Sysdig Launches AI Defense to Govern Agent Actions From Endpoint to Cloud

PUBLISHER ARTICLE PREVIEW

From the original article

Sysdig has launched AI Defense, a runtime security and governance product designed to inspect what AI agents do and intervene when their actions exceed an organization’s policies. The November 4 announcement makes the product generally available for macOS and Windows, with visibility intended to connect activity on employee workstations to the cloud resources their credentials can reach.

The product addresses the shift from AI that produces answers to AI that operates software. A coding agent can read files, invoke tools, start processes and change infrastructure. Securing that workflow requires understanding both the task the agent believes it is performing and the operations actually occurring underneath it.

Sysdig says AI Defense combines instrumentation inside an agent’s harness—the framework that runs it—with operating-system telemetry. Harness instrumentation captures calls to tools, Model Context Protocol servers, skills and plugins, including their arguments and targets. System-level observation provides a separate record of the processes and activity those calls produce.

The distinction matters when an agent’s account is incomplete or compromised. One reported tool action can start several processes, and a connection or skill added during a session can change what the agent is capable of doing. Sysdig reports an early observation of roughly seven underlying processes for each action in agent logs; that is a company finding, rather than a universal ratio for all agents.

The system also considers authority: the same file-reading operation can carry different consequences depending on whether the credential involved reaches a test environment or administers production. An action graph is intended to connect the sequence of events, the accountable person, the agent’s stated activity and the resources within reach.