ASAI Security ResearchIndependent public-source research
Public reviewread only

Solution approach

Exposed AI asset discovery

Find internet-accessible, unknown, or misconfigured AI systems and related attack paths.

Research scopeVendorsPublicly documented vendor profiles
Evaluation guideRequirementsSecurity requirements buyers can verify
Evidence basisSourcesPublic claims linked to their original sources
Unresolved itemsQuestionsMissing support is labeled instead of assumed
View research coverageThese counts describe available public research, not product quality or suitability.Expand
Vendor profiles
7 shown in this view
Security requirements
3 to review
Strong public support
15 requirement records
Limited public support
2 requirement records
Open research
4 with no supporting claim · 0 incomplete

Evaluation guide

What buyers should verify

Foundational security requirement

Unapproved AI use discovery

Discover and monitor workforce AI tools, accounts, prompts, domains, models, users, and usage outside approved controls.

Questions to test
  1. An unmanaged AI app used by a test user appears in discovery inventory with user, app or domain, and timestamp.
  2. The test user's AI usage activity can be filtered or exported with AI-specific context.
  3. Approved and unapproved AI destinations or accounts are distinguishable in the evidence record.
Related frameworks

NIST AI RMF Playbook · NIST Cybersecurity Framework 2.0 · CIS Critical Security Controls · ISO/IEC 42001 · OWASP GenAI Security Solutions Landscape

Additional security requirement

Generative AI application security

Protect enterprise-built large language model (LLM) applications, retrieval-augmented generation (RAG) systems, prompts, application programming interfaces (APIs), model calls, tools, and production runtime behavior.

Questions to test
  1. A test large language model (LLM) application event records prompt, application programming interface (API), model, retrieval, or tool interaction context.
  2. A prompt-injection or unsafe-output test is detected, blocked, or flagged by the guardrail or large language model (LLM) firewall.
  3. The evidence links the event to an application, endpoint, request identifier, or workflow.
Related frameworks

NIST AI RMF Playbook · NIST Cybersecurity Framework 2.0 · CIS Critical Security Controls · ISO/IEC 42001 · OWASP GenAI Security Solutions Landscape

Foundational security requirement

Action-taking agent monitoring

Observe and govern agent plans, memory, tool calls, delegated tasks, autonomy, runtime decisions, and outcomes.

Questions to test
  1. A test agent run captures plan, steps, tool calls, outcome, and timestamps.
  2. Agent memory, delegated task, autonomy, or runtime decision detail is visible in a timeline or log.
  3. Out-of-policy or unusual agent behavior can be flagged or filtered for investigation.
Related frameworks

NIST AI RMF Playbook · NIST Cybersecurity Framework 2.0 · CIS Critical Security Controls · ISO/IEC 42001 · OWASP GenAI Security Solutions Landscape

Vendor research

Vendors with public research for this approach

Choose vendors to compare →

Vendors are grouped by whether this approach is a core product focus or related coverage, then ordered by documented support across the requirements shown. This organizes public research coverage; it is not a product ranking or recommendation.

Evidence labelsStrong public supportLimited public supportNo supporting claim foundResearch incomplete
VendorUnmanaged AIGenerative AI app securityAgent runtime telemetrySourcesAction
Core product focusThis approach is central to how these vendors present the product · 3 vendors
Upwind AI SecurityScaledSupport found for 3 of 3 requirementsStrong public supportStrong public supportStrong public support1Profile →
Apex Security / TenableEstablishedSupport found for 3 of 3 requirementsStrong public supportStrong public supportLimited public support1Profile →
Wiz AI-SPM / Google CloudEstablishedSupport found for 2 of 3 requirementsNo supporting claim foundStrong public supportStrong public support1Profile →
Related coverageThese vendors address the requirements through another core product focus · 4 vendors
Palo Alto Networks Prisma AIRSEstablishedSupport found for 3 of 3 requirementsStrong public supportStrong public supportStrong public support1Profile →
Zscaler AI SecurityEstablishedSupport found for 3 of 3 requirementsStrong public supportStrong public supportStrong public support1Profile →
Orca AI-SPMScaledSupport found for 2 of 3 requirementsStrong public supportLimited public supportNo supporting claim found1Profile →
Akamai API SecurityEstablishedSupport found for 1 of 3 requirementsNo supporting claim foundStrong public supportNo supporting claim found2Profile →

Company maturity remains a filter and profile attribute; it does not affect the research-coverage order.