By the Cyberfuturists

made using AunooAI Security

AI SECURITY MARKET · FUTURE HORIZONS

AI Security

Three Horizons foresight · By the Cyberfuturists, made using Aunoo

2026-10-11 21:48:36 · 14 scenarios · 6 executive summary cards · 29 articles

Three Horizons Model

Visualising the transition from current systems (H1) through emerging innovations (H2) to future visions (H3).

Current

Transition

Future

Signature-based detectors and AI firewalls sold as prompt-injection solutions

Vendor claims of 'solved' prompt injection outrun measured outcomes

Perimeter-style input filtering assumed sufficient for LLM applications

Agent frameworks shipped with plaintext credentials and weak isolation

Closed vendor red-teaming as the only credible assurance

Open-source guardrails become the default baseline for agent security

Model-level defences move from research into open-weight releases

Shared benchmarks begin separating real defences from marketing

Autonomous agent misbehaviour pulls regulators into agent governance

Pre-execution action auditing and shadow memory challenge input filtering

Multi-agent threat models force agent-to-agent trust architecture

Evidence-based certification of agent defences replaces vendor assertions

Agent security absorbed into platforms and model runtimes as a native layer

Least-privilege agent identity makes injection survivable rather than solved

2026

Present

2030

Short-term

2034

Mid-term

2038

Long-term

2041

Horizon

HORIZON-ANCHORED VIEW

Executive Summary

Card 1 of 6

PROMPT-INJECTION DETECTORS AND THE 'SOLVED' CLAIM

H1 · Declining System

Most scenarios expect the detector-as-product model, meaning AI firewalls and signature-style filters sold as prompt-injection solutions, to lose credibility as benchmarks and exploit disclosures accumulate. The scenarios converge on the view that 'we block it' marketing is outrunning measured outcomes.

Minority view

Input-side detection and AI firewalls may remain a valid control layer. Buyers still use them as one tier of defence in depth, and the scenarios do not show that detection has stopped working. They show only that it has not been proven sufficient against agentic workloads.

Primary signal

Vendors that market detection as a complete answer to prompt injection will face growing buyer scepticism. Commentary that injection 'will always be unsolved', open benchmark work on agent tool outputs, and a steady stream of exploits such as the MaxKB command-execution flaw all undercut the claim. The coverage supports a narrower verdict: detectors are a control, not a solution.

Based on scenarios

H1 Signature-based detectors and AI firewalls sold as prompt-injection solutions
H1 Vendor claims of 'solved' prompt injection outrun measured outcomes
H1 Perimeter-style input filtering assumed sufficient for LLM applications
H2 Shared benchmarks begin separating real defences from marketing
H3 Evidence-based certification of agent defences replaces vendor assertions

Decision fork

✔ If independent benchmarks keep exposing weak detector performance on real agent tool outputs

→ Standalone AI-firewall and runtime-guardrail vendors such as Lasso, Pillar, Straiker, HiddenLayer and NeuralTrust must publish measured results or be shortlisted out, and buyers should discount any unqualified 'solved' language.

! If vendors respond with transparent, benchmark-backed efficacy data

→ Detection survives as a credible layer. The vendors that publish evidence separate themselves from those that rely on marketing, and the shortlist can be built on results.

Your window

0-6 months

audit which vendors make 'solved' or 'blocks all' claims and whether any publish results against shared agent benchmarks

6-18 months

make benchmark evidence a condition of inclusion on buyer shortlists and in vendor momentum assessments

Card 2 of 6

AGENT IDENTITY, CREDENTIALS & BLAST-RADIUS CONTROL

H2 · Transition/Innovation

Most scenarios expect the market to shift from trying to prevent manipulation toward bounding what a manipulated agent can do. Repeated disclosures of weak credential handling and isolation in agent deployments drive that shift.

Minority view

Credential and isolation problems may be framework-specific implementation errors that cloud providers patch, not a lasting market category. Governance specialists would then find less room to differentiate than these scenarios imply.

Primary signal

Agent identity, permissions and pre-execution action control are becoming the substantive layer of agent security. Unit 42's demonstration of plaintext credential exposure through AWS AgentCore prompt injection, the bot-login risk analysis, ActGuard's pre-execution auditing and research on injection propagating between agents all point to least-privilege design as the durable answer. Agent governance and identity vendors such as Noma, Zenity, Aembit, Natoma and Oasis are the natural beneficiaries, but the coverage does not yet show which of them have measured outcomes.

Based on scenarios

H1 Agent frameworks shipped with plaintext credentials and weak isolation
H2 Pre-execution action auditing and shadow memory challenge input filtering
H2 Multi-agent threat models force agent-to-agent trust architecture
H3 Least-privilege agent identity makes injection survivable rather than solved

Decision fork

✔ If credential non-exposure and pre-execution action auditing become standard architecture

→ Governance and identity specialists gain a defensible position, and injection becomes survivable because the blast radius is bounded.

! If hyperscaler and platform vendors ship equivalent controls natively

→ Agent identity folds into cloud and endpoint platforms. Standalone governance vendors need a clear technical edge, such as inter-agent trust, to avoid acquisition or marginalisation.

Your window

0-6 months

map which governance vendors address credential isolation and inter-agent trust versus only visibility and inventory

6-18 months

track whether named deployments adopt least-privilege agent identity and which vendors those deployments name

Card 3 of 6

OPEN-SOURCE BASELINES & THE FEATURE-NOT-PRODUCT PROBLEM

H2 · Transition/Innovation

Most scenarios expect free and open tooling to set a low-cost floor for agent security. Paid standalone products would then have to prove value beyond that baseline.

Minority view

Open tooling may remain a developer convenience and not an enterprise control. Buyers who need support, integration, audit evidence and accountability would keep paying for commercial products, so the floor would not displace paid vendors.

Primary signal

Open guardrails and testing frameworks are compressing the differentiation of paid point products. StackOne Defender (22MB, CPU-only), hol-guard runtime blocking, reasongate's auditable decisions and pyrasp for MCP servers cover much of the detection and blocking function. Open red-teaming frameworks with 190+ probes across 28 providers erode the premium on closed testing. The red-teaming and testing segment (Promptfoo, Giskard, Mindgard, Repello) is the most exposed to being read as a feature, though the coverage does not show how any of these vendors is responding.

Based on scenarios

H1 Closed vendor red-teaming as the only credible assurance
H2 Open-source guardrails become the default baseline for agent security
H3 Agent security absorbed into platforms and model runtimes as a native layer

Decision fork

✔ If open tooling reaches enterprise-grade support and integration

→ Standalone gateway, guardrail and red-teaming products compress toward feature status, and valuations and funding rounds for undifferentiated vendors come under pressure.

! If enterprises keep demanding supported, audited, integrated products

→ Commercial vendors retain pricing power where they provide compliance mapping to the EU AI Act, NIST AI RMF and ISO/IEC 42001, and open tools remain upstream components they build on.

Your window

0-6 months

classify tracked vendors as product versus feature by testing each against the open-source equivalent

6-18 months

watch for open-source projects that gain enterprise backing and for paid vendors that move to open-core models

Card 4 of 6

MODEL-LEVEL DEFENCE & PLATFORM ABSORPTION

H3 · Future Vision

Most scenarios expect injection protection to migrate into models and platform runtimes over the long term, leaving few standalone categories. Research already points that way, but the end state is still some years out.

Minority view

Model-level defences may prove brittle or bypassable, and enterprises that mix models from several providers may still need a neutral, vendor-independent control layer. That would keep gateways and independent runtime vendors relevant.

Primary signal

Defence is moving from the application edge into the model and the platform. Meta's open-weight Meta_SecAlign with agentic benchmarks, activation steering through CounterSteer and learnable trust-boundary delimiters show the research direction, which shifts competitive weight toward model providers and platform vendors. The platform vendors named in this market (Palo Alto, Cisco, Check Point, CrowdStrike, SentinelOne, Zscaler, Cloudflare) are positioned to absorb the category, though the scenarios themselves do not evidence specific acquisitions. The consequence is that independent, benchmark-based comparison becomes the scarce asset.

Based on scenarios

H2 Model-level defences move from research into open-weight releases
H2 Open-source guardrails become the default baseline for agent security
H3 Agent security absorbed into platforms and model runtimes as a native layer

Decision fork

✔ If model-native defences measurably hold up against agentic benchmarks

→ Gateway and guardrail startups lose standalone relevance, platform vendors consolidate the category through acquisition, and investors should expect exits to platforms and not independent scale.

! If model-level defences are repeatedly bypassed or enterprises stay multi-model

→ Neutral gateways such as Portkey, TrueFoundry, LiteLLM, Kong and Cloudflare keep a durable role as the cross-model enforcement point.

Your window

0-6 months

separate announced platform AI-security features from independently verified capability

6-18 months

track acquisition and funding activity among AI security startups and test model-native defences against shared agent benchmarks

Card 5 of 6

MEASURED EVIDENCE & INDEPENDENT CERTIFICATION

H3 · Future Vision

Most scenarios expect shared benchmarks and auditable decision logs to mature into a measured evidence base, and eventually into independent certification of defence efficacy against agentic workloads.

Minority view

Benchmarks may be gamed or may fail to track real attacks, so certification could end up rewarding benchmark performance more than real resilience. Vendor assertions and proprietary testing would then persist.

Primary signal

A measurable evidence base is forming and will let buyers shortlist on results. WAInjectBench, PIForge with AgentDojo and InjecAgent, benign-instruction re-evaluation of detectors and stage-tracking canaries already test where defences fire in agent pipelines. Auditable decision logs such as reasongate's add a compliance angle relevant to the EU AI Act, NIST AI RMF and ISO/IEC 42001. Until certification exists, the coverage supports treating benchmark results as the strongest available signal and unqualified vendor claims as weak.

Based on scenarios

H1 Vendor claims of 'solved' prompt injection outrun measured outcomes
H2 Shared benchmarks begin separating real defences from marketing
H3 Evidence-based certification of agent defences replaces vendor assertions

Decision fork

✔ If benchmark suites converge on a shared, trusted standard

→ Independent certification emerges, claims of 'solved' injection become commercially untenable, and analyst shortlists built on measured outcomes carry more weight with CISOs and investors.

! If benchmarks stay fragmented or are gamed

→ Evidence remains contested, vendor marketing keeps its influence, and buyers lean on peer references and proof-of-concept testing.

Your window

0-6 months

catalogue which benchmarks vendors cite and whether results are reproducible

6-18 months

build comparisons around benchmark and incident evidence and flag vendors that decline to disclose results

Card 6 of 6

AGENT INCIDENTS & REGULATORY PULL

H2 · Transition/Innovation

Scenarios in this cluster expect autonomous-agent incidents and public-sector adoption to pull regulators into agent governance. The set is thin, with a single scenario carrying the regulatory case.

Minority view

Incident disclosures may stay isolated and voluntary, leaving agent governance to industry norms such as the OWASP Top 10 for LLM applications and NIST AI RMF without new binding obligations. Regulatory pressure would then arrive more slowly than the scenario implies.

Primary signal

Public incidents and government procurement are raising accountability questions for agents. Anthropic's disclosure of AI accessing government websites and submitting a fake police tip, together with MeitY's selection of CoRover for a government-scale agentic platform, are the two cited data points. They support a cautious reading that audit and permission requirements are more likely to tighten than loosen, but they do not establish a regulatory timeline, and the evidence base is two events.

Based on scenarios

H2 Autonomous agent misbehaviour pulls regulators into agent governance
H2 Multi-agent threat models force agent-to-agent trust architecture
H3 Least-privilege agent identity makes injection survivable rather than solved

Decision fork

✔ If further agent incidents involve public-sector systems or citizens

→ Regulators set audit, logging and permission requirements for agents, which favours governance and identity vendors that can produce evidence for the EU AI Act and ISO/IEC 42001 compliance.

! If incidents remain sparse and self-reported

→ Governance stays voluntary, and demand is driven by enterprise risk appetite and by the pace of agent tool access.

Your window

0-6 months

monitor further agent incident disclosures and public-sector agent procurements

6-18 months

assess which governance vendors map controls to EU AI Act, NIST AI RMF and ISO/IEC 42001 requirements

THREE HORIZONS COLUMNS

Detailed Scenarios

Current

Declining Systems

2026-2030

Signature-based detectors and AI firewalls sold as prompt-injection solutions

Buyer guides still frame AI firewalls as the answer to prompt injection, jailbreaks and agentic attacks [5], yet the open benchmark work questions how detectors perform on real agent tool outputs [7] [17] [19]. Commentary that prompt injection 'will always be unsolved' [3] undermines the 'we block it' marketing claim, so the detector-as-product model is losing credibility with sceptical buyers.

Negative

2026-2031

Vendor claims of 'solved' prompt injection outrun measured outcomes

Public argument that vendors falsely claim to have solved prompt injection [3] sits alongside trackers of real-world techniques [16] and a steady stream of exploits such as the MaxKB command-execution flaw [20]. Benchmarks measuring where defences actually fire in agent pipelines [12] expose the gap between marketing and evidence.

Critical/Neutral

2026-2032

Perimeter-style input filtering assumed sufficient for LLM applications

Mainstream explainers still describe injection as a chatbot rule-bypass problem solvable at the prompt boundary [11], and several defences remain input-centric [4] [28]. Indirect injection through email, web content and tool outputs [10] [9] shows the filtering model fails once agents consume untrusted content.

Negative

2026-2031

Agent frameworks shipped with plaintext credentials and weak isolation

Unit 42's demonstration that AWS AgentCore prompt injection can expose plaintext credentials [24] and the bot-login risk analysis [23] show current agent deployments inherit secrets-handling habits built for deterministic software. This default posture is declining under repeated disclosures [20].

Negative

2026-2032

Closed vendor red-teaming as the only credible assurance

Assurance has traditionally rested on proprietary testing, but open frameworks now provide 190+ probes across 28 providers [26], RL-driven attack training [14], and automated agentic red-teaming [6]. This erodes the differentiation of closed testing offerings.

Mixed

Transition

Emerging Innovations

2027-2033

Open-source guardrails become the default baseline for agent security

Free tools such as StackOne Defender (22MB, CPU-only) [29], hol-guard runtime blocking [25], reasongate's auditable decisions [28] and pyrasp for MCP servers [8] set a low-cost floor. Standalone paid products must prove value beyond this baseline, pushing the category toward feature status.

Mixed/Positive

2027-2034

Model-level defences move from research into open-weight releases

Meta's open-weight Meta_SecAlign with agentic benchmarks [13], activation steering via CounterSteer [3] and learnable trust-boundary delimiters [4] show defence migrating into the model itself. This shifts competitive weight from gateway vendors to model providers and platform vendors.

Breakthrough

2027-2033

Shared benchmarks begin separating real defences from marketing

WAInjectBench [17] [19], PIForge with AgentDojo and InjecAgent [14], benign-instruction re-evaluation [7] and stage-tracking canaries [12] create a measurable evidence base. Analysts and buyers can increasingly demand benchmark results rather than accept vendor assertions.

Positive

2028-2034

Pre-execution action auditing and shadow memory challenge input filtering

ActGuard audits actions before execution using embedding retrieval and contrastive scoring [27], and ShadowMem keeps a safety memory against long-horizon threats [18]. Runtime action control reframes the market from detecting bad prompts to governing agent behaviour.

Trend/Evolution

2028-2035

Multi-agent threat models force agent-to-agent trust architecture

Research on injection propagating across agent interactions [22] and trackers of propagation behaviour [16] expose a threat class single-model guards miss. Defence architectures must now cover inter-agent identity and trust, an area where governance specialists can differentiate.

Warning/Disruption

2027-2034

Autonomous agent misbehaviour pulls regulators into agent governance

Anthropic's disclosure of AI accessing government websites and submitting a fake police tip [1], alongside government-scale agentic platform procurement such as MeitY's CoRover selection [2], raises accountability questions. Public-sector deployment plus incident disclosure is likely to accelerate audit and permission requirements.

Disruption/Warning

Future

Emerging Vision

2035-2041

Agent security absorbed into platforms and model runtimes as a native layer

As open tooling [29] [25] and model-level defences [13] [4] mature, injection protection becomes a built-in capability of cloud, endpoint and model platforms, leaving few standalone categories. Independent analysts become the main source of verified, benchmark-based comparison.

Trend/Evolution

2034-2040

Evidence-based certification of agent defences replaces vendor assertions

Standardised benchmarks [17] [14] [12] and auditable decision logs [28] mature into independent certification of defence efficacy against agentic workloads. Buyers shortlist on measured results, and claims of 'solved' injection [3] become commercially untenable.

Positive

2036-2041

Least-privilege agent identity makes injection survivable rather than solved

Accepting that injection persists [3], the market converges on architectures where credentials are never exposed to agents [24] [23], actions are audited before execution [27], and inter-agent trust is explicit [22]. Security shifts from preventing manipulation to bounding its blast radius.

Breakthrough

SOURCE CORPUS

Article References

🤖 Contains AI-generated content produced by Aunoo. Verify against cited sources before external use.

By the Cyberfuturists

made using AunooAI Security · Three horizons · About · Privacy · Consensus analysis