give you insight into what’ll happen with AI, agents and MCP. But now, you’ll also have to deal with the probabilistic trap, the semantic entanglements, and the remote code execution risks.
This AI security challenge has given rise to what the industry is referring to as the Control Plane. Not a new term but the implications and sophistication of the Control Plane are immense when it comes to AI and agents. It’s not the yesteryear of traditional firewalls, enterprise service bus, and a few gateways here or there. The Control Plane that keeps AI in check and delivers on the AI control sought by every enterprise organization is one that gets the AI Command & Control Principles right.
On top of all this, you will need a sophisticated human-on-the-loop design and not a dashboard … but that’s a topic for later.