Agentic AI Security: Securing AI Agents in the Enterprise
Analyze live attacks on AI agents and develop protective measures in the threat modeling workshop
.svg)
Machine Learning Engineer
1. Agents from the attacker's perspective
- Agents vs. Chatbots: Agents perform actions.
- Levels of autonomy and their respective security requirements.
- Attack Surface: Model, Planning, Tools, Context, Orchestration.
- Trust boundaries: MCP server, agent-to-agent communication, external data sources.
- Minimum Governance Requirements: Agent Registry, Owner, Approval Level.
2. Attacks on AI Agents
- An Overview of the OWASP Top 10 for Agent-Based Applications and MITRE ATLAS.
- Live Prompt Injection: A tampered document takes control of an agent.
- Tool abuse, as well as identity and rights abuse via chained tools.
- Memory and context poisoning, tainted RAG sources.
- Supply Chain Risks: Tool Poisoning, Compromised MCP Servers.
3. Defense and Protection
- Defense in Depth Instead of a Single Filter.
- Agent identity, least privilege, short-lived permissions instead of static keys.
- Human approval of critical actions.
- Sandboxing, isolation, egress control.
- Connecting to an MCP Server Securely: Protection Filters—Benefits and Limitations.
4. Threat Model Workshop
- Data flow diagram and STRIDE analysis, supplemented by OWASP agentic risks.
- Group work on a sample workflow or on your own project.
- Assign measures; assess residual risks.
5. Secure Operations and Incident Response
- Tracing and logging agent actions.
- Detection of anomalies and typical indicators of fraud.
- Security testing, red teaming, emergency shutdown (“kill switch”).
- Integrate agents into the SOC and incident response teams.
- You classify agents according to their degree of autonomy and agency, and use this to determine their vulnerability and protection needs.
- You understand the risks associated with the OWASP Top 10 for Agent-Based Applications and can identify typical attack vectors such as indirect prompt injection, tool misuse, or compromised MCP servers.
- You create a threat model for an agent workflow and prioritize risks.
- You select and combine appropriate security measures—from dedicated agent identities and least-privilege access rights to human approval of critical actions—and realistically assess their limitations.
- You plan monitoring, security testing, emergency shutdowns, and incident response for agents.
Short keynote presentations alternate with live demos—including a prompt injection attack, which is then repeated against a hardened agent. A brief survey on known agent risks serves as an introduction to the exchange of experiences. In group exercises, you’ll work on attack paths and participate in the threat modeling workshop; moderated discussions will help you assess the benefits and limitations of protective measures. Real-world examples, lessons learned, and peer feedback on your own projects round out the day.
You’ll work with templates for autonomy assessment, attack surface analysis, attack trees, and threat modeling, as well as a catalog of measures and an incident response playbook—you’ll receive all of these materials in digital form for future use. Additional topics (agent frameworks, cost/latency, legal framework, AI governance processes) are available in the handout.
Prerequisites: A basic understanding of AI and large language models (e.g., how an LLM processes input, what prompts, context windows, and RAG are). Basic knowledge of IT security (permissions, authentication) is helpful. Programming skills are not required.
- IT Security Managers and Security Architects
- IT and Solution Architects
- AI/ML and Platform Engineers
- SOC and Incident Response Teams
- Technical Product Owners who validate, review, or oversee AI agents
.svg)