AI security glossary

Plain definitions of the terms that come up when securing enterprise AI, AI agents, and MCP toolchains.

Agent Detection & Response (ADR)

The practice of detecting and responding to threats from AI agents at runtime. ADR discovers agents, watches the actions they take (tool and MCP calls, identity usage, data access), and can block, sanitise, throttle, or terminate a malicious action inline, the way Endpoint Detection & Response does for devices. It focuses on what an agent does, not only what it says.

MCP security

Securing the Model Context Protocol: the servers, tools, and transports that agents use to reach external systems. MCP security covers credential handling, transport encryption, tool poisoning, over-broad tool scopes, and malicious or spoofed servers, and is commonly framed by the OWASP MCP Top 10.

Shadow AI

AI tools and agents used inside an organization without security's knowledge or approval: personal ChatGPT accounts, unsanctioned coding assistants, local models, and self-serve SaaS agents. Shadow AI creates data-exposure and compliance risk because it operates outside monitored, governed channels.

Prompt injection

An attack that hides instructions in content an AI model or agent will read (a document, a web page, a tool result) to hijack its behaviour. Indirect prompt injection rides on retrieved or third-party data. The dangerous part is usually the downstream action the injected instruction triggers, such as exfiltrating data or misusing a tool.

Jailbreak

A prompt technique that bypasses a model's safety or policy guardrails to make it produce restricted output or take restricted actions. Jailbreaks are often combined with obfuscation such as base64, leetspeak, or homoglyphs to evade simple filters.

Agentic threats

Threats specific to autonomous agents rather than single prompts: goal hijacking, tool and function misuse, privilege escalation across agent-to-agent handoffs, cascading multi-agent failures, memory or context poisoning, and rogue or runaway agents. The OWASP Agentic Top 10 catalogs these.

AI Bill of Materials (AIBOM)

A structured inventory of the AI components in a system: models, agents, datasets, and their provenance, versions, and risks. Wingback generates a CycloneDX 1.6 AIBOM per model and agent so the AI supply chain is documented and exportable.

AI red teaming

Adversarial testing of AI systems (models, agents, and RAG pipelines) to find vulnerabilities before attackers do. Modern AI red teaming uses an adaptive, LLM-driven attacker that adjusts its approach across many techniques and maps findings to frameworks such as the OWASP LLM/Agentic Top 10 and MITRE ATLAS.

Runtime AI defense

Protecting AI systems while they run, inline, rather than only scanning code or configuration beforehand. Runtime defense inspects live prompts, completions, tool calls, and agent behaviour and can act on them in real time.

Inference security

Securing the path a request takes through a model provider or inference endpoint: applying policy to every prompt and completion, protecting against injection and data leakage, and controlling which models and providers an agent may use and under what conditions.

AI gateway

A proxy that sits inline between applications and model providers, applying a single security and governance policy to every prompt and completion: guardrails, PII and secret handling, provider allowlists, usage and cost controls, and audit logging.

Tool poisoning

An attack in which a tool or MCP server (its description, schema, or output) is crafted to manipulate an agent into taking harmful actions, such as leaking credentials or calling a dangerous tool. It is a supply-chain risk specific to agentic systems.