Gurucul connects AI activity to identity data for faster threat response

Gurucul has announced the general availability of Gurucul AI Risk and Response, bringing behavioral AI to the growing attack surface created as AI moves from assistant to actor. With hundreds of AI detections connecting activity to identity, access, data and broader security telemetry, the solution helps SOC and Insider Risk teams see who or what is acting, recognize threats as they develop, investigate the evidence and respond before risk escalates.

AI Prevention, now available in preview, adds controls designed to stop selected high-risk AI interactions at the point of use. Gurucul is also offering organizations an AI Risk Assessment and Report on real data, at no cost.

Recent incidents involving AI systems interacting with real-world environments, including the compromise of Hugging Face systems by rogue OpenAI agents, have highlighted how autonomous AI behavior has security consequences beyond traditional prompts and chatbot interactions.

At the same time, Anthropic’s latest threat intelligence report documents increasingly sophisticated cyber operations using Claude, including autonomous agents conducting reconnaissance, exploitation and data theft with limited human involvement. As AI systems such as Google Gemini become increasingly capable of interacting directly with computers and executing complex tasks, security teams need to understand not only what AI is asked to do, but also what it’s actually doing, what it can access and how its behavior connects to the rest of the ecosystem.

Gurucul AI Risk and Response addresses this emerging need by bringing AI activity into the full security context surrounding it: who or what initiated it, which identity and privileges were used, what data and systems were reached, and how behavior changed over time. Built on more than a decade of behavioral AI, it analyzes users and autonomous agents as persistent entities to reveal shadow AI, excessive access and emerging behavioral risk.

Security teams get an evidence-backed view of what happened, why it matters and how to respond, leveraging playbooks and existing controls. AI Risk and Response helps teams find risky behavior early and stop it before it escalates.

With AI Risk and Response’s prevention capabilities now in preview, organizations gain an additional layer of protection by identifying and stopping risky AI activity at the source. The solution builds on Gurucul’s market-leading security information and event management (SIEM), user entity behavior analytics (UEBA) and AI insider risk management (AI-IRM) capabilities to detect, investigate and respond to AI-related risk in real time.

Unlike standalone AI gateways and other point solutions, Gurucul AI Risk and Response provides a broader behavioral view of AI risk across the enterprise. It combines AI-platform data with existing proxy, endpoint detection and response (EDR), identity, operating system and cloud telemetry, giving security teams a connected view of AI activity and its broader security context.

By applying behavioral AI to this connected context, along with hundreds of detections mapped to all 16 MITRE ATLAS tactics and the OWASP Top 10 for LLM Applications, Gurucul enables security teams to detect, investigate and respond to AI-related risk with machine-speed analysis across the enterprise.

For managed security service providers (MSSPs), protecting customers from AI risk requires more than visibility into AI usage. They need evidence-rich findings that can be deployed quickly across diverse customer environments and acted on without adding operational complexity.

Jay Martin, CISO and VP of Cybersecurity at Blue Mantis, said: “Our customers need to understand not only where AI is being used, but when that use creates risk to sensitive information and critical systems. Gurucul AI Risk and Response can be enabled quickly using telemetry already available in the customer environment, providing rapid visibility without custom engineering or additional endpoint agents.

The solution identifies sensitive, non-public information being shared with unapproved generative AI services and correlates that activity with the user and endpoint behavior our analysts need to investigate. This reduces implementation time, operational overhead and cost while enabling our Security Operations team to respond more quickly with minimal disruption to customer environments.

For an MSSP like Blue Mantis, the difference between seeing AI activity and having the context and evidence behind it is the difference between forwarding another alert and helping a customer understand and address real risk.”

Gurucul AI Risk and Response lets security teams:

• Reveal AI activity and exposure using data already available. AI data pipelines ingest and normalize activity from leading AI platforms, including Anthropic Claude AI, Gemini Enterprise Agent Platform, Google Gemini, OpenAI ChatGPT, Azure AI Foundry Inventory, and Microsoft 365 Copilot, alongside existing proxy, EDR, identity, operating system and cloud telemetry. Organizations can identify sanctioned and unsanctioned AI use, build an inventory of agents, models, tools and hosts, and connect that activity to owners, permissions and accessible resources. Teams can begin with data they already collect and add direct AI platform integrations for deeper prompt, agent and audit context.
• Detect and prioritize known threats and emerging AI risk. Behavioral AI and deterministic detection logic work together to identify Shadow AI, sensitive data exposure, risky autonomous agents, excessive access, AI supply-chain risk and changes in behavior that fixed rules may miss. Hundreds of detections span five AI security families, with coverage mapped across all 16 MITRE ATLAS tactics and the OWASP Top 10 for LLM Applications. Unified Entity Intelligence combines those findings into an active risk score backed by the evidence that drove it.
• Turn AI alerts into identity-resolved investigations. Connect AI activity to the human or non-human identity behind it, along with the systems, tools, data and relationships involved. Analysts can see what changed, how the activity compares with the entity’s history and peers, what the AI can access and how separate events combine into a developing risk. The AI Security Overview, Agent Workspace and Graph Explorer provide a direct path from an initial finding to the affected entities, related activity and underlying evidence.
• Respond through controls and workflows already in place. Automated and approval-gated playbooks help teams contain risk through connected identity, endpoint, network and supported AI-platform controls. AI-assisted recommendations give analysts clear response options while keeping them responsible for consequential actions. Integration with enterprise ITSM routes and tracks remediation through established security and IT processes, eliminating the need for a separate response workflow for AI.
• Prevent selected high-risk AI activity at the point of interaction. Automated controls identify and stop supported high-risk AI interactions before they escalate. A lightweight browser plug-in provides an additional point of control for prompts, pasted content, readable file uploads and AI destinations, helping organizations apply policy where AI activity occurs while keeping analysts in control of enforcement decisions and exceptions.

As the latest advances in AI have proven, tackling AI Risk now is more important than ever. “As AI moves from generating answers to taking action, risk no longer lives within a single prompt or application. It develops across identities, permissions, data, tools and actions over time. Insider and SecOps teams need to connect those signals to understand what changed, why it matters and where the risk is headed,” said Saryu Nayyar, CEO of Gurucul.

“Gurucul AI Risk and Response applies behavioral AI, entity intelligence and evidence-backed risk scoring to put AI activity in the context of the broader security environment. This gives analysts a clear, actionable view of developing threats and the control to address them early through the workflows and processes they already use. With runtime prevention now in preview, we are taking the next step: stopping high-risk AI behavior at machine speed at the source,” Nayyar concluded.