Most organizations treating AI security as a model problem are defending the wrong layer. Security teams filter prompts, patch jailbreaks, and tune model behavior, which is all necessary work, while the actual attack surface sits largely unexamined underneath. That surface is the API layer: the endpoints AI systems use to retrieve data, call tools, and take action on behalf of users. This isn't a theoretical gap.

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster. Request a Demo Rick Bosworth is a cybersecurity marketing executive with nearly two decades of experience driving GTM strategy across technology startups. His uniquely technical perspective bridges the gap between complex solutions and practical customer outcomes. Rick has deep expertise spanning EDR, CNAPP, CWPP, AppSec, CTEM, and agentic SecOps.

AI agents create data exfiltration risk by combining three capabilities that are dangerous together: access to private data, exposure to untrusted content, and the ability to communicate externally. When all three exist in one agent, an attacker can hide instructions inside an email, document, or webpage the agent processes and trick it into sending sensitive data out. No software vulnerability is required. The attacker doesn't need to break in. They just need to talk to your agent.

On April 28, 2025, a massive power outage affected large areas of the Iberian Peninsula and parts of southern France. Traffic lights, elevators, point-of-sale systems, and many mobile phone and internet networks suddenly stopped functioning. Subways and parts of the rail network ground to a halt. Industrial production and numerous service businesses were interrupted for several hours to a full day.

Red Team Penetration Testing is a simulated cyberattack that mimics real-world threat behavior to identify vulnerabilities, test defenses, and evaluate how effectively an organization can detect and respond to an attack. It goes beyond traditional testing by focusing on how an attacker would actually move through an environment.

You can easily split the room in half if you mention autonomous pentesting in a room full of security professionals. One-half will argue it’s the most important shift in offensive security to date, capable of solving the challenge of monitoring attack surface expansion faster than any manual pentester can prove it secure. The other half will push back hard.