ThreatLocker Launches Zero Trust AI Control for Agentic AI Security
ThreatLocker introduces ZTAIC to enforce external boundaries on AI agents, ensuring they cannot bypass security controls while executing tasks.
Key points
- ThreatLocker released Zero Trust AI Control (ZTAIC) to manage agentic AI access and execution.
- The solution applies controls outside AI deployments to prevent agents from bypassing existing protections.
- ZTAIC integrates with ThreatLocker Allowlisting and Web Content Control for lifecycle security.
ThreatLocker has announced the launch of Zero Trust AI Control (ZTAIC), a new security tool designed for organizations deploying agentic AI. According to Help Net Security, the product allows security teams to maintain control over their environments while enabling AI agents to perform necessary tasks without unauthorized access.
ZTAIC addresses the limitations of traditional AI guardrails, which rely on self-enforcement of behavioral rules. The new solution independently governs agent actions by applying controls outside the AI deployment itself. This external governance ensures that security boundaries remain intact even if an AI agent behaves unexpectedly or attempts to circumvent internal restrictions.
Context and Background
The security landscape has shifted as AI agents move beyond providing information to taking direct actions within organizational environments. Danny Jenkins, CEO of ThreatLocker, stated that organizations need a way to adopt AI without handing over control of their systems. ZTAIC aims to provide this peace of mind by defining exactly what agents can access, execute, and connect to.
A single request to an AI agent can trigger a complex workflow involving applications, scripts, browsers, and other services. ZTAIC maintains security boundaries throughout this entire process. It prevents agents from invoking other processes in ways that would bypass existing protections, ensuring that each step of the workflow remains within authorized limits.
Who Is Affected
Security teams responsible for deploying and managing AI agents are the primary users of this solution. These teams can start with pre-built guardrails and recommended policies provided by ThreatLocker. They can then tailor these policies to fit their specific environment, allowing for rapid establishment of strong boundaries around AI agent operations.
ZTAIC works in conjunction with ThreatLocker Allowlisting and Web Content Control. This combination gives security teams control across the entire AI lifecycle. It covers which AI applications and browser-based services are permitted in the environment, as well as what authorized agents can do once they are running.
What should you do?
Organizations evaluating agentic AI deployments should review their current control mechanisms. Existing guardrails may not be sufficient if they rely on the AI system to enforce its own limits. Security leaders should consider external control solutions that can independently verify and restrict agent actions.
WHAT TO DO:
- Audit current AI agent permissions to identify potential over-privilege or lack of external controls.
- Review existing guardrails to ensure they do not rely solely on self-enforcement by the AI system.
- Monitor agent workflows for unexpected application invocations or connections to unauthorized services.
- Wait for vendor updates on integration capabilities with existing allowlisting and web content controls.
What to do and how to stay safe: ThreatLocker
- Sudden role changes in output signal a successful override of system instructions.
- Hidden metadata in images or documents often carries invisible injection payloads.
- Immediate isolation of the affected session prevents lateral movement within the AI workflow.
Prompt injections exploit the model’s ability to follow instructions by hiding malicious commands in input data. Isolate affected sessions immediately and implement external guardrails to filter inputs before they reach the model.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Zero Trust AI Control (ZTAIC)?
ZTAIC is a tool by ThreatLocker that applies external controls to AI agents, governing their access and execution independently of the AI deployment itself.
How does ZTAIC differ from traditional AI guardrails?
Traditional guardrails rely on the AI to enforce its own behavioral rules, while ZTAIC applies controls outside the deployment to maintain boundaries even if the agent behaves unexpectedly.
Which other ThreatLocker products integrate with ZTAIC?
ZTAIC works together with ThreatLocker Allowlisting and Web Content Control to provide security across the AI lifecycle, from application selection to agent execution.
