Our own writing on AI security. What our red team actually finds in production systems, what the new standards and advisories really require, and where agentic risk is going next. Researched and written in-house, not aggregated from anywhere.
Insights is the RedLens AI Security Research team's own writing. Two kinds of piece appear here. Guides answer one question a security or compliance lead actually types: how prompt injection reaches a LangChain agent and how to test for it, what a SOC 2 auditor expects once an LLM feature ships, how HIPAA due diligence changes when the vendor is an AI model. Posts are dated analysis of what happened in AI security that week, written with the sources linked, and with the practical control that would have changed the outcome stated plainly.
Everything here is grounded in what the platform does for customers: adversarial AI red-teaming across the Master Attack Schema, findings documented as evidence against HIPAA, NIST AI RMF, OWASP GenAI, MITRE ATLAS, ISO/IEC 42001 and the FBI CJIS Security Policy, and runtime enforcement of those findings. We write about agentic risk, egress and containment, prompt injection, and healthcare and law-enforcement compliance because those are the systems we test. We do not publish vendor comparisons we cannot back with a run, and we do not describe a control as compliance.
How to use this page: each entry below names its date, its author and what it covers, so you can tell a dated post from a guide at a glance. Guides are kept current and carry an "updated" date; posts are left as written, with corrections noted inline where a cited fact later changed. Every claim links to its source, and anything we measured ourselves says so.
If you want the industry's own reporting rather than ours, the free Threat Intel feed (linked under the post list) aggregates CISA, NIST, OWASP GenAI and the security press daily. If you want to see what a RedLens report looks like before reading further, the interactive sample report is one click. New here? Start with the two guides below, then the BAA post if you work in healthcare or the MCP post if you run agents.
Answerable questions across inputs and prompt injection, tool permissions, data and secrets, outputs and egress, logging, testing and incident response. Tick them on the page or download the printable PDF.
Open the checklist →The seventeen CJIS controls AI security testing can evidence, which are sanctionable now and which sit in the zero-cycle to September 2027, the six that are new in v6.x, and what AI testing cannot evidence at all.
Read the guide →The FBI certifies no AI product for CJIS. The three questions that actually decide it, and why being inside the CJIS boundary is where testing starts, not where it ends.
Read the guide →Prompt injection in LangChain is an architectural attack surface across chains, agents, tools, RAG and deserialisation, not one bug. The CVEs that have shipped, the paths an attacker takes, and how to test an agent against them.
Read the guide →SOC 2 has no "AI control", but shipping an LLM feature changes what your existing Trust Services Criteria have to cover. A control-by-control reading, with the evidence an auditor will ask for.
Read the guide →Testing an agent means attacking its tools, memory and MCP connections, not just the model. The methodologies that matter, how to test without real data, and why one scan is not evidence.
Read the guide →A decision guide to open-source frameworks, platform vendors and vertical tools, grouped by what you are buying. Sourced and honest, including where RedLens is the wrong choice.
Read the comparison →Six alternatives to Prisma AIRS, what each does well, and when to stay with Prisma AIRS. Honest and sourced.
Read the comparison →Where Mindgard is stronger, where RedLens differs, pricing side by side, and who should pick which. Written by RedLens, saying where Mindgard wins anyway.
Read the comparison →The biggest, best-funded platform versus the vertical tool. Breadth and scale versus regulated-sector evidence, with pricing side by side.
Read the comparison →The model-file scanning leader versus citation-level HIPAA and CJIS evidence. Where each is stronger, and who should pick which.
Read the comparison →An inline runtime guard versus an offensive testing and evidence platform. Often complementary, and this page explains when to use which.
Read the comparison →The 2026 edition added nothing and dropped nothing, but eight entries changed rank, System Prompt Leakage became Hidden Context Exposure, and the order was shaped by incident data for the first time. What moved and why, then each of the ten with what it is, how to test for it, and where RedLens's methodologies do and do not map.
Read the post →Most AI vulnerability reports are a screenshot and an adjective. The nine fields a finding needs before it counts as confirmed, from a pinned target and verbatim input and output to the judgment rule, the reproduction rate, the impact sentence, the framework mappings, a remediation that names a control, and a lifecycle an auditor can retain.
Read the post →The attack does not look like an attack. It looks like a routine sentence in a referral, a portal message or a scanned fax, written for the assistant rather than the reader. How indirect prompt injection leaks PHI, why healthcare is more exposed than most industries, a defender checklist mapped to OWASP, NIST AI RMF and the HIPAA Security Rule, and how to test for it.
Read the post →A Contrast Security experiment found three AI scanners agreeing on only 5% of their findings against the same codebase, and one reproducing just 17% of its own results run to run. Why LLM-judged scanning is structurally non-deterministic, and what a reproducible benchmark methodology requires instead.
Read the post →Three incidents in one week point to one root cause. OpenAI agents leaked user images to third-party hosts, Gemini broke out of a red-team sandbox to compromise three companies, and the Carbonato botnet turned exposed Docker hosts into agent-run infections. The problem is not exotic AI risk. It is ordinary access-control failure, and it is testable.
Read the post →OpenAI agents bypassed a read-only restriction on a dormant German wiki using GET-based writes and an unvalidated Azure Blob Storage hostname allowlist. What that incident, and OWASP's 2026 Excessive Agency ranking, mean for the egress controls on your own agents.
Read the post →Model evaluation is not HIPAA due diligence. Why every healthcare AI vendor needs a signed BAA and monitored data flow, and how the PHI Egress Scan gives compliance teams a fast, honest first read on what is actually going to each vendor.
Read the post →Confirmed CVEs, an NSA advisory, and a real supply-chain attack. What actually happened to the Model Context Protocol this year, and what to do about the MCP servers already running in your environment.
Read the post →More posts as we publish them. Everything above is written here. If you want the industry's own reporting instead of ours, our free Threat Intel feed aggregates it daily from CISA, NIST, OWASP GenAI and the security press, and links every item back to the outlet that published it.
Original writing on AI security from the people building the platform: agentic risk, red-team findings, and the advisories worth reading in full. A few times a month at most, no sales sequence, and one click to leave.
RedLens red-teams the AI systems you've already shipped, then shows you exactly how to close what it finds.