19 Detection Rules for Agentic AI: How Runtime Defense Catches What Firewalls Miss
Traditional security tools were built to police network packets, files, and process behavior. None of them understands what an AI agent is actually trying to do. When an agent calls an API to read a database and forward the result to an external service, a firewall sees an allowed outbound HTTPS connection, an EDR agent sees a normal process, and a WAF sees a well-formed request. Every layer waves it through — because the danger is in the intent and content of the interaction, not the transport.
That is the agentic AI blind spot. The attack surface is the conversation between an agent, its model, and its tools — and that surface is invisible to tools that don't parse AI semantics. Runtime Defense closes it by inspecting every AI interaction in real time, with 19 purpose-built detection rules.
Why firewalls and EDR miss this
The threats that matter for agentic AI don't look like the threats those tools were designed to catch:
- Prompt injection rides inside legitimate data. The malicious instruction is text returned by a tool or document — there is no malformed packet to block.
- Tool misuse uses authorized credentials. The agent has permission to call the tool; the problem is that it shouldn't in this context.
- Data exfiltration looks like normal API traffic. A query result flowing to an LLM provider or a webhook is just an outbound request.
- Behavioral drift has no signature. An agent doing something it has never done before is novel, not known-bad.
19 rules across four categories
Runtime Defense ships 19 detection rules grouped into four categories. Each rule evaluates a parsed agent interaction and, when it fires, explains why it fired and what the recommended response is — so analysts get a decision, not just an alert.
Direct and indirect injection — including malicious instructions smuggled in through tool outputs, retrieved documents, or system-prompt leakage attempts.
An agent invoking tools outside its intended scope: a coding agent deploying, a read-only agent writing, an analytics agent reaching production systems.
Secrets, PII, or sensitive payloads moving through an agent toward an external destination — caught before they leave your boundary.
Deviations from a per-agent baseline: new tools, abnormal data volumes, off-hours activity, or request patterns far outside the norm.
Five enforcement modes
Detection without enforcement is just noise. Every rule maps to a policy decision, and policies support five enforcement modes so teams can roll out safely: allow, deny, warn, review, and audit (monitor-only). Start in audit mode to baseline what your agents actually do, then tighten high-confidence rules to deny without disrupting legitimate workflows.
Behavioral baselining
Signature rules catch known patterns; baselining catches the unknown. Runtime Defense builds a profile of each agent over time — which tools it uses, what data volumes are normal, when it runs. When an agent suddenly reaches for a tool it has never touched, moves far more data than usual, or acts at an unusual hour, the anomaly is flagged with a confidence score proportional to how far outside normal the behavior is.
Why this matters now
The EU AI Act requires organizations to maintain inventories of AI systems and demonstrate governance controls. ISO 42001 mandates AI management systems with defined risk controls. The OWASP LLM Top 10 lists prompt injection and excessive agency among the highest risks for LLM applications. Runtime Defense gives you the real-time control layer those frameworks assume you already have — before an agent does something you only find out about after the fact.
Put runtime defense around your AI agents
Runtime Defense is available on the Enterprise plan. Request a demo to see the 19 rules and enforcement modes in action.
Request Demo