The number of companies adopting generative AI is growing rapidly. According to ITWorld's 2026 IT Outlook Report, more than 85% of companies are expected to use generative AI in 2026, and 74% said their AI-related budgets are increasing. AI is already becoming a basic condition for competition rather than an option. However, fast adoption does not mean safe operation. Trust in generative AI is still low. Lack of trust in incorrect information and results (61.3%) and the risk of security and personal information leaks (53.3%) are the main concerns cited by Korean companies. Gartner offers a more direct warning. It projects that by 2026, more than 80% of unauthorized AI transactions will stem not from malicious attacks but from internal policy violations, such as oversharing of information, inappropriate use, and misguided AI behavior. (Source: Gartner Market Guide for AI TRiSM, 2025) Threats come from inside before they come from outside.The next step in AI adoption is clear: operating AI in a trustworthy way, in other words, AI governance. Based on proven frameworks, this article explains why AI governance is needed, how it should be structured, and what actually needs to be controlled.☑️The Reality of AI Adoption: The Gap Between Rosy Forecasts and Conditions on the GroundMany companies feel pressure to adopt AI. According to TechSurvey's 2025 IT Outlook Report, a majority of respondents (63.1%) said they feel pressure regarding generative AI, and this pressure tends to intensify as an organization's AI maturity increases.Looking at the distribution of AI adoption maturity among Korean companies makes the reality clearer. Based on ITWorld's 2026 IT Outlook Report, maturity is distributed as follows.· Stage 1 (pilot use of external tools in some departments): 19%· Stage 2 (efficiency gains in individual tasks such as text summarization and content generation): 43%· Stage 3 (integration with internal data, building an internal AI portal): 17%· Stage 4 (developing a dedicated LLM or internal AI assistant): 16%· Stage 5 (integrating AI into core business and decision-making): 3%· Stage 6 (collaboration between AI agents and multiple business systems): 2%Most companies are concentrated in Stages 1 and 2. They have started using AI but have not yet moved to the stage of operating it safely across the entire organization. And as they move into Stage 3 and beyond, they commonly hit the same wall: AI governance.CIO.com puts it this way: "When a POC moves from the sandbox to production, the risk rises sharply." Things that seemed fine in an experimental environment appear as entirely different risks in real production. Governance is not something to put in place after AI adoption is complete; it must be designed alongside adoption from the very beginning.☑️The Structure of AI Governance: The AI TRiSM 4-Layer FrameworkHow should AI governance be approached systematically? Gartner answers this with a framework called AI TRiSM (AI Trust, Risk, Security Management). According to the Gartner AI TRiSM Market Guide 2025, "organizations that operationalize AI TRiSM will achieve a 50% improvement in AI model adoption, achievement of business goals, and user acceptance."AI TRiSM structures AI governance into four layers. Each layer does not operate independently but functions as part of an interconnected, integrated system.Layer 1. AI Governance This is the policy and management process layer that ensures AI complies with corporate policies, ethical guidelines, and regulatory requirements. Its core elements are building an AI asset inventory, documenting use cases, risk assessment and approval procedures, audit traceability, and compliance with legal policies and regulations. It serves as the "control tower" that transparently manages all AI activity within the organization.Layer 2. Runtime Inspection & Enforcement This is the security layer that monitors interactions between AI and users and blocks threats at execution time. The Gartner 2025 report places particular emphasis on the importance of this layer, because without real-time monitoring and automated guardrails, policies have little effect in production environments. Key areas of management include prompt injection, jailbreak attempts, exposure of PII and sensitive information, hallucination detection, and agent monitoring.Layer 3. Information Governance This layer is responsible for identifying, classifying, protecting, and controlling access to the data used by AI. It includes vector DBs, RAG (retrieval-augmented generation), data lineage management, DLP (data loss prevention) integration, and data localization. The key is ensuring the safety of the data that AI learns from or references.Layer 4. Infrastructure & Stack Security This layer addresses the security of the infrastructure on which AI workloads run and of the entire AI stack. It covers API security, workload protection, confidential computing, MLOps pipeline security, and support for multi- and hybrid cloud environments. No matter how well governance is established in the upper layers, it is useless if the infrastructure is vulnerable. Notably, Gartner projects that by 2028, 25% of large organizations will have dedicated AI governance teams. This is a dramatic change from less than 1% in 2023. (Source: Gartner Market Guide for AI TRiSM, 2025) AI governance is already becoming a core organizational capability at leading companies.☑️In the Agentic AI Era, the Nature of Threats Fundamentally ChangesIf AI TRiSM provides the structure for governance, OWASP shows the reality of actual threats. In December 2025, the OWASP GenAI Security Project officially released the "OWASP Top 10 for Agentic Applications 2026," completed through more than a year of research and review by over 100 security experts. This list matters not simply because it enumerates new security threats. It matters because, as AI evolves beyond a simple response tool into agentic AI that plans and executes tasks on its own, the nature of threats itself has changed. The question is no longer "What if the LLM gives a wrong answer?" but "What if the agent takes the wrong action?"The top 10 security threats for agentic AI identified by OWASP are as follows.ASI01 Agent Goal Hijack: Attacks that hijack an agent's goals and decision paths through malicious contentASI02 Tool Misuse & Exploitation: Malicious use of the tools an agent usesASI03 ID & Privilege Abuse: Abuse of identity and privilegesASI04 Agentic Supply Chain Vulnerability: Vulnerabilities in the agent supply chain, such as malicious dependencies and compromised build pipelinesASI05 Unexpected Code Execution: An agent executing unintended codeASI06 Memory & Context Poisoning: Attacks that poison the data sources and memory an agent uses for decision-makingASI07 Insecure Inter-Agent Communication: Insecure communication between agentsASI08 Cascading Failures: Cascading failures in which the failure of one agent spreads in a chainASI09 Human-Agent Trust Exploitation: Exploiting the trust relationship between humans and agentsASI10 Rogue Agent: An agent that deviates from its intended behavior and escapes controlIn the Korean enterprise environment in particular, AI threats in network-separated environments are also an important consideration. Network separation provides security at the physical perimeter, but it cannot prevent integrity breakdowns caused by AI acting as an autonomous insider. The Financial Security Institute's AI Red Team calls this "the paradox of network separation." Because AI agents can generate large volumes of transactions in parallel and enable automated, large-scale propagation, existing network separation security frameworks alone have limits in responding.Ultimately, what AI TRiSM and OWASP both emphasize converges on one thing: Observability, Tracing, Explainability, and Evaluation. If you cannot see what AI is doing, you can neither trust it nor control it.☑️What Should Be Controlled in AI Services?To actually execute AI governance, it must be clear what to control and how. There are six major areas that organizations must manage to operate AI in a trustworthy way.1. AI Assets "Is the inventory of AI assets within the organization being managed?" The starting point of governance is understanding the current state. If an organization does not know which AI models and services are being used internally, control itself is impossible. Detecting and managing Shadow AI adopted indiscriminately without IT department oversight is particularly important. Given Gartner's projection that more than 80% of unauthorized AI transactions will stem from internal policy violations by 2026, gaining visibility into AI assets is essential, not optional.2. Access Control / Authentication / Authorization "Who is using AI, and are their privileges controlled?" Users and roles that can access AI systems must be clearly defined, and access must be controlled according to the principle of least privilege. In particular, in environments where AI agents call external systems and APIs on behalf of people, identity authentication and privilege management for agents are essential. This is also why OWASP ASI03 (ID & Privilege Abuse) was identified as a key threat for agentic AI.3. Data Security "Is sensitive data leakage blocked, and is data protected from malicious attacks?" AI services process vast amounts of data. Personal or confidential information can be leaked when accessing internal documents through RAG pipelines or passing user inputs to LLMs. DLP (data loss prevention) and guardrail configuration are the key control measures, and organizations must also prepare for attacks that poison the data sources themselves, such as OWASP ASI06 (Memory & Context Poisoning).4. Service Flow"Is the AI processing flow observed and traced?" The entire process from when an AI service receives a user's query to when it generates a response must be traceable. Only by tracing which prompt was entered, which documents were referenced through RAG, and how the LLM generated its response can the cause be identified and improvements made when problems occur. AI governance begins with Observability and Tracing.5. Performance / Quality"Are the results of AI services accurate and trustworthy?" An AI model is not finished once it is deployed. Over time, performance can degrade (drift), or accuracy on certain types of questions can decline. A framework is needed to continuously evaluate and improve metrics such as summarization accuracy, Q&A accuracy, RAG relevance, and hallucination rates. The principle that "you cannot improve what you cannot measure" applies equally to AI operations.6. Resources / Cost"Is resource usage monitored, and is it operated with optimized costs?" LLM API call costs and GPU compute costs rise sharply as AI services scale. This is also why an IDC survey found that "unpredictable pricing is the biggest obstacle to implementing generative AI in the enterprise." Token usage, latency, cost analysis, and automatic scaling management determine the sustainability of AI operations.☑️AI Governance Solutions from CloudNetworksRealizing the six control areas above requires solutions specialized for each area. CloudNetworks designs and implements AI governance frameworks together with organizations, based on proven partner solutions in the areas of AI observability and evaluation, authentication and authorization, and threat detection and blocking.Arize AI — The Core Platform for Observability, Tracing, Explainability, and Evaluation Arize AI is an AI engineering platform that realizes, in agentic AI environments, the four keywords commonly emphasized by major frameworks including AI TRiSM and OWASP: Observability, Tracing, Explainability, and Evaluation. Through tracing, it collects and visualizes AI app execution at the span level to identify bottlenecks, errors, and prompt issues, and it continuously measures the quality and performance of AI apps through automated evaluation using LLMs (LLM as a Judge). It provides a variety of evaluation criteria, including summarization accuracy, Q&A accuracy, RAG relevance, hallucination, and toxicity, and these can also be customized.Auth0 — Secure Authentication and Authorization for AI Apps Authentication and authorization are essential elements of AI app development. Auth0 is a Customer Identity Platform that enables AI to accurately identify users, ensures data access that takes user permissions into account, and securely handles even API calls and asynchronous tasks. In environments where AI agents interact with external systems on behalf of people, it precisely controls who accesses what and with which privileges.Cisco AI Defense — AI Asset Discovery, Threat Detection, and Runtime Protection​ Cisco AI Defense automatically identifies AI assets across cloud, SaaS, and on-premises environments, detects vulnerabilities in AI models and apps, and evaluates prompts and responses to block malicious prompts and protect sensitive information. With detection technology based on Cisco's AI models and training data, it responds in real time to threats arising in AI runtime environments.☑️Why AI Governance Should Start NowAI governance is not something to put in place after AI adoption is complete. There is no need to have every framework in place right away. A realistic approach is to start with controls suited to your current stage of AI adoption maturity and expand them step by step. Gartner projects that by 2028, 25% of large organizations will have dedicated AI governance teams. Today, the figure is less than 1%. Leading companies are already moving.As an official partner of Arize AI, Auth0, and Cisco AI Defense, CloudNetworks helps organizations operate AI in a trustworthy way. For inquiries ranging from product adoption to building an AI governance framework, please contact CloudNetworks. 

In the era of agentic AI, data is the foundation of digital resilience. Meet Splunk, the platform that lets you search, analyze, and act on that data anywhere, at any scale.🔸From Data Chaos to AI-Powered ClarityThe machine data that security and IT operations teams deal with every day is still scattered and siloed across multiple systems, costs too much time and money to analyze, and is not refined into a form that AI can use right away. According to a joint study by Splunk and Oxford Economics (The New Rules of Data Management, 2025), 91% of 1,475 IT and security professionals worldwide said their data management costs had increased compared to the previous year, and 62% said data management challenges had led to actual compliance failures.The Splunk platform addresses exactly this point. It forms the foundation of Cisco Data Fabric and turns raw machine data into structured insights. By providing unified visibility, intelligent data management, and AI-driven efficiency, it connects fragmented data and enables operational excellence across the digital environment.🔸Splunk's Core Capabilities1. Complete Control of the Data LifecycleThe Splunk platform is designed to manage the entire data lifecycle on a single platform, from the moment data is generated to the point it is analyzed and used. The data types the platform handles are Metrics, Events, Logs, and Traces. It does not stop at collecting and onboarding this raw operational telemetry data but handles the entire flow through to converting it into structured, AI-powered intelligence. Data cost optimization also takes place in the process.2. Federated Search and AnalyticsTraditional data analysis required moving data to one place for analysis. This meant additional transfer costs and complexity. Splunk's Federated Search fundamentally solves this problem. Wherever the data resides, such as Amazon S3 or Amazon Security Lake, it can be searched and analyzed in place without moving it. Organizations can gain real-time insights across distributed data sources while simplifying data storage management.3. AI-Native IntelligenceAI is deeply embedded throughout the Splunk platform. Rather than a structure in which AI is layered on top of specific features, it is an "AI-native" design in which AI operates at every stage, from data collection to analysis and investigation. A representative capability is the AI Assistant for SPL. When users enter requests in natural language, the AI automatically generates or explains queries in SPL (Search Processing Language), Splunk's powerful search language. This means even non-experts can query and analyze data directly. Complex queries and advanced analytics are also accessible through generative AI-based natural language search, allowing all users to tap into the platform's potential regardless of their technical skill level.4. The Foundation for Agentic AI InnovationAs we move beyond simply displaying data into an era in which AI agents make their own decisions and take action based on data, Splunk has introduced two core technologies to support this.The first is the MCP (Model Context Protocol) server. Released for Splunk Cloud Platform, the MCP server is a standardized bridge connecting AI agents to the Splunk data platform. Based on the Model Context Protocol, an open standard led by Anthropic, it allows AI assistants such as Claude and ChatGPT to communicate directly with Splunk in natural language. Users can query complex datasets and run searches without writing a single line of SPL. Because it uses Splunk's existing authentication and access controls as they are, it is also secure.The second is the Machine Data Lake. It is a schemaless data lake that refines and enriches machine data from the pre-indexing stage so that it can be used for AI training and RAG (Retrieval-Augmented Generation) pipelines, and an alpha version was released in February 2026. It serves as the infrastructure for preparing high-quality data that AI agents can actually use.5. Data Visualization and ReportingDashboard Studio turns complex data into clear, actionable insights. It provides customizable dashboards and reporting at a level that not only technical staff but also business decision-makers can use right away.🔸The Two Pillars Supported by the Splunk Platform — Security and ObservabilityThe Splunk platform delivers unified security and full-stack observability on a single data platform.On the security side, Splunk Enterprise Security is an AI-powered SecOps platform that unifies threat detection, investigation, and response (TDIR), providing complete visibility, AI automation, threat intelligence, and high-fidelity alerts. It is designed to respond to threats accurately and quickly, and it was named a Leader in the 2025 Gartner Magic Quadrant for SIEM for the 11th consecutive year. It also ranked first in all three use cases in the 2025 Gartner Critical Capabilities for SIEM.On the observability side, Splunk Observability provides complete visibility and real-time troubleshooting across all environments, stacks, and networks, including AI infrastructure. It enables issues to be detected proactively, prioritized based on business impact, and resolved quickly. It was named a Leader in the 2025 Gartner Magic Quadrant for Observability Platforms.Having both areas run on a single platform means that security and IT operations can be run on a unified data foundation without having to maintain separate data silos.🔸An Integration Ecosystem of More Than 2,000Another strength of the Splunk platform is its vast integration ecosystem. More than 2,000 apps and add-ons are available on Splunkbase. Integrations with existing technology stacks can be set up quickly, and the entire Splunk portfolio can be used to integrate security and observability across the enterprise.For technical support, technical information and collaborative solutions are available through Splunk Community and Splunk Lantern. The Voice of the Customer program and Splunk Ideas, through which product feedback can be submitted directly, are also in operation.🔸Splunk Customer StoriesThe Splunk platform is used in real operations by companies across a variety of industries worldwide. Click Learn More to view each customer story. · Automotive parts company Continental uses the Splunk platform to monitor the performance of all its machines and technologies and, when problems occur, quickly identifies the root cause to resolve outages rapidly. Learn More· FINRA, the Financial Industry Regulatory Authority in the United States, combined Splunk Cloud and AWS to build a cybersecurity framework to protect US investors. FINRA's senior director of cybersecurity said, "When we looked at what other companies were offering, they were trying to catch up to the capabilities Splunk already had." Learn More· Hotel chain Hyatt reduced its mean time to resolve (MTTR) after adopting Splunk and created an environment in which developers can focus on innovation. A team member put it this way: "Since switching to Splunk, we have a single place to go to resolve issues." Learn More· Biopharmaceutical company Regeneron uses Splunk to proactively track and respond to potential issues, reducing the risk of downtime. Learn More🔸A Data Platform for Digital Resilience in the Agentic AI Era - SplunkAgentic AI is rapidly evolving beyond simply answering questions toward making its own decisions and taking action. And the performance of AI ultimately depends on the quality and accessibility of the data behind it. No matter how good an AI model is, it cannot do its job if data is scattered and unrefined.The Splunk platform is a tool for building the data foundation that is a prerequisite for AI innovation. Going beyond collecting, unifying, and analyzing machine data to converting it into intelligence that AI agents can use in real time, digital resilience in the agentic AI era starts here.Drawing on its expertise in data and security, CloudNetworks operates a dedicated team specializing in the implementation and technical support of the Splunk platform. For inquiries about adopting and using Splunk, please contact CloudNetworks, an official partner.▶ Splunk View Products

Building a basic agent is relatively easy. You just use a framework and follow common architectural patterns. However, turning that basic agent into something robust and production-ready is difficult. The true value of an agent comes precisely from this process.Because LLMs are non-deterministic, an agent can arrive at the correct answer even while taking a strange path, and this is what makes debugging difficult. Effective agent evaluation shouldn't just look at the final output—it needs to evaluate what the agent knows, what actions it takes, and how it plans, all together.Evaluation is the key means of turning an agent from a simple demo project into a production tool. Based on the Agent Evaluation chapter of Arize AI's 'AI Agents & Assistants Handbook' series, this article summarizes how to systematically evaluate agents. ☑️ Agent development is cyclical, not linearAll LLM application development involves some degree of cyclical iteration, and agents are no exception. It's impossible to predict in advance every query an agent might receive or every possible output from the model. Only by properly monitoring the production system and feeding the data it generates back into the development process can you build a truly robust system.This iteration cycle typically proceeds as follows. First, create an initial set of representative test cases, break the agent down into individual steps (routers, skills, etc.), and then create evaluators for each step. Next, experiment with different versions of the agent while maximizing evaluation scores. Once the agent is deployed to production, monitoring is used to collect real-world usage data, and this data is used to revise the test cases, evaluation steps, and evaluators. Then experimentation and iteration are performed again.This article examines each component of this cycle one by one. ☑️ Building test casesHaving a standard set of test cases lets you test changes to the agent, prevent unexpected performance regressions, and establish a baseline for evaluation.Test cases don't need to be numerous, but they do need to be comprehensive. For example, if you're building a chatbot agent for a website, the test cases should include every type of query the agent supports: queries that trigger each function or skill, common informational queries, and off-topic queries the agent shouldn't respond to. The test cases should cover every path the agent can take. If a case is simply a rephrasing of another, there's no need to create thousands of them.Test cases evolve over time as new types of input are discovered. Don't be afraid to add to them, even if it makes some evaluation results harder to compare against past runs. ☑️ How to break down the steps to evaluateNext, break the agent down into manageable steps that can be evaluated individually. These steps should be fairly granular, at the level of individual units of work.Every function, skill, and execution branch of the agent should have an evaluation that can benchmark its performance. You can be as granular as you like—for example, evaluating just the retrieval step of a RAG skill separately, or evaluating the response of an internal API call. Beyond skills, it's important to evaluate the router along multiple axes. If you're using a router, this is often where you can achieve the biggest performance gains.The list of "pieces" that need to be evaluated can grow quickly, but that's not necessarily a bad thing. Especially if you're new to agent development, it's recommended to start with many evaluations and reduce them over time. ☑️ Two ways to build evaluatorsOnce the steps are defined, you can create evaluators for each one. Evaluation is generally done in one of two ways.· Comparison with expected output — A deterministic approach suitable when ground truth is available. Accuracy is measured by directly comparing the output with the expected value.· LLM-as-a-Judge — Useful when there's no ground truth, or when the goal is a more qualitative evaluation. A separate LLM is prompted to evaluate the agent's output. Since human feedback or user feedback is often costly and hard to obtain, LLM-as-a-Judge serves as an effective alternative. ☑️ Evaluating skillsEvaluating an agent's skill step is similar to evaluating that skill independently, outside the agent. What you evaluate depends on the type of skill.For RAG skills:· Retrieval Relevance — Are the retrieved documents relevant to the question?· QA Correctness — Does the response provide an accurate answer to the question?· Hallucination — Did it avoid fabricating content not found in the retrieved documents?· Reference/Citation — Does the response accurately cite its sources?For code generation skills:· Code Readability· Code CorrectnessFor API skills:· Code-based integration tests and unit testsCommon to all skills:· Comparison with ground truth data ☑️ Evaluating the routerBeyond skills, the most distinctive part of agent evaluation is router evaluation. The router should be evaluated along two axes.Selecting the correct skillThe first axis is the ability to select the correct skill or function for a given input. This is perhaps the most important yet also the most difficult task. This is the step where the router prompt (if one exists) is put to the test. Low scores at this step are usually caused by a weak router prompt or unclear function descriptions, both of which are tricky to improve. Extracting the correct parametersThe second axis is the ability to extract the correct parameters from the input to populate the function call. This is also tricky, especially when there's overlap between parameters. It's a good idea to add intentional curveballs to your test cases—for example, including inputs that stress-test the agent, such as a user asking about order status while also providing a shipping tracking number. ☑️ Evaluating the pathFinally, evaluate the path the agent takes during execution. Does it repeat steps? Does it fall into a loop? Does it unnecessarily return to the router? These "path errors" can cause the most serious bugs in an agent.To evaluate the path, it's recommended to add a step/iteration counter as an evaluation item. Tracking the number of steps it takes the agent to complete different types of queries can yield useful statistics. However, the best way to debug an agent's path is to manually inspect the traces. Especially early in development, using an observability platform to directly review agent runs provides the most valuable insights for improvement.ConvergenceExtending path evaluation lets you measure convergence. In the context of agents, convergence refers to how often the agent takes the optimal path for a given query. You can measure whether the agent is "converging" on the optimal path for a particular query type.Here's how to calculate a convergence score:1. Run the agent on a set of similar queries2. Record the number of steps taken in each run and the overall minimum number of steps for that query type3. Calculate the convergence score: ∑ (minimum number of steps for that query type / number of steps taken in the run)This score is a value between 0 and 1, showing how often the agent follows the optimal path for that query type, and how far it deviates when it takes a suboptimal path. However, there is a limitation: since the optimal path is calculated based on the agent's shortest run, cases where every run takes a suboptimal path cannot be detected by this method. ☑️ LLM-as-a-Judge agent evaluation templatesArize AI provides pre-tested evaluation templates that have been stress-tested on benchmark datasets and tuned to 70–90% precision and 70–85% F1 scores. The key question each template answers is as follows.· Agent Tool Calling — Did the agent select the correct tool and construct a fully executable call? Suitable for end-to-end validation of tool calls after the router step. Covers both tool selection and parameters in a single judgment.· Agent Tool Selection — Is the tool selected for a given input the correct one? A narrowly scoped check that ignores parameters and checks only tool selection. Suitable for diagnosing router misrouting before worrying about parameter quality.· Agent Parameter Extraction — Did the function call accurately extract the parameters present in the query? Did it avoid fabricating information not present in the JSON schema? This isolates "wrong argument" issues, and combined with tool selection evaluation, lets you distinguish routing errors from parsing errors.· Agent Path Convergence — How close is the agent's number of steps to the optimal path? Outputs a score between 0 and 1. Quantifies path efficiency across multiple runs, suitable as a quick regression check for "wandering" in multi-step agents.· Agent Planning — Can the proposed plan (sequence of tools) accomplish the task? And is it a minimal plan? Judgments are divided into ideal / valid / invalid. Validates the LLM-generated plan before execution, preemptively blocking costly tool calls or retries.· Agent Reflection — Does the agent's own answer hold up under self-inspection? Serves as a final safety net before exposing the response to the user, triggering a correction loop through post-hoc self-critique. ☑️ The cycle of experimentation, iteration, and productionOnce evaluators and test cases are defined, you're ready to modify the agent. After a major modification, run the test cases against the agent, then run each evaluator against the outputs or traces. You can track this process manually, or use an observability platform to track experiments and evaluation results.There's no one-size-fits-all approach to improving an agent, but this evaluation framework gives you far greater visibility into the agent's behavior and performance. It also gives you confidence that your changes haven't unintentionally broken other parts of the application.Once the agent is deployed to production, monitoring collects real-world usage data. New types of input or failure cases discovered in this data are added to the test cases, the evaluation steps and evaluators are revised, and experimentation and iteration are performed again. Since it's impossible to predict in advance every query an agent might receive, this cyclical structure of feeding production data back into the development process is the key to building a robust agent. ☑️ ConclusionAgent evaluation isn't just about checking the accuracy of the final output. It requires systematically evaluating each component—whether the router selects the correct skill, whether each skill accurately performs its intended task, whether the agent follows an efficient path, and whether parameters are extracted correctly.Through this series, we've looked at what AI agents are, how they're structured, what various architectures and frameworks exist, and how to observe and evaluate agents.Cloud Networks, as Arize AI's official partner in Korea, supports the adoption and implementation of Arize AX, an AI agent observability and evaluation platform. If you're interested in quality management for AI agents, please reach out to Cloud Networks.

As AI agents become the new digital workforce in enterprises, "Shadow AI" operating outside the control of IT departments is emerging as a new blind spot in enterprise security. To address this problem, global identity security company Okta announced the Agent Discovery capability within ISPM (Identity Security Posture Management). In this blog post, we look at why Shadow AI is more dangerous than traditional Shadow IT and whether an identity-centric security strategy is the answer. 🔵What Changed from Shadow IT to Shadow AIShadow IT is not a new problem. Employees adopting SaaS tools without IT department approval has been going on for a long time. However, AI agents have three characteristics that are fundamentally different from traditional Shadow IT.First, they operate at a different layer. While traditional Shadow IT was mainly a problem at the level of individual apps, AI agents operate at the application layer and exercise broad, long-lived privileges through multiple non-human identities (NHIs).Second, they are created and spread at a different speed. With the spread of agent builder platforms, every employee can now provision digital workers directly. When an employee grants OAuth permissions to an unvetted tool, data can flow outside the security perimeter at that very moment.Third, the blast radius is different. When an unauthorized agent connects to core systems, the compromise of a single agent can have a cascading impact on multiple apps and data. James Simcox (COO/CPO) of Equals Money points out, "If AI agent products come in connected to multiple services without anyone knowing, that's a real problem."According to Gartner's 2025 survey, 69% of organizations suspect or have evidence that employees are using unauthorized GenAI tools, and Gartner predicts that by 2030, more than 40% of enterprises will experience security or compliance incidents caused by unauthorized Shadow AI. According to data from Okta's "Okta for AI Agents" solution page, 91% of organizations are already using AI agents, but 44% have no governance at all.🔵Visibility, Not Blocking: Why Traditional Approaches Don't WorkThe most intuitive response to Shadow AI is blocking. However, there is a growing consensus in the field that blocking actually makes the problem worse. Amar Akshat (SVP Technology & Chief Architect) of Paysafe points out, "If you block, you're only blocking visibility. The AI landscape is evolving so fast that blocking just makes usage invisible." KPMG's 2025 survey also found that almost half of US workers are using AI tools in unauthorized ways. Employees choose unauthorized tools over official ones for speed and convenience, and simple blocking does not address this root cause. This is also why Simcox of Equals Money said, "We rolled out ChatGPT to employees before they did it themselves." Increasing access to approved tools is the first step in reducing the spread of Shadow AI.However, providing approved tools alone is not enough. Traditional network- and endpoint-based security approaches do not apply to AI agents, because AI agents operate at the application layer rather than the network or device layer. What is needed, therefore, is visibility into where agents exist, who created them, what data they access, and what privileges they hold, in other words, an identity-centric approach.The problem of "permission inheritance" also cannot be addressed without visibility. According to Okta's "AI at Work 2025" report, only 36% of organizations have a centralized governance model for AI, and only 10% have an NHI management strategy. Even if an employee with administrator privileges hands over all of their privileges to an AI tool, there is no way to detect it without visibility.🔵Okta's Solution: Agent Discovery in ISPMOkta's answer to these problems is the Agent Discovery capability within ISPM (Identity Security Posture Management). Announced on February 12, 2026, this capability is a core component of the "Okta for AI Agents" solution, designed to detect Shadow AI and bring it into the governance framework.Agent Discovery addresses three problems.· Detection: Automatically discovers Shadow AI agents operating within the organization· Risk identification: Identifies hidden identity risks and misconfigurations of unknown and known agents· Blast radius mapping: Visualizes how far damage would spread if an agent were compromisedAgent Discovery starts by detecting OAuth consent. Integrated with browsers such as Google Chrome, it captures in real time the moment an employee grants an AI tool (Client App) access to corporate data (Resource App). This makes it possible to map which agents have what level of permissions (scope) to which data sources, and to trigger alerts when an unauthorized agent gains permissions to critical data.What matters is the action taken after detection. Discovered agents are registered as managed identities on the Okta platform, security policies are applied, and a human owner is assigned. The core value of Agent Discovery is that it does not stop at simply finding Shadow AI but converts discovered agents into managed assets subject to governance.🔵A Four-Stage Playbook for AI Agent SecurityThrough its blog, Okta presented a four-stage playbook for gaining control over AI assets. Each stage progressively expands the scope of visibility, ultimately creating a structure in which all agents are managed on a unified identity platform.Stage 1: Identify Agents Within Approved AI PlatformsEven on AI platforms officially approved by the enterprise, such as Microsoft Copilot, Salesforce Agentforce, AWS Bedrock, OpenAI, and Google Vertex AI, security teams often do not know which agents are operating with which privileges. Approval itself does not guarantee visibility. The number of agents is so large that manual oversight is virtually impossible, and it is difficult to detect situations in which agents are granted excessive administrator privileges for ease of configuration or in which access between production and development environments is connected indiscriminately. Okta provides an automated inventory of these "Crown Jewel" environments, identifying each agent's owner, actual privileges, and key risk locations.Stage 2: Detect Unknown Agents on Unapproved PlatformsWhile most organizations focus on a small number of approved tools, the attack surface expands across departments through unapproved platforms, unvetted agent builders, and hidden MCP servers. The key risk driver is OAuth permission grants (User Consent). When an employee grants corporate data access to an agent they built themselves or brought in from outside, that agent obtains an OAuth token that allows it to access data and perform tasks on the user's behalf. Okta's SAM (Secure Access Monitor) browser plugin feeds real-time OAuth signals into ISPM to identify agents on unapproved platforms, excessive permission (scope) exposure, and Shadow SaaS that has bypassed legal and privacy reviews.Stage 3: Harden the Non-Human Identity (NHI) LayerAn AI agent is not a single "bot" but operates on top of multiple non-human identities (NHIs), such as API tokens, access keys, service principals, and OAuth tokens. To truly protect AI agents, organizations must harden not only the agents themselves but also the technical keys that enable them to act. This requires deep visibility into the graph connections among the AI agent, the person who created it, the specific NHIs that power the agent, and the apps the agent can access. Okta provides visibility into various NHI types across SaaS, IdP, cloud infrastructure, and on-prem AD in a single view, and proactively identifies high-risk vulnerabilities such as excessive privileges and unrotated credentials through detection of more than 25 prioritized risks mapped to the OWASP Top 10 for NHIs.Stage 4: Consolidate onto a Unified Identity PlatformThe final stage is to consolidate the AI agents discovered in the previous three stages and their underlying NHIs onto the same identity platform. Because Okta is platform-neutral, it can detect agents regardless of their source, and this consolidation makes it possible to apply consistent security policies across the entire human and non-human workforce. Applying the same policies to AI agents as to human employees is the ultimate goal of identity-based AI security.🔵The Core of AI Security Is Identity SecurityThe most important premise in AI agent security is that AI agents are ultimately "identities." Agents are authenticated, granted privileges, access data, and perform tasks just like people. Therefore, the core of agent security is not building a separate new security framework but integrating agents into the existing identity security fabric.The approach Okta presents through this Agent Discovery announcement can be summarized as follows.·  You can't manage what you can't see: Gaining visibility to detect Shadow AI is the starting point of all security·  From discovery to governance: The transition of registering detected agents as managed identities, assigning human owners, and applying security policies is essential·  Unifying human and non-human: An integrated approach is needed that manages AI agents not as separate entities but as part of the organization's identity framework·  Speed and safety are not a trade-off: Identity-based governance makes it possible to maintain the pace of innovation while ensuring securityIn the current situation, where 80% of organizations have experienced unintended agent behavior and 23% have reported credential exposure through agents, building a framework that treats AI agents as formal identities of the organization and manages their entire lifecycle from creation to retirement is no longer optional but essential.Shadow AI is no longer a problem that can be left unaddressed. Discovering invisible agents, converting discovered agents into managed assets, and consistently managing human and non-human identities within a single framework is the core of the identity-based AI security that Okta presents. For Okta adoption and consultation inquiries, please contact CloudNetworks, an official partner. ▶ Okta Learn More 

As the maximum validity period of public TLS certificates is shortened in phases starting in March 2026, certificate renewal is no longer an "occasional task" but an ongoing operational responsibility. Based on DigiCert's "47-Day TLS Certificates FAQ" document, this article summarizes, in question-and-answer form, the validity reduction roadmap (200 days → 100 days → 47 days), the change in the domain validation reuse period (up to 10 days), and why automation is essential. The Q&A below will help you quickly check what your organization needs to prepare.⏰47-Day TLS Certificates: FAQs Q: What are the new rules for certificate validity periods? The CA/B Forum's new TLS rules include three major changes that begin to take effect in March 2026:1. The maximum validity period of public TLS certificates decreases from 398 days to 47 days.2. The maximum period for which domain and IP address validation information can be reused decreases from 398 days to 10 days.3. The maximum period for which SII (Subject Identity Information, information identifying the entity to which the certificate is issued) can be reused decreases from 825 days to 398 days.Automating some public certificates may require specialized tools or expertise, but in most cases the work is relatively simple. Plenty of documentation is available, and the services are often free (as DigiCert provides). Q: What is the timeline for the changes? The maximum validity period of public TLS certificates will decrease over the next few years as follows:• Until March 15, 2026: Maximum TLS certificate validity of 398 days• From March 15, 2026: Maximum TLS certificate validity of 200 days• From March 15, 2027: Maximum TLS certificate validity of 100 days• From March 15, 2029: Maximum TLS certificate validity of 47 daysThe maximum reuse period for domain and IP address validation information will also decrease as follows:• Until March 15, 2026: Maximum domain validation reuse period of 398 days• From March 15, 2026: Maximum domain validation reuse period of 200 days• From March 15, 2027: Maximum domain validation reuse period of 100 days• From March 15, 2029: Maximum domain validation reuse period of 10 daysQ: What is the difference between the maximum certificate validity period (down to 47 days) and the maximum domain validation reuse period (down to 10 days)? The maximum validity period of a certificate is the maximum number of days the certificate is considered valid. To issue a certificate, a certificate authority (CA) must validate that the applicant controls the domain names or IP addresses included in the certificate. If you renew a certificate once a year, as under the current rules, control is revalidated every year when the renewal is ordered. But what if a certificate needs to be replaced before renewal (for example, if the private key is compromised)? In that case, the CA can reuse the validation performed at the most recent renewal, reducing the need to validate again. This is because the maximum domain validation reuse period has not yet expired.The Baseline Requirements (the CA/B Forum's rules for certificate issuance) have long specified both of these time limits, but the two values have generally been set to the same number of days. The reason the final stage of the new rules changes so that "the maximum certificate validity period is (ultimately) 47 days" but "domain validation can only be reused for up to 10 days" is that validation information is considered to become stale quickly, so validation should be performed more often. This change also makes it clear that the CA/B Forum believes domain validation must be automated. On such a short timeline, manual validation becomes a heavy burden. With automation, the short timeline is not a problem at all.Q: What are the options? There is only one reasonable option: automating Certificate Lifecycle Management (CLM). For years, the CA/B Forum and the industry (including DigiCert) have been advising customers that certificate validity periods would be shortened and that manual certificate management would no longer be a realistic solution.Most use cases for domain validation (DV) certificates can be automated relatively easily using the ACME (Automated Certificate Management Environment) and ARI (ACME Renewal Information) standards. This capability is included in DigiCert CertCentral at no additional cost. For more complex cases, DigiCert's Trust Lifecycle Manager (TLM) provides managed automation support for a variety of enterprise configurations.For some applications, internal PKI (also called private PKI) can be another option. Many publicly trusted certificates are used to protect resources that do not need public access, and according to best practices, such resources should not be accessible from the internet. Administrators sometimes use public certificates for these resources because it is the easiest way, but the correct approach is to use an internal PKI.An internal PKI issues certificates that are "valid" or trusted only within the enterprise, for communication between private resources inside the enterprise. As a result, you can set your own rules for certificate validity periods and many other parameters. You can operate all the software needed for an internal PKI yourself, but this is a complex and error-prone task. DigiCert offers several internal PKI solutions for enterprise, cloud, and manufacturing use cases.The same domain validation timeline also applies to OV and EV certificates. Ultimately, OV/EV certificates must also perform domain validation on the same schedule as DV certificates (that is, every 200/100/10 days). However, the other information included in those certificates (such as organization name and address) only needs to be renewed every 398 days. Domain validation can and should be automated, just as with DV certificates, but the other information cannot be fully automated.Q: From the date the changes take effect, will browsers no longer accept certificates with validity periods exceeding 200/100/47 days? Not exactly. The limits apply to the types of certificates CAs can issue, not the types of certificates browsers can accept. Browsers check "whether the current date falls within the certificate's validity period."Once a rule change takes effect, CAs can no longer issue TLS certificates with validity periods exceeding 200/100/47 days. However, 398-day certificates issued before the rule change remain valid until they expire. The same applies when 200-day certificates change to 100 days and when 100-day certificates change to 47 days. Q: What is the CA/B Forum?The CA/Browser Forum (abbreviated as CA/B Forum or CABF) is an industry standards body made up of certificate authorities such as DigiCert (called certificate issuers in the standards) and applications that use certificates to authenticate resources (usually web browsers, called certificate consumers in the standards). Other stakeholders also participate as members, but voting rights are limited to qualified certificate issuers and consumers.The first TLS Baseline Requirements (BRs) for TLS certificates took effect in 2012. There are also working groups that address standards for public code signing and S/MIME certificates.Q: Do these standards changes also affect internal (private) PKI? No. The Baseline Requirements are binding only on public certificate authorities.An internal PKI operates within a network or cloud. An internal PKI also includes certificate authorities, but the policies enforced by internal certificate authorities, including certificate expiration dates, are set by the user. Choosing short expiration dates may be best practice for internal PKI as well, but it is not required. You can operate all the software for an internal PKI yourself, but this is a complex and error-prone task. DigiCert offers several internal PKI solutions for enterprise, cloud, and manufacturing use cases.Q: If I have to replace certificates more often, will I have to pay more? No. At least not with DigiCert CertCentral. Certificates are paid for as an annual subscription. During the subscription period, you can renew or replace certificates as often as needed at no cost, and ACME/ARI automation is also included in the subscription at no additional cost. Anticipating these changes was one of the reasons we moved to a subscription model.When customers automate certificate renewal, many voluntarily move to faster replacement cycles, because it becomes easy and there is no reason not to. For example, switching to renewing every 30 days right away gives you confidence that you are prepared for the 2029 change.Q: Do the new rules also affect intermediate and root certificates? No. These rules affect only leaf certificates issued by intermediate CAs.The CA/B Forum and other standards bodies have no rules limiting the validity periods of root and intermediate certificates, but generally agreed-upon best practices exist, and software vendors that consume certificates have their own rules for their trusted root programs, which can vary significantly.The Mozilla Root Store Policy (Section 7.4) states that Mozilla will distrust root certificates 15 years after their keys are generated. The validity rules in Chrome Root Program Policy version 1.6 (February 15, 2025) are more complex. There is no explicit upper limit on validity periods, but it states that "root CA certificates whose corresponding key material was generated more than 15 years ago will be continuously removed from the Chrome Root Store." Roots containing keys generated before April 16, 2014 will be removed according to a fixed annual schedule defined in the Root Program Policy. The Microsoft Trusted Root Program states that "newly minted root CAs must have a validity period of at least 8 years and at most 25 years from the date of submission." The difference between Microsoft's rules and other policies stems from the fact that the range of applications Microsoft supports with PKI is much broader than that of other browsers.One commonsense best practice is to ensure that a root CA certificate does not expire before any intermediate CA certificate chained under it.Mismanaging the lifecycle of root and intermediate CA certificates can have serious consequences. Recently, there was a case in which many Google Chromecast devices were unable to use the service when a seemingly "forgotten" Google intermediate CA certificate expired. Q: How do I automate certificate lifecycle management? For common and relatively simple cases such as web servers and public TLS certificates, CertCentral customers can automate for free using the widely supported ACME (Automated Certificate Management Environment) and ARI (ACME Renewal Information) standards.Of course, not all certificates are public TLS, and not all technologies support ACME. In those cases, DigiCert's Trust Lifecycle Manager provides advanced automation capabilities and integrations.ACME automation goes beyond simply checking a box. Changes need to be made on the device or application requesting the certificate (usually a web server). However, most administrators will find that the procedure is not complicated and is well documented.Q: What are ACME and ARI? ACME stands for Automated Certificate Management Environment, and ARI stands for ACME Renewal Information.ACME is a standard supported by all major certificate authorities through which certificate client software (usually a web server) requests certificates from a CA and installs them on the client. (In this scenario, the client is the web server.) The client software must also support ACME. Support is widespread but not universal. ACME client programs usually run on the client system on a schedule using Linux cron or Windows Scheduled Tasks, but there are other solutions that integrate scheduling into a larger product.ARI is a related standard that allows the server to suggest a schedule so the client knows it needs to renew a certificate before it expires. When configured correctly, ARI can also prevent outages by instructing the client to renew even when a certificate has been revoked. Q: How does this change affect Organization Validation (OV) and Extended Validation (EV) certificates? Under the new rules for TLS certificates, from March 15, 2026, SII (Subject Identity Information) validation can be reused for only 398 days, down from 825 days. In other words, the main impact on OV and EV certificates is that SII, the "information included in the certificate that identifies the organization," must be revalidated every year rather than once every two years.According to the TLS Baseline Requirements, this requires an annual phone call with a DigiCert representative, so full automation is not possible.Because OV and EV certificates also protect domain names, the validity periods of OV and EV certificates change on the same schedule as DV certificates. They are reduced to 200 days in 2026, 100 days in 2027, and 47 days in 2029. The need to automate the management of these certificates is just as great as for DV certificates.Q: Why 47 days? 47 days may seem like an arbitrary number, but it is simply the result of a cascade:• 200 days = up to 6 months (184 days) + 1/2 of a 30-day month (15 days) + 1 day of wiggle room• 100 days = up to 3 months (92 days) + about 1/4 of a 30-day month (7 days) + 1 day of wiggle room• 47 days = up to 1 month (31 days) + 1/2 of a 30-day month (15 days) + 1 day of wiggle roomThis model of "setting odd-numbered periods by adding wiggle room" has long been standard practice at the CA/B Forum. The current 398-day limit was chosen as up to 1 year (366 days) + up to 1 month (31 days) + 1 day of wiggle room.Q: How do these changes relate to cryptographic threats from quantum computing? There is no direct relationship. However, by forcing organizations to adopt automated certificate management solutions, we expect these changes to improve readiness for post-quantum cryptography (PQC).The future transition to PQC will involve many changes across the cryptographic systems of infrastructure (such as certificate authorities), customer environments (web servers and other applications that use digital certificates), and the software itself (web browsers, network equipment, and so on). To keep up with these changes, organizations must be able to make software changes quickly without disrupting operations. Automated certificate lifecycle management makes an important part of this possible.Certificates are only one part of PQC (though an important one), and many other software and hardware products you use will also need to be updated by various vendors to support PQC. Notably, 2029, when these changes take full effect, is also the point by which Gartner says "organizations should be quantum ready." Q: How are non-browser clients (such as network equipment) affected? The public TLS certificate market overwhelmingly supports browser-facing certificates installed on web servers, but there are other cases as well. VPN gateways and some IoT devices are good examples.These devices will also need tighter CLM (certificate lifecycle management) cycles. Many devices directly support ACME or other automation protocols, so changing the parameters may not be a big task. In other cases, however, devices may support alternative automation mechanisms or none at all, in which case users must program the automation themselves.Accommodating the new schedule on these devices will emerge as a common challenge. It is important to build a complete inventory of affected assets, and DigiCert can support this process.Q: If I renew certificates before the 2026 deadline, can I still get 398 days? Yes, renewing before March 15, 2026 to get another 398 days is permitted under the rules. However, this is a one-time extension. The next time you renew a certificate, the maximum validity period will have been reduced to 100 days. To prepare, please build automation in advance using CertCentral or Trust Lifecycle Manager.If you need to reissue (rekey) a certificate on or after March 15, 2026, DigiCert (or any public CA) must follow the rules in effect at that time, in which case the certificate can be valid for a maximum of 200 days. The best time to automate certificate management is as early as possible. Please put an automation framework in place as soon as possible so you can prepare without the risk of outages due to expiration or other causes.The sooner you prepare for certificate automation, "now" rather than "someday," the safer you will be. Systematize certificate lifecycle management with DigiCert Trust Lifecycle Manager (TLM) and respond to the reduction schedule (200 → 100 → 47 days) without disruption.▶ DigiCert TLM Learn More▶ ​FAQs: 47-Day TLS Certificates View Original

Since the arrival of ChatGPT democratized access to generative AI, the enterprise environment has been changing rapidly. As AI becomes deeply integrated into everyday business operations, new types of risk have emerged that traditional security controls cannot address. Organizations face a variety of AI-related risks, including data compromise, third-party risks, and inaccurate or unwanted AI outputs. In particular, problems caused by internal employees' policy violations, oversharing of information, and misuse of AI occur far more frequently than malicious hacking.Against this backdrop, Gartner published the "Market Guide for AI Trust, Risk and Security Management" in February 2025, presenting "AI TRiSM" as a systematic approach for enterprises to implement safe and trustworthy AI.  ☑️What Is AI TRiSM?AI TRiSM (AI Trust, Risk and Security Management) is a comprehensive technology framework for managing the trust, risk, and security of AI.Its core goal is to ensure that AI complies with corporate policies and to deliver AI governance, trustworthiness, fairness, safety, security, privacy, and data protection. It does not refer only to technical solutions but encompasses a governance framework that integrates people, processes, and technology. AI TRiSM applies to all types of AI, from embedded AI to in-house agentic AI systems, and complements traditional technical safeguards.☑️Defining the AI TRiSM MarketGartner defines the AI TRiSM market as "four layers of technical capabilities that support enterprise policies for all AI use cases." These policies aim to ensure AI governance, trustworthiness, fairness, safety, reliability, security, privacy, and data protection.The top two layers, AI Governance and AI Runtime Inspection and Enforcement, are areas newly emerging for AI and are currently consolidating into a single independent market segment. The bottom two layers represent traditional technologies focused on AI.☑️Key AI Risks Facing EnterprisesAccording to the report, the three AI risks enterprises are most concerned about are as follows.Data CompromiseThird-party RisksInaccurate or Unwanted OutputsInterestingly, it is predicted that by 2026, at least 80% of unauthorized AI transactions will be caused by internal policy violations concerning information oversharing, unacceptable use, or misguided AI behavior rather than by malicious attacks. While malicious hacking remains rare, cases of unconstrained harmful chatbots and internal data oversharing breaches are widespread.This suggests that the focus of AI security must shift from defending against external attacks to managing internal policy compliance and appropriate use.☑️Gartner's Key PredictionsGartner offers the following specific outlook for the future of the AI TRiSM market.2026: Internal policy violations become the main threat At least 80% of unauthorized AI transactions are expected to result not from malicious attacks but from internal policy violations such as information oversharing, unacceptable use, and misguided AI behavior2027: Formation of the AI TRiSM services market AI TRiSM as a Service will emerge as a viable outsourced service option for enterprises that lack the resources to implement their own AI TRiSM services2028: Spread of integrated governance teams 25% of large organizations will have integrated, dedicated information governance teams made up of data and analytics, digital workplace, security, and compliance staff (up from less than 1% in 2023)These predictions show that AI TRiSM is an area that goes beyond simple technical solutions and requires fundamental changes in organizational structure and ways of operating.☑️The Four-Layer Technology Structure of AI TRiSMAI TRiSM technology consists of four layers built on top of traditional technology controls (network, endpoint, and cloud security solutions).1. AI GovernanceAI governance provides a framework for managing an organization's AI assets, building trust in AI performance, and ensuring business outcomes. Its key capabilities are as follows.· AI catalog: An inventory of all AI entities used in the organization, including models, agents, and applications· AI data mapping: Data used to train or fine-tune AI models, data that provides context to user queries in RAG systems, or data fed to AI agent systems· Continuous assurance and evaluation: Ongoing evaluation against performance, reliability, security, and safety expectations and metrics, applied before and after deployment· Workflows: Approval of new AI, exception handling, and attestation of use· AI security testing: Red teaming and scanning of all entities (models, applications, agents)· Risk and trust control validation: Bias, leakage, trust, and use case alignment· Audit trail: Auditing of all state changes to AI artifacts· Documentation: BOM (Bill of Materials), model cards, artifacts, regulatory reports, and explainability2. AI Runtime Inspection and EnforcementThis layer is applied to model, application, and agent interactions to support the alignment of transactions with the organization's governance policies. It inspects relevant connections, processes, communications, inputs, and outputs for violations of policies and expected behavior. Anomalies are highlighted and blocked, automatically remediated, or forwarded to humans or incident response systems for investigation, triage, response, and applicable remediation.Runtime controls for AI models:· Model monitoring· Detection of anomalous activity and security events, with blocking and automatic remediation where possible· Data protection· Responsible AI filtering· Compliance with internal and external controlsRuntime controls for AI applications:· Data protection· Responsible AI filtering· Compliance with internal and external controls· Context-based access control and dynamic contextual data classification· Content anomaly detection for input and output risks (safety and enterprise acceptable use), with automatic blocking where possible· AI runtime defense (against malicious and hacker attacks), with automatic blocking where possible· Selective data obfuscation and redaction· Compliance with internal and external controlsRuntime controls for AI agents:· Aligning agent activity with agent intent· Detecting and flagging anomalous activity and security events· Automatically blocking anomalies and security events where possible· Automatically remediating anomalies and security events where possible· Compliance with internal and external controls3. Information GovernanceIn the context of AI TRiSM, information governance relates to the classification, protection, security, and management of data across its entire lifecycle. Mature information governance controls are essential to:· Ensure that AI accesses only relevant and properly authorized information· Secure the organization's sensitive information· Attempt to comply with relevant AI regulations such as the EU AI ActWhen generative AI tools are embedded in enterprise applications or use RAG to find organizational information, they can expose overshared data to a larger audience much faster, shining a light on data lifecycle problems. If appropriate measures are not taken to identify and manage sensitive data across the organization's data estate, these problems can worsen, creating unnecessary data risk and potentially leading to widespread data breaches.To improve information governance, organizations should form a multidisciplinary team made up of stakeholders from various teams, including digital workplace, data and analytics, data security, compliance, and IAM (Identity and Access Management). This team should focus on:· Bridging gaps between the various representative teams so that the organization's security, usability, privacy, and scaling requirements can be met· Handling, classifying, protecting, and securing sensitive information according to data purpose, organizational goals, and business needs· Establishing data retention policies to manage ROT (redundant, obsolete, or trivial content)· Shifting to purpose-based access control (PBAC) to reduce "permission sprawl"· Building a scalable information architecture that makes the above easy to manage and easy for users to understand on productivity platforms (Microsoft 365, Google Workspace, etc.)Currently, this technology layer remains fragmented among vendors that typically focus on one or two of the components required for comprehensive information governance. For example:· DSPM, DLP, and DAG vendors focus on data security· Identity governance vendors focus on permission management· Compliance vendors focus on retention and the data lifecycle4. Infrastructure and StackInfrastructure and stack refers to the hardware and software environments that support AI workloads, the purpose-built tools and libraries used to develop and maintain AI applications, the data processing layer, and the deployment environment, including network infrastructure. Solutions in this category include API key management and confidential computing to protect workloads in trusted execution environments.☑️Four Key Trends Shaping the AI TRiSM Market1. The Formation of AI TRiSM TeamsAI requires new cross-enterprise team processes and tools for effective runtime deployment. Gartner is seeing four new organizational trends that will naturally lead to TRiSM oversight and operations teams over the next three years.1. Security and risk management functions integrate with relevant IT software engineering and quality assurance teams and shift left into AI engineering to manage AI TRiSM controls2. Centralized or hybrid AI teams emerge to manage all aspects of AI, including AI TRiSM controls3. Information governance comes to the surface, creating an immediate need for an integrated approach across multiple organizations to protect the information used by AI4. Legal and compliance staff require that regulatory and legal requirements be met in enterprise AI applicationsGartner expects AI TRiSM oversight and operations teams to report to the managers responsible for enterprise AI innovation, development, and operations. Meanwhile, according to Gartner's 2024 enterprise AI survey, budget authority for AI privacy, security, and risk initiatives typically resides in the office of the CTO or CIO.2. Unified AI Runtime Inspection and Enforcement SystemsConsistent signals, low latency, single-pass processing, and a unified runtime control system are needed to effectively handle runtime inspection of AI events and enforce enterprise policies. Otherwise, siloed inspection and policy enforcement systems for the same event at runtime will result in conflicting analyses and resolutions.The following are important.· Running runtime policy engines (made up of rules and AI models) simultaneously - for example, separate policy engines that score data compromise risk, bias risk, legal risk, and security threats· Merging the results into a common blended risk score to guide subsequent enterprise action and remediation for suspicious AI interactionsOrganizations need to identify which team is best suited to manage the unified runtime inspection and enforcement system: a new AI team in AI engineering, an expanded IT team, or an expanded security and risk team. Regardless of who owns the unified runtime detection and enforcement system, incident response and remediation for suspicious transactions that are not automatically blocked or remediated should be forwarded to the unit and system best suited to handle them.For example, in most scenarios, security events detected by the unified inspection and enforcement system are sent to the organization's SIEM team (or an appropriately outsourced managed security service provider) for necessary follow-up. AI event triage then requires multiple escalation queues depending on the type of anomaly or violation that occurred.3. AI Hosting Providers Expanding TRiSM ServicesFrontier model providers and other AI hosting providers are continuously expanding the TRiSM services they offer to enterprises as a competitive strategy to win more business. Some have already introduced tools that enterprises can use to support their own specific acceptable use policies. Most hosting providers have implemented guardrails on model use regarding violence, self-harm, sexual content, and hate. Many providers have implemented tools to detect known runtime security threats such as copyright infringement and prompt injection.AI TRiSM will always be a shared responsibility between users and model providers, with the level varying depending on the configuration of the AI service, that is, whether it represents an IaaS, PaaS, or SaaS service. Organizations that host and manage their own models bear full responsibility for all risk mitigation.4. Consolidation of the AI TRiSM MarketIntegration of AI governance and AI runtime inspection and enforcement: This has already been partially achieved by several vendors in this Market Guide, and this trend is expected to accelerate after 2025. Vendors that provide AI runtime inspection and enforcement typically also provide two AI governance capabilities:· AI catalog (inventory)· Continuous assurance and evaluationIntegrating these two governance capabilities with runtime controls provides the foundation for real-time analysis and policy enforcement for all enterprise AI interactions and delivers a complete view of AI risks and threats.Expansion strategies from multiple types of vendors: The integration of AI governance with runtime inspection and enforcement will be incorporated into services offered by established large software, security, or networking vendors seeking to increase their share of customer wallet by supporting users on their AI journey. For example:· Signs of this trend were seen when Cisco acquired early-stage TRiSM startup Robust Intelligence in 2024· Cloud-based network security vendors such as Zscaler and Palo Alto Networks are expanding their capabilities into AI TRiSMFurthermore:· Some regulatory, compliance/fairness, and trust and safety-oriented solutions will integrate with existing governance, risk, and compliance (GRC) systems, many of which have already added modules for AI governance· Some AI runtime inspection and enforcement solutions will integrate with SASE, SSE, and cloud security vendors such as Zscaler and Wiz, and with SIEM and SOAR vendors such as Exabeam or Cisco (Splunk)· Vendors providing outsourced services for security and risk functions will expand to offer AI TRiSM services, primarily targeting small and midsize organizations· Vendors offering enterprise AI management platforms that support an abstraction layer for the AI lifecycle will increasingly integrate TRiSM capabilities into their platformsConsolidation of the information governance layer: Vendors offering DSPM, data security, and DLP systems will continue to expand to incorporate AI-centric capabilities. In particular:· DSPM vendors will integrate dynamic data classification and authorization at AI runtime· DLP vendors will expand their capabilities to support context-based inspection of AI sessions and interactions and use AI policy engines to enforce acceptable use and access control. DLP vendors will also expand their products to support not only transaction inputs and outbound information, as they do today, but also responses and inbound information· Data security platform vendors will integrate the security of structured and unstructured information in their products☑️Recommendations for EnterprisesGartner emphasizes that AI leaders must work with stakeholders across the organization to manage AI trust, risk, and security. They must establish an organizational structure to create and update AI governance policies and to evaluate and implement the AI TRiSM technologies that enable and enforce these policies.Once organized, AI leaders and business partners should:1. Discover and inventory all AI used in the organization: Use vendor capabilities that help with this, as defined in the AI governance section of this guide2. Revisit and implement data classification, protection, and access management across all enterprise information that AI could potentially use: Include both structured and unstructured information. This requires collaboration among multiple teams involved in information governance3. Contractually define responsibility and liability for unacceptable AI use or behavior in third-party embedded AI applications: Work with legal and compliance experts4. Evaluate and implement layered AI TRiSM technologies to continuously support and enforce policies across all AI entities in use: Include enterprise-owned AI TRiSM services alongside controls provided by frontier model providers. Evaluate the capabilities of frontier model hosting providers from vendors such as Microsoft, OpenAI, AWS, and Google, and apply them where appropriate, but do not rely on them alone5. Ensure independence from any single AI model provider: This enables future flexibility as AI evolves and more advanced, cost-effective AI models become available. TRiSM services help support such independence6. Continuously monitor the vendor landscape for expected consolidation and new TRiSM outsourcing services that reduce the burden of system integration and maintenance☑️Outlook and ImplicationsGartner predicts that by 2028, 25% of large organizations will have integrated, dedicated information governance teams made up of data and analytics, digital workplace, security, and compliance staff. It also expects that by 2027, AI TRiSM as a Service will emerge as a viable outsourced service option for enterprises that lack the resources to implement their own AI TRiSM services.AI TRiSM goes beyond technical solutions, exposing organizational silos and pushing teams to realign to solve problems across departmental boundaries. While no single vendor or solution currently addresses every aspect of AI threats and risks, the market is maturing rapidly and user demand is steadily increasing.For enterprises to use AI safely and reliably, they need to understand the four-layer framework of AI TRiSM and take a phased approach suited to their own organization's situation.▶ Read the full Gartner report : Market Guide for AI Trust, Risk and Security ManagementGovernance in the AI era is no longer optional but essential. Together with its global partners, CloudNetworks supports enterprises in adopting AI safely. If you have any questions about AI governance solutions, please feel free to contact us.