Sysdig Introduces Runtime Security and Governance for AI Agents
Sysdig has launched Sysdig AI Defense, a new platform designed to provide runtime security and governance for autonomous AI agents, addressing the growing risks associated with their increasing capabilities.
The rapid evolution of AI agents, moving from simple chatbots to autonomous actors capable of performing complex tasks like shipping code and modifying infrastructure, presents significant new security challenges. Sysdig has responded to this emerging threat landscape with the introduction of Sysdig AI Defense, a platform aimed at providing crucial runtime security and governance for these increasingly powerful AI agents.
"AI is moving from answering to acting. It used to be chat machines. Now agentic AI does stuff for us," explained Loris Degioanni, Sysdig founder and CTO. The core problem, he noted, is that these agents can operate beyond human oversight, acting faster than they can be controlled and lacking inherent moral or ethical constraints. This autonomy, while beneficial for productivity, dramatically increases the potential for unintended errors and malicious actions.
Sysdig AI Defense leverages the company's established runtime visibility capabilities to monitor and govern AI agent operations. The platform tracks every action an agent takes from its inception to its completion, providing deep visibility that extends to the operating system kernel level. This is critical because agents can rapidly acquire new permissions or modify their behavior in ways that might not be apparent from higher-level logs alone. As Sysdig warns, "The agent deployed in the morning isn’t always the one running in the afternoon," underscoring the need for kernel-level insights.
To address the need for immediate intervention, Sysdig AI Defense operates at runtime, enabling rapid, in-line blocking responses before an action can be fully executed. "There is a need for solutions that operate at runtime, can operate extremely quickly, and can include response," Degioanni stated. "For example, any blocking response must happen in real time, in line, as the action happens and before the action completes." This real-time capability is essential for preventing potentially catastrophic actions by rogue or misbehaving AI agents.
The platform provides a live inventory of all AI agents, their associated harnesses, models, skills, and plugins, all derived from runtime telemetry. A key feature is the ability to trace each agent back to an accountable human, ensuring clear lines of responsibility. Risky agentic actions can be detected, flagged for human review, or blocked entirely before they can cause harm. Sysdig also offers policy templates pre-configured with rules mapped to frameworks like the OWASP Top 10 for LLM Applications, allowing organizations to start in alert mode and gradually move to enforcement.
Sysdig AI Defense creates audit-quality, immutable records of agent actions, pairing the agent's reported activities with its actual system interactions. This detailed logging, presented in a live action graph, shows what an agent claimed to do versus what it actually did, its potential reach, and under whose authority it acted. This provides a comprehensive and trustworthy audit trail, crucial for compliance and incident investigation.
This development aligns with broader industry concerns about AI agent governance. A report by the IBM Institute for Business Value highlighted that as AI agents move into production, manual governance cannot keep pace with the sheer volume of autonomous decisions being made daily. With enterprises expecting to deploy an average of 1,661 AI agents by 2027, the need for automated, runtime security solutions like Sysdig AI Defense becomes increasingly apparent.