Thales Launches New AI Agent Security Governance and Autonomous WAAP Capabilities

At Thales' recent AI Security Innovations Newsroom, three security leaders shared the latest developments in AI Agent governance, autonomous WAAP, and attack-defense countermeasures. The overall signal was clear: when AI Agents begin making decisions on behalf of humans, initiating API calls, and reading/writing data within enterprises, traditional security boundaries are no longer sufficient — new control planes must be used to constrain every action of the Agent.

AI Agent Governance: Installing a "Circuit Breaker" for Autonomous Decision-Making

Ward Dusham, Technical Director of AI Cybersecurity Products at Thales, used a claims scenario to explain the core logic of Agent governance. Insurance customer Asha submits a glasses reimbursement request through the App, and the claims specialist grants the AI Agent permission to process the queue. The Agent automatically completes the reimbursement, but in another application, it independently determines that the same user has submitted a duplicate and decides to delete the customer record. Corporate policy explicitly prohibits Agents from deleting customer data, and the system intercepts this call before the Agent executes the deletion action.

The key issue exposed by this scenario is not whether the Agent will make mistakes, but whether the enterprise can intervene before the Agent makes a mistake. Thales' solution is to introduce an AI security control plane, placing itself at the center of all data flows between the Agent and LLMs, MCP servers, and data sources, thereby governing and intercepting every interaction.

In the product interface Ward demonstrated, each Agent interaction is presented as a "call chain," showing the complete request-response timeline between the Agent and LLM, MCP services. The allowed "create claim" call passes normally, while the link attempting to delete the member is highlighted in red and blocked. Three types of configurations support this mechanism: the Agent registry (containing identity and credentials), the letter of authorization (limiting the maximum amount per claim), and policies. Policies can be generated from natural language prompts, which the system translates into deterministic rules that are enforced during every Agent interaction.

Three Main Lines: Observe, Protect, Control

Ward breaks Agent governance into three main lines: observing Agent behavior to ensure continuous visibility into Agent activity across the enterprise; protecting Agent interactions with data, identity, and business processes to defend against business logic attacks; and the control layer, which analyzes and enforces policies in real time to ensure AI systems comply with business rules. Together, these three lines aim to enable enterprises to safely scale their "Agent workforce."

Specific capabilities include: preventing data exposure (intercepting malicious traffic, runtime data classification and encryption), controlling intent drift (deterministic policies plus non-deterministic heuristic policies), and audit forensics (proving the Agent's reasoning process and control measures to auditors). Ward revealed that these capabilities have entered early access and Beta testing, inviting enterprises to validate them together.

The MCP (Model Context Protocol) repeatedly mentioned in the text is key to understanding the entire governance logic. It is a protocol proposed and open-sourced by Anthropic at the end of 2024, with the goal of standardizing the way LLMs call external tools and data sources: models no longer need to write adapter code for each tool individually, but instead discover tools through a unified MCP server, read their definitions, and initiate calls according to the convention. It can be compared to a "USB-C interface for the AI world."

For security teams, MCP brings both convenience and new attack surfaces: once an MCP server is poisoned or impersonated, the Agent may be induced to call unintended tools; the tool definitions themselves may also be tampered with, enabling "tool poisoning" attacks. This is precisely why Thales places itself between the Agent and MCP servers and validates tool definitions and parameters one by one — the governance point must be at the protocol layer, not merely at both ends of model input and output.

Autonomous WAAP: Fighting AI Attacks at Machine Speed

Thales Field CTO Nadav Avital took up another topic: when attackers are already using frontier AI models, defenders relying on human waves will inevitably fail. He listed new capabilities on the attack side: autonomous discovery of zero-day vulnerabilities, weaponization of N-day vulnerabilities, evasion of existing security controls, generation of new attack tools using natural language, imitation of human behavior, and large-scale automated operations.

On the three dimensions of time, scale, and dynamism, human analysts cannot match: AI attacks operate at millisecond speed, a single model can launch attack attempts against tens of thousands of targets simultaneously, and traditional rule-based systems cannot adapt to AI-generated polymorphic payloads.

Therefore, Nadav gave a definition of autonomous WAAP: a protection solution that understands, reasons about, and adapts to each application context at machine speed, while being constrained by human-set guardrails. It is not a single detection engine, but a three-layer structure.

Layer 1: Unified Security Engine Cluster

The core is a unified security engine that centralizes intelligence and policies for WAF, API security, advanced Bot protection, DDoS mitigation, and AI application security. It relies on multiple specialized engines working together: the Agent guardrail engine ensures Agents operate within approved identities, permissions, workflows, and data boundaries, detecting prompt injection, excessive autonomy, abnormal tool chains, and sensitive data exposure; the MCP protection engine discovers and monitors MCP servers, tools, and interactions, validating identity, tool definitions, authorization, and parameters, and blocking unauthorized execution; the intent detection engine determines the true goal behind each interaction, distinguishing legitimate delegation behavior from crawling, abuse, account takeover, or manipulated Agent behavior; the AI Bot and Agent trust control engine identifies human, Bot, browser, and Agent traffic, verifying Agent identity, reputation, and user delegation relationships.

WAAP (Web Application and API Protection) is an umbrella term for integrating WAF, API security, Bot management, DDoS mitigation, and other capabilities into a single platform, replacing the previously siloed point devices. Traditional WAAP policies mainly rely on manual rule configuration, and cannot keep up with the update speed needed to counter AI-generated polymorphic payloads and frequently morphing attack traffic.

The word "autonomous" in "autonomous WAAP" lands exactly here: protection policies can reason, judge, and adjust on their own based on context, without waiting for analysts to manually change rules. The difference between it and "automated WAAP" is that automation merely executes predefined actions, while autonomy must be able to make decisions without explicit instructions — and therefore must be paired with human-set guardrails to prevent the protection system itself from going out of control.

Layer 2: Unifying the Operations Entry Point with MCP Servers

Thales encapsulates AppSec capabilities into tools that can be invoked by AI, providing a unified integration point for all application security workflows through an MCP server. This allows Agents and automated processes to execute operations on their own, reducing repetitive work for human analysts.

Layer 3: AI Threat Intelligence and Self-Improving WAF

This part has the highest capability density. N-day vulnerability protection is essentially a virtual patch at machine speed: an end-to-end Agent workflow tracks newly disclosed vulnerabilities within minutes, triages by severity and relevance, verifies vulnerability authenticity and exploit validity, develops and validates its own exploit when none exists, generates detection rules and evaluates false positives, and finally rolls them out to customers in a canary release. Nadav specifically mentioned that this technology is applying for a patent.

The self-improving WAF adopts a red-blue confrontation approach: red team Agents continuously generate thousands of attack variants and evasion techniques, and once an effective bypass is found, blue team Agents generate new defenses, repeating the cycle until the system is hardened to a threshold where the red team struggles to break through.

The New Normal of Attack and Defense: Protecting "From AI, With AI, Against AI"

Pal Balint, Chief Solutions Officer EMEA at Thales, brought the topic back to the defender's perspective. He emphasized that AI today plays three roles simultaneously: attacker, target, and defender. The most obvious change is not the form of the threat, but the speed of the threat.

Pal listed the most common current risks: the scale, linguistic complexity, and methodology of phishing attacks are all escalating, and multimodal models have brought speech synthesis and recognition to a new level. He recommends adopting phishing-resistant MFA and regularly conducting red-blue testing of employees and processes.

The dramatic shortening of the exploitation window is another key change. Pal cited the latest OWASP research pointing out that zero-day exploitation has returned to the top of malicious takeover methods. When almost all platforms offer some kind of WAF capability, a few percentage points of effectiveness difference can have a huge impact.

AI Assets Themselves Are an Attack Surface

Pal pointed out that many enterprises struggle to push LLMs or Agentic AI into production, and the root cause is their inability to converge the attack surface exposed by these systems. He listed the risk points one by one:

• User prompts face direct and indirect prompt injection; any content fed into an AI system should be treated as untrusted, including search results and web content.
• Agentic retrieval (RAG, multimodal RAG, Graph RAG) may encounter echo-like attacks: malicious payloads hidden in search result responses drive the AI system to perform malicious operations on behalf of the attacker.
• Tool connectors become attack targets, with attackers attempting to trick MCP or Agent collections into performing unintended actions on their behalf.
• Model outputs may be contaminated by hallucinations, and worse, may carry malicious payloads. Some victims directly copy generated content into code, emails, or applications, creating new attack vectors.
• Agent identities must be configured individually, authorized on demand, and revoked promptly.
• Supply chain attacks are returning; externally introduced AI Agents may be compromised upstream and move laterally.
• Shadow AI is becoming a nightmare for security operations, as third-party or web tools used by employees may be continuously leaking data.

Pal's defense recommendations can be summarized in a few points: treat model outputs as untrusted content; always separate trusted and untrusted contexts; preserve human approval steps as much as possible; assign each AI Agent an independent identity and short-lived credentials with regular rotation; establish a complete audit trail for Agents; and build an "emergency stop switch" into all Agent systems.

The RAG (Retrieval-Augmented Generation) mentioned in the text is currently the most common architecture for enterprises implementing LLMs: before answering, the model first retrieves relevant content from knowledge bases, search results, or web pages, and then stitches this content into the prompt for the model. It greatly improves answer quality, but also sends "untrusted input" directly into the model's context window.

The so-called "echo-like attack" is a typical weakness of this architecture: attackers disguise malicious instructions as fragments of retrieval results, and the model, upon reading them, mistakes them for instructions and proceeds to perform deletions, data exfiltration, and other operations. Graph RAG and multimodal RAG merely extend the retrieval targets to knowledge graphs and images/audio, without changing the risk pattern. This is also the fundamental reason Pal repeatedly emphasizes "treat model outputs as untrusted content" and "always separate trusted and untrusted contexts" — under the RAG architecture, the boundary of input is the boundary of trust.

Governance Framework and Implementation Pace

On the governance and compliance level, Pal recommends the OWASP LLM and Agentic AI guidelines to identify common attack surfaces, and mentions the EU AI Act (described as taking effect in December 2027) as a tool for classifying AI systems.

Regarding the implementation pace of Agentic AI in security operations, his recommendation is phased: first let it provide action suggestions only in a layered mode, then act on its behalf under human approval, and only after sufficient maturity grant it a certain degree of autonomy. This pace is consistent with the "letter of authorization + policy constraints" approach demonstrated by Ward.

The OWASP LLM Top 10 and Agentic AI guidelines cited by Pal are currently the most widely referenced AI security risk lists in the industry. The LLM Top 10 focuses on model-layer risks such as prompt injection, insecure output handling, training data poisoning, and model denial of service; the Agentic AI guidelines expand the scope to multi-step autonomous behavior, covering tool abuse, permission sprawl, memory poisoning, and inter-Agent communication hijacking — risks closer to those of an "autonomous entity."

Together with the EU AI Act he mentions, the two form a complement: OWASP provides a technical list of attack surfaces, and the EU AI Act provides a compliance framework for classifying systems by risk level. In practice, enterprises usually use the OWASP list first for self-assessment and threat modeling, and then determine the required documentation, auditing, and level of human oversight according to the EU AI Act's risk classification.

What the Three Talks Together Show

Ward talked about how to draw enforceable, auditable boundaries for Agents within the enterprise; Nadav talked about how, once attackers have become AI-powered, defense tools must first hold their ground at machine speed; Pal talked about the priorities defenders should use to converge the exposure surface of AI assets. All three point to the same judgment: AI security is no longer about adding a filter layer to the model, but about establishing an enforceable governance structure at every link of identity, permissions, data flows, business logic, and operational processes.

Currently, Thales' Agent governance capabilities have entered early access, and the virtual patching and self-improving mechanisms of autonomous WAAP have also entered the productization stage. For enterprises that are pushing Agents into production environments, this approach is worth using as a reference for security architecture design.