AI Security Reference ArchitecturesReference
AI Security Vendors by Category
Example products for each part of the eleven models in our AI reference architectures, grouped by what they do. The "Used in" column links to the implementation guide for each architecture, which names the tier each control needs.
Last reviewed October 2026. Parent company in parentheses where an acquisition has closed. Examples of a category, not endorsements. Spot something out of date? Tell us.
| Category | Used in | Example vendors |
|---|---|---|
| Enterprise AI assistantsCompany tenants for chat and desktop AI, with SSO and no training on your data | A2 B1 | ChatGPT Enterprise, Claude Enterprise, Microsoft 365 Copilot, Gemini in Google Workspace; inside SaaS: Slack AI, Zoom AI Companion, Notion AI |
| Employee AI agentsAssistants that act as the user in email, calendar, files and the browser | B1 | ChatGPT agent, Claude in Chrome and Claude Cowork, Microsoft 365 Copilot Cowork, Gemini in Chrome; third-party: Fyxer, Superhuman, Lindy; open source: OpenClaw |
| Vendor-run AI agentsAI SOC and SRE agents a vendor runs with access to your systems | B2 | AI SOC: Dropzone AI, Prophet Security, 7AI, Torq, Microsoft Security Copilot agents, CrowdStrike Charlotte AI; AI SRE: Resolve.ai, Cleric, Datadog Bits AI SRE |
| Shadow AI and browser controlsFind unapproved AI tools, block personal accounts, redact sensitive data in prompts | A2 B1 | Harmonic, LayerX (Akamai), Island, Prisma Browser, Prompt Security (SentinelOne), Cloudflare Zero Trust, Chrome Enterprise Core, Netskope, Zscaler |
| Model APIsFrontier models called over the public internet | A1 A3 T | OpenAI API, Anthropic API, Gemini API |
| AI gatewaysOne endpoint for keys, budgets, routing, logging and guardrails | A3 A4 C2 T | LiteLLM, Kong AI Gateway, Prisma AIRS AI Gateway (formerly Portkey), Cloudflare AI Gateway, Vercel AI Gateway; aggregator: OpenRouter |
| Managed cloud AIModels inside your cloud's compliance boundary over private networking | A4 T | Amazon Bedrock, Microsoft Foundry, Gemini Enterprise Agent Platform (formerly Vertex AI), AWS PrivateLink |
| Self-hosted inferenceServe open-weight models on infrastructure you run | A4 T | vLLM, Ollama, NVIDIA NIM, KServe |
| Guardrails and model scanningCatch prompt injection, jailbreaks and PII at runtime; scan model files before loading | A3 A4 B3 C2 T | Lakera (Check Point), CrowdStrike Falcon Guardian, Cisco AI Defense, Amazon Bedrock Guardrails, Microsoft Presidio, Protect AI (Palo Alto Networks), HiddenLayer |
| Identity and device accessSSO, MFA and compliant-device checks for people, workloads and agents | A2 A3 A4 B1 B2 B3 B4 C2 T | Okta, Okta Device Assurance, Microsoft Entra Conditional Access and token protection, Entra Privileged Identity Management, Google Workspace and Cloud Identity with context-aware access |
| Agent and non-human identityAgent identities, on-behalf-of tokens and inventory of agent credentials | B1 B2 B3 T | Okta for AI Agents, Okta Agent SSO (Cross App Access), Microsoft Entra Agent ID, Aembit, Descope, Astrix, Token Security, Clutch |
| Secrets managersKeep keys out of code, .env files and laptops; inject them at run time | A1 A3 B3 B4 T | 1Password (CLI, SSH agent, service accounts), HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager |
| Short-lived credentialsReplace stored keys with job-scoped and task-scoped tokens | A1 A4 B1 B4 | GitHub Apps + OIDC, GitHub fine-grained PAT policies, cloud workload identity |
| Data classification, DLP and access governanceLabel sensitive data, stop it leaving, and remove broad sharing before AI search finds it | A2 B1 T | Microsoft Purview, Google Workspace DLP, Nightfall, Varonis, Cyera, Securiti |
| Device management and EDRLock AI apps to your org, block unapproved AI apps, push managed settings and find AI use on laptops | A1 A2 B1 B4 T | Microsoft Intune, Jamf, Iru (formerly Kandji), Santa; EDR AI modules: SentinelOne AI Usage Control, CrowdStrike Falcon Guardian, Microsoft Defender for Cloud Apps |
| Low-code agent platformsAgents built by business teams inside a vendor suite or a workflow engine | A2 B3 | Copilot Studio, Salesforce Agentforce, ServiceNow AI Agents, Gemini Enterprise; n8n, Dify, Langflow, Flowise, Zapier, Make |
| Agent frameworksLibraries for building custom agents | B3 | LangGraph, Claude Agent SDK, OpenAI Agents SDK |
| MCP gateways and policy enginesApproved tool registry, token exchange and allow or deny decisions for every tool call | B3 B4 C1 T | Docker MCP Gateway, Kong, Cloudflare MCP Server Portals, Runlayer, Obot; OPA, Cedar |
| Sandboxes and cloud dev environmentsIsolated places for agents to run code, away from production credentials | A1 B1 B3 B4 | E2B, GitHub Codespaces, Dev Containers, Coder |
| Coding assistants and agentsAI that writes, reviews and ships code | B4 | Cursor, GitHub Copilot, Claude Code, OpenAI Codex, GitHub Actions |
| Code and supply chain security for agentsPackage firewalls, CI egress control, and inventory of local MCP servers, extensions and skills | B1 B4 | Socket, StepSecurity, Backslash, Koi (Palo Alto Networks), GitGuardian, GitHub secret scanning, TruffleHog |
| AI inventory, posture and runtime monitoringFind every model, agent and MCP server, and watch agent behavior | A2 B3 T | Wiz, Orca Security, Noma, Zenity, Straiker, Microsoft Agent 365 |
| Red teaming and evalsTest AI apps and agents for injection, leaks and unsafe actions before release | B3 C2 | Promptfoo (OpenAI), Mindgard, SPLX (Zscaler) |
| Customer identity and API protectionOAuth for agents, per-client rate limits and schema checks on the APIs you publish | C1 C2 | Auth0 (Okta), WorkOS, Descope, Stytch, Kong Gateway, Cloudflare API Shield |
| SaaS security and token detectionFlag new OAuth grants, shadow AI apps and automation-like token use in SaaS apps | A2 B1 B2 | Valence Security, Push Security, Obsidian, AppOmni, Reco |
| SIEM and telemetryKeep logs and run detections for AI abuse | A2 A3 A4 B2 B3 C1 C2 T | Splunk, Microsoft Sentinel, Datadog, Blumira; MDR that ingests AI logs: Expel |
Not sure which of these you actually need?
Bring the AI tools your teams use today. In a 30-minute call we map you to the architectures and tell you what to buy first, and what you already own that covers it. No sales pitch.
Talk to a CISO