Articles, whitepapers, and videos on putting AI agents to work in the enterprise - safely and at scale.
If you were working in enterprise security in the early 2010s, you remember the BYOD moment. We are at that moment again. But this time, the thing employees are bringing into the enterprise isn’t a device. It’s an agent. And the governance gap is significantly larger.
Chen Pipek
SailPoint launched Agentic Fabric. Okta launched its AI Agents blueprint. The message is consistent: extend your existing identity controls to cover AI agents. It’s a reasonable instinct. It’s also incomplete in a way that matters enormously.
Amir Ofek
OAuth 2.0 is a well-designed protocol. It solved a real problem elegantly, it scaled across the internet, and the patterns it established are genuinely good engineering. It was also designed for a world that no longer describes what enterprise AI agents actually do.
Roee Salomon
The identity industry has spent the last two years building NHI security programs, extending governance frameworks, and applying non-human identity controls to enterprise AI agents. The vendors are on board. The analysts are aligned. The conference sessions are packed. And we are governing the wrong thing.
Amir Ofek
Showing 37 - 40 of 40 articles
PDFA routine billing complaint. Four lines of routing text. One AI agent with access to your CRM. That was all it took. aizome researchers documented a complete indirect prompt injection attack chain using only a public Salesforce Web-to-Case support form - no credentials, no exploit, no Salesforce bug. One support ticket caused a privileged AI agent workflow to export customer records and deliver them to an external mailbox. The attacker’s only contribution was text in a support form.
Download PDF
PDFNew research from SACR defining the control layer that decides whether a live AI agent action should complete, not whether the agent had access an hour ago. Covers the three-layer architecture, the Agentic Control Depth model that sets ACD 4 as the production bar for agents touching sensitive data, and a vendor landscape of more than thirty providers. aizome is named a pure-play ARISE vendor.
Download PDF
PDFSACR names aizome an Emerging Leader in agentic identity and access. The report covers why traditional IAM was not built for agents, and lays out a four-phase model for securing them: discover, authorize, broker, and watch. aizome is one of six vendors profiled, and one that spans all four phases.
Download PDFSee aizome in action. Your employees are already building AI agents - connected to your most sensitive systems, operating under inherited identities, with no one watching what they’re actually doing. This video shows what changes when aizome is in your environment. Every agent discovered. Every identity governed. Every action validated before it executes. Every outcome accountable. Watch to see what’s already running in your environment - and what it looks like when it’s governed.
Your AI agents don’t sleep. They don’t take breaks. And if nobody is watching their intent - not just their access - they will reach further than they should. In this episode, aizome CEO Amir Ofek joins Hacker Valley Media to talk about the autonomous workforce already running inside enterprise environments - ungoverned, unmonitored, and unknown. A conversation about why knowing what an agent is permitted to do is not the same as knowing what it is actually doing right now. Listen here - https://hackervalley.com/e/do-you-know-what-your-agent-is-doing-at-3am-with-amir-ofek
NHI is evolving. Or is it being replaced? In this fireside chat, SACR analyst Lawrence Pingree and Amir Ofek make the strongest possible case for why extending NHI frameworks to cover AI agents is not the right strategy. The argument: organizations treating enterprise AI agent governance as “NHI with extra steps” are building programs that will fail in production. ARISE - Agentic Runtime Identity Security Enforcement - is not an extension of NHI. It is what comes after it.
Amir Ofek
Showing 1 - 3 of 4 videos
PDFA one-page breakdown of how aizome delivers continuous AI agent governance posture across OWASP, MITRE ATLAS, ARMCF, NIST AI RMF, and the EU AI Act.
Download PDF
PDFThe board question is already in the room: which AI agents are connected to our critical systems, who built them, and who is accountable? Most CIOs cannot answer it today - not because they are not paying attention, but because the infrastructure to answer it does not exist in their current stack. This guide tells you what to put in place.
Download the Guide
PDFAI agents don’t breach perimeters - they drift past them. This infographic maps how aizome’s intent analysis engine evaluates every agent action in real time, from the moment a prompt is received to the moment it executes or is blocked. Identity establishes who the agent is. Intent determines what it’s allowed to do. Together, they are the only control plane built for how agents actually operate.
Download PDFShowing 1 - 3 of 9 datasheets
PDFIn a world of ten thousand faces, not every identity is what it seems. In this chapter of The Indigo Guardian, Ito confronts the dangers of false identities, wandering agents, and invisible threats. But true protection isn’t about stopping everything - it’s about knowing what belongs, recognizing what doesn’t, and establishing boundaries that preserve trust. Through Japanese-inspired storytelling, aizome explores a fundamental principle of agentic AI security: You cannot protect what you cannot see, and you cannot govern what you cannot identify. The first battle isn’t access. It’s identity.
Read the comic
PDFFour samurai. One clan. One crosses a boundary he was never meant to cross. In this chapter of The Indigo Guardian, discover how even the most trusted agents can drift beyond their intended purpose - and why identity, visibility, and governance are essential in the age of agentic AI. Through the art of Japanese-inspired storytelling, aizome explores a critical security challenge: How do you protect what you cannot see? Every agent needs an identity. Every identity needs a guardian.
Read the comic
PDFIn Japan, indigo protected what it touched by becoming part of it, not by standing between. Mamoru, miru, shiru - to protect, to see, to know. The story behind the name, in a single page.
Read the comicOccasional, substance-first writing on identity, intent, and putting AI agents to work across the enterprise. No noise.
