|
By Nick Rago
AI Detection and Response (AI-DR), also called AI runtime security, is quickly becoming a must-have. Prompt injection, jailbreaks, and data leakage are real, and the prompt is often where attacks begin. But the prompt is only the first hop. In an agentic enterprise, a single instruction can trigger activity well beyond the LLM, all the way to your business systems and data.
|
By Salt Labs
Salt Labs found that the agentic AI platform Manus could be hijacked with a single email. By hiding malicious instructions inside an ordinary message, researchers got Manus to execute malicious code and, from there, reach the email, cloud storage, and code repository accounts a user had connected to it. The full attack required nothing from the victim beyond asking Manus to check their inbox. No stolen password, no clicked link.
|
By Salt Labs
Salt Labs recently showed that a single email could hijack the AI agent platform Manus and reach a victim’s connected accounts. The full technical breakdown, with complete evidence, payloads, and screenshots, is in our research team’s write-up, and Dark Reading first reported the finding in an exclusive. This post is the shorter version: what the finding means and what it tells every organization now deploying AI agents. For the full technical detail, read the Salt Labs research blog.
|
By Julia Weitz
As AI adoption accelerates inside enterprises, security and IT teams are increasingly asking a foundational question: what exactly is connected to our AI, and what can it access? For organizations running Claude Enterprise, Salt now has a direct answer. Salt Claude Connect links Salt to Claude’s Compliance API and provides continuous, read-only visibility into the MCP (Model Context Protocol) servers connected to your Claude Enterprise organization.
|
By Roey Eliyahu
The problem is not a lack of controls. It is connecting them into one attack story. The more time I spend with enterprise AI deployments, the clearer one thing becomes: AI security is incredibly fragmented. There are LLM guardrails, AI gateways, MCP security tools, API security, endpoint controls, SASE, code scanning, and runtime detection. Each solves a real problem, but agentic systems do not experience them as separate layers, and neither do attackers.
|
By Michael Callahan
Agentic AI has moved from experimental research to live production environments at unprecedented speed, outpacing nearly every technology security leaders have encountered in recent history. Distinguishing themselves from standard chatbots that merely respond and pause, autonomous agents architect multi-step workflows, interface with tools and APIs, maintain contextual memory, and execute operations with minimal human intervention.
|
By Roey Eliyahu
These two photos were taken almost ten years apart. The first is from 2016, with Sam Altman at Y Combinator. The second came from an unexpected encounter in Silicon Valley almost a decade later. I’ll come back to it at the end. With Sam Altman at Y Combinator in 2016. I was 22 when I arrived in Silicon Valley on a one-way ticket, with a little bit of cash that was barely enough for one month of living there, and a thesis I wanted to prove.
|
By Michael Callahan
Salt Security and CrowdStrike give joint customers visibility across the full agentic path, from the model to the system where the action lands An employee at a bank asks an AI assistant a routine question. How much money is in my savings account? The assistant answers correctly. The prompt was legitimate. The response was accurate. A model-layer security control inspects both and finds nothing wrong, because nothing is wrong with either. Now look at what happened in between.
|
By Michael Callahan
AI coding assistants have gotten remarkably good at writing functional code. Syntax correctness rates are approaching 100%. Developers are more productive than ever. And yet the security picture tells a very different story.
|
By Michael Callahan
Modern organizations don't operate from a single server room anymore. Today's enterprise environment spans dozens of cloud services, SaaS applications, APIs, AI agents, and non-human identities, all of which are continuously changing. A quarterly security audit is no longer a safety net, but now considered a gap.
|
By Salt Security
Enterprises are deploying AI agents at scale, and those agents are taking real business actions. Through LLMs, MCP servers, and APIs, they move money, access patient records, modify code, and send emails. The attack surface has fundamentally shifted, but most security programs are still focused on what an AI says rather than what it does.
|
By Salt Security
Salt Security + Anthropic = a more secure AI ecosystem We’re excited to introduce Salt Claude Connect. This integration will bring continuous MCP server visibility for Claude Enterprise directly into the Salt Security platform. Now you’ll be able to see which organization-managed MCP servers are connected, when they’re added or removed, and their current status (continuously, with no agents, traffic analysis, or manual cataloging required).
|
By Salt Security
AI coding assistants are transforming how enterprise software gets built. Developers at every level are prompting their way to production-ready APIs, MCP integrations, and agentic workflows faster than any security team can review them. The problem is that none of those assistants knows your internal security standards, regulatory obligations, or risk tolerance. The result is insecure patterns shipping unnoticed, vulnerabilities discovered downstream when fixes are costly, and compliance becoming a guessing game on every commit.
|
By Salt Security
The EU AI Act is a global business issue. Just like GDPR before it, it reaches beyond EU borders. If your organization does business in the EU, you are in scope. Full enforcement begins August 2, 2026, with fines of up to 35 million euros or 7% of global turnover for non-compliance.
|
By Salt Security
We’ve reached the big 100! With 100 pre-built policies, the Salt Policy Hub gives security teams an immediately deployable governance layer across APIs, MCP servers, agent permissions, compliance, and runtime behavior. By the numbers: AI moves fast. Security governance should move faster.
|
By Salt Security
As enterprises accelerate adoption of Generative AI, the security perimeter is rapidly expanding. This creates a new, largely unprotected attack surface: the Agentic Action Layer. In this on-demand webinar, @CrowdStrike and Salt Security introduce an AI-native security architecture that spans the full chain of intent-to-action. Learn how CrowdStrike Falcon AIDR protects the model runtime, prompts, inference, and LLM behavior, while Salt Security governs and defends the APIs, MCPs, and services where AI actions actually occur.
|
By Salt Security
AI coding assistants are generating APIs, MCP integrations, agent tools, and application logic faster than your security team can review them. And none of them are trained on your internal security standards, industry frameworks, or regulatory requirements. Salt Code changes that. Join us for this product launch and see how Salt governs AI-generated code from the first prompt through runtime, without slowing your developers down.
|
By Salt Security
AI is writing more enterprise code than ever. The problem? AI coding assistants aren’t trained on your internal security policies, compliance requirements, or industry frameworks. The solution? Salt Code, the first agentic security solution to enforce security policies inside AI coding assistants. Salt Code brings policy-driven security to the moment code is created, helping developers generate compliant code by default from prompt to production.
|
By Salt Security
Secure your Agentic Action Layer and see where your Databricks MCP servers are communicating with detailed descriptions of what they do.
|
By Salt Security
API attacks are on the rise, and WAFs and gateways cannot stop them. A few highlights from our latest Salt Labs report on API security: Download the report now to benchmark yourself and use the findings to improve API security for your company.
|
By Salt Security
API Security for Dummies walks you through how application architecture has evolved, why apps are built on APIs now, the security risk APIs present, and best practices for securing APIs. This eBook: Download this eBook to learn the most critical elements of API security and ten prioritized steps you can follow now to start securing APIs for your organization.
|
By Salt Security
Securing your APIs is no longer a luxury, but it shouldn't be viewed as just a necessary burden either. Protecting your APIs opens the door to real business value including: Download this eBook to explore the business results customers are uncovering as they embark on their API security journey and how to quantify the value of API security in your organization.
|
By Salt Security
API attacks include many of the tactics, techniques, and procedures (TTPs) identified in the MITRE ATT&CK framework. This white paper analyzes and maps three common API attack scenarios to the TTPs found in the MITRE Enterprise Matrix. By understanding how the MITRE ATT&CK TTPs relate to API security threats, security leaders can: Download now to learn how to defend against API attacks by leveraging this well-known security framework.
|
By Salt Security
API security has emerged as a key priority for protecting vital data and services. It's also an area where many companies lack expertise. Salt Security has compiled this list of API security best practices, drawn from field experience and customer feedback, to help guide you on your API security journey. These API security best practices fall into multiple focus areas, including: Download this guide to obtain a comprehensive list of best practices and guidance to secure your APIs throughout their lifecycle.
|
By Salt Security
With API attacks on the rise, and existing security technology proving to be ineffective at stopping API attacks, organizations need to take a new approach. API security offerings must provide a range of functionality to be useful to organizations, including: Download this white paper to improve awareness of what it takes to adequately secure APIs, how to evaluate a given API security offering, and what API security capabilities are necessary to protect your business.
- October 2026 (4)
- September 2026 (5)
- August 2026 (7)
- July 2026 (6)
- June 2026 (10)
- May 2026 (7)
- April 2026 (8)
- March 2026 (3)
- February 2026 (7)
- January 2026 (6)
- December 2025 (15)
- November 2025 (3)
- October 2025 (2)
- September 2025 (4)
- August 2025 (6)
- July 2025 (8)
- June 2025 (5)
- May 2025 (5)
- April 2025 (8)
- March 2025 (6)
- February 2025 (1)
- January 2025 (10)
- December 2024 (3)
- November 2024 (4)
- October 2024 (13)
- September 2024 (3)
- August 2024 (10)
- July 2024 (9)
- June 2024 (4)
- May 2024 (2)
- April 2024 (3)
- March 2024 (3)
- February 2024 (1)
- January 2024 (3)
- November 2023 (1)
- October 2023 (3)
- September 2023 (2)
- August 2023 (3)
- July 2023 (7)
- June 2023 (7)
- May 2023 (6)
- April 2023 (9)
- March 2023 (14)
- February 2023 (6)
- January 2023 (6)
- November 2022 (1)
- June 2022 (1)
- May 2022 (1)
- April 2022 (1)
The leading API security company, providing the context needed to discover APIs, stop attacks, and remediate vulnerabilities to accelerate business innovation.
By correlating activities across millions of APIs and users over time, Salt delivers deep context with real-time analysis and continuous insights for API discovery, attack prevention, and shift-left practices. Deployed quickly and seamlessly integrated within existing systems, the Salt Security platform gives customers immediate value and protection, so they can innovate with confidence and accelerate their digital transformation initiatives.
Complete API security for complete protection:
- Discover all your APIs: Continuously inventory all your APIs, including shadow and zombie APIs.
- Prevent sensitive data exposure: Identify the APIs that are exposing PII or other sensitive data.
- Stop API attacks: Correlate activity to block attackers during reconnaissance.
- Prevent ATO, Data Exfiltration: Thwart credential stuffing, account takeover, and data theft attacks.
- “Shift left” with proactive API security Test APIs in pre-production to identify and eliminate vulnerabilities.
- Accelerate incident response: Reduce the time needed to understand and resolve incidents.
- Provide remediation insights: Share learnings from runtime analysis with dev teams to harden APIs.
- Simplify compliance: Tie your API and sensitive data discovery and vulnerability remediation into GRC workflows.
The rich API context you need for robust discovery, attack prevention, and shift left.