Agentic-Ai-Runtime-Governance-And-Control-Points
Sources: 1 • Confidence: Medium • Updated: 2026-03-28 03:34
Key takeaways
- Ian Swanson asserted that Prisma AIRS v3 shifts focus from securing AI applications and models to securing the broader agentic enterprise.
- Rich Campagna asserted that CA/Browser Forum actions include a March 2026 reduction in maximum certificate lifetime from roughly 398 days to 200 days, with further reductions planned.
- Ian Swanson asserted that attackers are increasingly targeting AI supply chains by poisoning critical AI assets as AI adoption expands.
- Ian Swanson asserted that Prisma AIRS v3 continuously assesses agent risk and can scan agentic artifacts such as MCP servers, agents, and skills for inherent risk including malicious code.
- Ian Swanson asserted that Prisma AIRS v3 uses a runtime gateway to funnel agentic traffic for inline inspection and dynamic policy enforcement to prevent rogue agent behavior in real time.
Sections
Agentic-Ai-Runtime-Governance-And-Control-Points
- Ian Swanson asserted that Prisma AIRS v3 shifts focus from securing AI applications and models to securing the broader agentic enterprise.
- Ian Swanson asserted that Prisma AIRS v3 continuously assesses agent risk and can scan agentic artifacts such as MCP servers, agents, and skills for inherent risk including malicious code.
- Ian Swanson asserted that Prisma AIRS v3 uses a runtime gateway to funnel agentic traffic for inline inspection and dynamic policy enforcement to prevent rogue agent behavior in real time.
- Ian Swanson asserted that Prisma AIRS evolved from runtime AI traffic detections (1.0) to adding model artifact scanning and behavioral testing via Protect AI capabilities (2.0) and then to securing agentic AI that can act autonomously (3.0).
- Ian Swanson asserted that Palo Alto Networks positions Prisma AIRS as an end-to-end AI security platform spanning shift-left asset and supply-chain security through runtime protections for AI traffic.
- Ian Swanson asserted that Prisma AIRS is delivered as a managed offering because AI security workflows rely on AI and GPU-intensive infrastructure that many customers prefer not to operate.
Certificate-Lifetime-Compression-And-Automation
- Rich Campagna asserted that CA/Browser Forum actions include a March 2026 reduction in maximum certificate lifetime from roughly 398 days to 200 days, with further reductions planned.
- Rich Campagna asserted that NGTS supports the ACME protocol (v1 and v2) for automated certificate management workflows.
- Rich Campagna asserted that organizations that do not move from manual to automated certificate processes are likely to experience service outages as certificate validity windows shrink.
- Rich Campagna asserted that NextGen Trust Security (NGTS) is a certificate lifecycle management automation product that works with certificate authorities rather than acting as a standalone CA.
- Rich Campagna asserted that NGTS combines certificate lifecycle automation with Palo Alto Networks firewall and SASE visibility to identify unmanaged, expiring/expired, or non-compliant certificates and automate remediation.
- Rich Campagna asserted that NGTS is primarily offered as a cloud-based service using existing Palo Alto Networks security products as sensors, with a fully on-premises option for customers who require it.
Ai-Supply-Chain-Security-For-Models-Agents-And-Skills
- Ian Swanson asserted that attackers are increasingly targeting AI supply chains by poisoning critical AI assets as AI adoption expands.
- Ian Swanson asserted that serialized AI models can conceal unsafe or malicious content that only becomes apparent during deserialization in training or production.
- Ian Swanson asserted that zero-trust security practices should be applied to AI artifacts similarly to how they have been applied to traditional software.
- Ian Swanson asserted that AI supply-chain components include models, agents, and skills, and that serialized models can conceal malicious code that traditional security tools may miss.
- Ian Swanson asserted that Prisma AIRS includes AI supply-chain scanning for artifacts such as models, MCP servers, agents, and skills, and that a malicious serialized model could exfiltrate AWS credentials while still performing its advertised function.
Watchlist
- Ian Swanson asserted that attackers are increasingly targeting AI supply chains by poisoning critical AI assets as AI adoption expands.
Unknowns
- What specific CA/Browser Forum ballot(s) and browser vendor enforcement milestones substantiate the March 2026 (200-day) and projected 2029 (47-day) certificate validity limits?
- What are the observed (not hypothesized) outage rates and incident root causes attributable to certificate expiration under shortened validity windows in comparable enterprises?
- How complete is network-traffic-based certificate discovery for identifying certificates that matter operationally (including certificates not visible on monitored network paths)?
- What concrete, testable criteria and artifact formats are covered by the claimed AI supply-chain scanning (models, MCP servers, agents, skills), and what false-positive/false-negative rates are achieved?
- What is the precise threat model for serialized-model malicious behavior described (e.g., where execution occurs and what conditions enable credential exfiltration), and what mitigations are recommended besides scanning?