AI Detection & Response

Overview

Core Components

The AIDR solution consists of two integrated components:

1. Runtime Visibility - Complete observability into AI agent behavior with granular step-by-step tracking of all interactions—transforming the AI black box into transparent, auditable activity.

2. Threat Detection & Response - Continuous security analysis powered by an advanced detection engine mapped to industry-standard OWASP LLM and MITRE ATLAS frameworks.

Table of Contents

Runtime Visibility (Activity)

Zenity’s Runtime Visibility provides near real-time observability into every AI agent interaction. By breaking down complex workflows into granular steps—both user-facing and behind-the-scenes—Zenity transforms what was once a black box into complete transparency.

Key Activity Attributes

Every interaction captured by AIDR includes the following metadata:

Understanding Steps

Agentic AI flows are broken down into atomic units called Steps. These capture both visible user interactions and internal agent operations, providing complete context for investigation and analysis.

Step Types

Zenity tracks all AI agent activity through distinct step categories:

Step Metadata

Each step contains rich contextual information:

AI Service

The supported AI service powering the agent (e.g., Microsoft Copilot, ChatGPT Enterprise, Google Vertex AI).

Client Application

The application platform from which the actor interacted with the agent.

Agent

The AI agent associated with the step. This is clickable and links directly to Zenity’s AISPM Inventory for deeper asset context.

Logs & Transcript Data

Each step contains both:

• Metadata: Timestamps, actors, service information, and step details (persisted)
• Sensitive Content: Message text, tool parameters, file snippets (processed in-memory, never stored)

When investigation requires access to sensitive content, users can fetch this data on-demand via the source’s API directly within the Zenity UI.

A2A Communication Visibility {#a2a-communication-visibility}

When agents communicate with one another, Zenity automatically identifies and tracks these interactions as dedicated Agent Handoff steps in the Activity Page. This includes both the initial request from one agent to another and the response containing the requested data or assistance.

When you select an Agent Handoff step in the UI, the side panel provides granular context for the interaction. It includes an A2A Communication section, along with common step fields and enrichments available for other steps.

Key A2A Fields:

Threat Detection (Findings)

Zenity’s advanced detection engine continuously analyzes AI agent activity to surface risks, anomalies, and suspicious behavior before they become incidents. Every finding is enriched with context and mapped to industry-standard security frameworks.

Detection Coverage Includes:

• Data exposure and leakage
• Prompt injection attempts
• Unusual agent behavior patterns
• Malicious file uploads
• Policy and compliance violations

Detection Engine

At the core of AIDR is a powerful rule engine designed to surface AI runtime risks across multiple threat categories:

• Prompt misuse and injection attempts
• Sensitive data exposure (PII, credentials, secrets)
• Unusual agent behavior patterns
• Malicious inputs and obfuscation techniques
• Policy and compliance violations

Framework Mapping

All detection rules are fully mapped to industry-standard security frameworks:

• MITRE ATLAS - Adversarial threat landscape for AI systems
• OWASP LLM - Top security risks for LLM applications

To explore the complete ruleset, visit the Policy page in the Zenity platform and filter by the “AIDR” tag.

Severity Levels

Detection severity is calculated based on potential impact and confidence level, resulting in three priority tiers:

Note: Not every anomaly indicates a confirmed threat. Findings serve as indicators of suspicious behavior worth tracking and investigating, even when not yet conclusive.

Individual Finding Details

Click any finding to access comprehensive context and actionable intelligence for investigation and response.

Each finding includes:

Evidence

• Exact reason for detection
• Supporting data and context
• Timestamp and sequence information

Context

• Actor Name: User who triggered the interaction
• Client Application: Platform used for the interaction
• Agent: AI agent involved (linked to AISPM Inventory)

Framework Mapping

• OWASP LLM category
• MITRE ATLAS technique
• GenAI Matrix alignment

Guidance

• Investigation tips and next steps
• Response recommendations
• Links to related findings and thread activity

Detection Capabilities

LLM-Based Runtime Detections

AIDR extends its detection engine with LLM-based runtime detections to identify threats that require deep semantic and contextual understanding. These detections operate alongside existing mechanisms such as pattern matching, structural validation, and threshold-based conditions to identify known risk signals with high precision and predictable behavior. LLM-based detections and are designed to uncover previously unseen attack variants, nuanced misuse, and multi-step behaviors that cannot be reliably detected using static patterns alone.

LLM-based detections are applied selectively in scenarios such as determining malicious intent, detecting paraphrased or obfuscated attacks, correlating behavior across multiple steps or tool invocations, and identifying inconsistencies between user requests and agent actions. To enable deeper analysis without impacting user-facing latency, these detections run asynchronously.

Detection coverage includes:

• Malicious Input such as instruction injection, jailbreaks, tool abuse, and disguised manipulation techniques
• Reconnaissance attempts targeting sensitive data, agent capabilities, tools, or system instructions
• Data Exfiltration via email, messaging, webhooks, external storage, public links, attachments, or encoded payloads
• Destructive Actions including deletions, permission changes, and other mutating operations
• Sensitive Resource Access involving non-destructive reads of PII, credentials, financial, HR, legal, customer, or IP data
• Obfuscated Text using encoding or transformation techniques while excluding legitimate technical artifacts
• Intent Breaking, where agent behavior deviates from the user’s request

LLM-based detections provide semantic, intent-aware analysis with probabilistic outcomes and natural-language explainability. They complement existing detection mechanisms by adding depth and adaptability while preserving Zenity’s privacy-by-design approach through in-memory processing of sensitive content.

LLM-based detections significantly improve signal quality compared to pattern-based logic. While deterministic rules are highly effective for known and well-structured indicators, they often generate false positives when context is ambiguous or language is used in a legitimate manner. By analyzing intent and semantic meaning rather than isolated keywords or patterns, LLM-based detections reduce alert noise and improve precision, especially in complex, paraphrased, or multi-step scenarios. This results in more actionable findings for security teams, minimizing investigation overhead while increasing coverage of sophisticated and previously unseen threats.

File Attachment Scanning

As document uploads become a primary interaction method with AI agents, file attachments represent a critical security blind spot. AIDR provides comprehensive near real-time scanning to identify security and compliance risks hidden within uploaded files.

Supported Platforms & Formats

Primary Integration: ChatGPT Enterprise

Security Scanning Scope

The detection engine analyzes file contents across three critical risk categories:

Investigating File-Based Findings

When risks are detected in file attachments, findings include specialized metadata for forensic analysis:

Enhanced File Evidence

Security teams can download suspicious files directly from the finding drawer for deeper investigation and analysis.

AI Agent Runtime Governance

Alongside threat detection, AIDR supports AI governance use cases by enforcing organizational standards for how AI agents access data and interact with external systems at runtime. These detections are driven by customer-defined policy configuration, allowing security teams to translate internal AI usage rules into enforceable controls.

Runtime governance detections focus on organizational policy violations rather than malicious intent, helping reduce risk, prevent accidental data exposure, and ensure consistent AI behavior across environments.

Key governance-driven detections include:

• Sensitive File Access
  Detects when an AI agent accesses files classified as sensitive based on Microsoft sensitivity labels or defined SharePoint and OneDrive sensitive locations. This enables data-layer governance scenarios such as monitoring access to executive OneDrive folders or specific sites containing regulated or high-impact data.
  To enable this detection, use the Policy Configuration tab to define sensitive data using Sensitive Labels and Sensitive Locations.

• Disallowed Recipient Domains
  Detects when an AI agent sends information via tools to recipient domains that are not permitted by organizational policy. This helps reduce unintended data egress and limit information leaving the tenant.
  To enable this detection, use the Policy Configuration tab to define trusted domains. Subdomains are supported using wildcards (for example, *.main.com). Any domain not explicitly listed will trigger a detection.

These detections provide deterministic and explainable outcomes aligned with enterprise governance requirements, enabling consistent enforcement of AI usage standards at runtime without relying on probabilistic intent analysis.

Automate Response via AIDR API

Scale your security operations with programmatic access to AIDR data. The Zenity API enables automated risk processing, custom alerting, and seamless integration with existing security workflows—SIEM, SOAR, ticketing systems, and more.

Key API Endpoints

Access AIDR data through the Detection API section:

Querying Findings

Retrieve detected runtime risks with flexible filtering options:

# Example: Get findings for M365 Copilot since specific timestamp
GET /v1/detection/findings?aiService=m365Copilot&sinceTimestamp=2024-01-01T00:00:00Z

Key API Parameters

Cross-Referencing with AISPM

To correlate runtime findings with Zenity AISPM inventory data:

1. Use the toolplatforminfo.resourceid field from the listFindings endpoint
2. Cross-reference with the List Resources endpoint
3. Gain complete asset context including ownership, permissions, and configuration

How It Works

Solution Architecture

AIDR is built on a modern, cloud-native architecture designed for enterprise scale:

Platform Coverage

AIDR currently supports the following AI services:

Getting Started with AIDR

Microsoft 365 Copilot Setup

To enable AIDR for M365 Copilot, Zenity requires specific Microsoft Graph and Office 365 Management API permissions.

Required Permissions

Once permissions are granted, Zenity automatically starts ingesting data in real-time and analyzing it for runtime findings.

Expanding Existing Integrations

Already have a Zenity integration with Microsoft? Follow these steps to enable AIDR capabilities:

Option 1: Expand via Managed Application

Enhance your existing Zenity integration by re-consenting to the updated permission set.

Step-by-Step Instructions:

1. Navigate to Azure Portal > Enterprise Applications
2. Select the Zenity application used for your existing integration
3. Expand Security in the left navigation menu
4. Click Permissions
5. Click Grant admin consent for [your tenant]

Once consent is granted, Zenity automatically begins ingesting data and analyzing it for runtime findings in near real-time.

Option 2: Expand via Service Principal

For organizations using service principal-based integrations, add the required permissions directly to your Azure AD application.

Step-by-Step Instructions:

1. Open your Azure AD Application page
2. Navigate to API Permissions
3. Click Add a permission
4. Add the following permissions:

Office 365 Management APIs (Application permissions)

• ActivityFeed.Read

Microsoft Graph (Application permissions)

• AiEnterpriseInteraction.Read.All
• InformationProtectionPolicy.Read.All

5. Click Grant admin consent for [your tenant] to activate the permissions

Creating a New Integration

If you don’t have an existing Zenity integration with Microsoft, create a new one using either method:

Securing Homegrown Agents

The Solution: Zenity Evaluation Engine for homegrown agents

Zenity provides a specialized, cloud-agnostic security decision engine that acts as a runtime guardrail for homegrown agents.

How it Works: Agents micro-interaction (prompts, tool calls, and RAG retrievals) are sent to the engine.

The Decision: The engine evaluates the interaction for security and logic, returning a clear Allow or Deny decision with full explainability.

Deployment and Integration

Detections Supported for Homegrown Agents