🔐 Introducing the AI Security Mini-Series
Over the past blogs, we've explored how to build Agentic AI systems—from creating Strands Agents and integrating tools to implementing RAG, evaluations, observability, and AgentOps practices.
Now it's time to answer an equally important question:
How do you secure what you've built?
Before we can answer that, we first need to understand the system we're trying to protect.
🤔 Why This Matters
Imagine securing an airport.
Before installing CCTV cameras, security checkpoints, or baggage scanners, you first need a map of the airport—its entrances, restricted areas, baggage handling systems, and control tower.
AI Security follows the same principle.
Before implementing guardrails, IAM policies, or prompt defenses, we first need to understand what we're protecting.
That's exactly what this article is about.
Traditional Applications vs. Agentic AI
A traditional application has a relatively predictable attack surface.
Traditional applications primarily focus on securing APIs, authentication, infrastructure, and databases.
Now compare that with an Agentic AI application.
Unlike traditional applications, an AI agent continuously reasons over multiple information sources before making a decision.
Every one of those sources can influence the final outcome.
That is what makes the Agentic Attack Surface fundamentally different.
💻 Our Reference Application
Throughout this AI Security Mini-Series we'll use the same Enterprise AI Research Assistant, built using Kiro and the Strands Agents SDK.
The application contains:
Rather than creating a new application for every topic, we'll progressively secure this reference application throughout the series.
What is the Agentic Attack Surface?
Let's begin with a simple definition.
The Agentic Attack Surface is the collection of all components, interactions, and execution paths that can influence an AI agent's reasoning, decisions, or autonomous actions.
We're protecting everything that influences an agent's reasoning:
If it influences the agent's behaviour, it belongs to the attack surface.
🏗️ Mapping the Reference Architecture
Every component contributes to the agent's behaviour and forms part of the attack surface.
🚧 Understanding Trust Boundaries
A trust boundary exists whenever information crosses from one level of trust to another.
Each trust boundary represents a point where malicious or unexpected information could influence the agent.
🔍 Following a Single Request
"Explain the OWASP LLM Top 10."
A single request traverses multiple components before a response is produced. Every transition is an opportunity to influence the agent's reasoning.
🏛️ Architect's PerspectiveIn traditional software, users influence the application.In Agentic AI, users can influence the reasoning.
💡 Key Takeaways
- AI Security begins with understanding your architecture.
- Every component that influences reasoning becomes part of the attack surface.
- Trust boundaries identify where future security controls will be applied.
- Before implementing defenses, you must first understand what you're protecting.
🚀 Try It Yourself
⏭️ What Comes Next
Next, we'll perform Threat Modeling to identify threats across every component and trust boundary.
🎉 Final Thoughts
Building an AI agent is only half the journey.
This article gave us the map.
In the next blog, we'll identify the threats hidden within it.
Loading article