About Lasso Security
Lasso Security sells an AI Security Platform that covers discovery, AI risk assessment and runtime protection. Lasso Security offers protection for every AI agent an organization builds and deploys, wherever it runs. Lasso Security secures autonomous AI agents, LLM applications and agentic workflows from build-time through runtime. Lasso Security states that decentralized ownership has led to Shadow AI across the enterprise. Lasso Security states that security teams have zero visibility into the AI tools and agents that employees are using and creating. Lasso Security states that everyone from HR to Marketing is now using or building agents.[1][4][5][6]
Lasso discovers every agent and AI application across an environment, consolidates them into a single inventory and assesses risk across the agentic ecosystem. Lasso inventories AI components including models, MCP servers, delegated agents, databases, third-party tool connectors, identity boundaries and authorization policies. Lasso connects through native integrations with CI platforms and low code no code agent builder platforms such as Amazon Bedrock, Azure AI Foundry, Microsoft Copilot Studio, Google Vertex AI and Salesforce Agentforce. Lasso uses an agentless, read-only integration into CI pipelines and native integrations with cloud providers and third-party agent builder tools.[4][5]
For posture management, Lasso visualizes how every agent is built, what is exploitable and how to fix it before the agent reaches production. Lasso posture coverage spans OWASP, MITRE, NIST, the EU AI Act and internal policies. Lasso identifies misconfigurations, risky tool access, weak guardrails, exposed dependencies and potential attack paths. Lasso assesses agentic architecture for compliance and governance requirements, including NIST, the EU AI Act and company-specific AI policies.[7]
Lasso identifies exploitable vulnerabilities through high-agency adversarial testing and auto-updates policies with purple teaming. Lasso integrates with a CI/CD pipeline so red teaming simulations can run automatically on every application update. Before an attack runs, Lasso performs optional reconnaissance to map the profile of the application. The Lasso agentic attack engine runs multi-turn adversarial simulations that evolve across conversation turns. Lasso red teaming runs from the Lasso tenant, with no agents, no code changes and no source code access.[1][4][8]
Lasso enforces policies inline at the proxy, API or AI Gateway layer. Lasso detects and terminates AI threats across an environment, with coverage including MITRE and OWASP. Lasso monitors every interaction across the AI stack, from tool calls and RAG retrievals to sub-agent communications. Lasso enforces predefined and custom security policies inline before agent actions execute. Lasso builds a behavioral baseline for every AI user and agent in an environment. Lasso flags deviations from the behavioral baseline in real time, including novel attack techniques with no existing signature. Lasso runs as a lightweight layer alongside an existing stack with no architectural changes required. Lasso shows alerts and audit logs directly in Lasso or streams findings into a SIEM alongside other security telemetry.[1][4][9]
Lasso's Intent Deputy secures AI agents with real-time intent analysis. Lasso takes action according to a security threshold, either blocking the request or sending an alert. Lasso decodes the semantic meaning behind every request to detect hidden malicious commands behind techniques like obfuscation, adversarial embeddings and payload splitting. Lasso uses an 8-dimensional coordinate system to provide human-readable evidence for legal and risk teams.[10]
Lasso enables enterprises to use AI across every department, from SaaS and web chatbots to local desktop agents and MCPs. Lasso discovers, inventories and assesses every AI asset across an enterprise, from models to SaaS and web chatbots to local desktop agents or homegrown agents and their connected tools. Lasso detects in real time whether PII, PCI or other sensitive data is shared in prompts or file uploads, and masks that content before the prompt is sent to third-party models. Lasso limits which AI agents are available to certain roles and restricts high-risk actions based on clearance levels. Lasso maps policies to NIST, OWASP and MITRE using plug-and-play templates, or enforces internal rules with custom policies.[6]
Lasso Security governs the lifecycle of AI agents from build-time to runtime for agents built on Vertex AI, Microsoft Copilot, AWS Bedrock, Salesforce Agentforce or any other cloud or third-party service. Lasso gives risk scores that highlight which agents require immediate attention. Lasso maps agents and their connections to third-party tools, databases and internal services to identify potential attack paths. Lasso applies real-time guardrails at the moment of interaction that block malicious inputs, sanitize outputs and enforce content policies.[8][11][12][13]
Lasso Security on the record