Lighthouse AdvisorySLED AI Adoption Intelligence

Strategic PartnersIssue 063 records

Palo Alto Networks

Palo Alto Networks published nothing new on Nov. 4, so this edition looks at independent scrutiny. Two outside reviews of Prisma AIRS were re-checked this week. AnchorTerminal grades the runtime API a C (61.6/100). It credits detector breadth and FedRAMP Moderate support but flags 10-year retention of payloads flagged as malicious, an EULA ban on published benchmarks and no SLA. Checkable AI finds 8 of 38 agent-security controls documented, with no human-approval step or kill switch. A new preprint, StateFence, shows that poisoned logs can mislead SOC AI agents and that defenses need to fit each task. All three rely on documentation or benchmarks, not live public-sector deployments.

Evidence records
3
Cross-source patterns
2
Evidence classes
2 independent research1 academic research
Outcomes
2 mixed1 cautionary
Source freshness
2 new this fortnight1 undated
Research completed
2026-11-05

Choose a role to see its takeaway beside every record in the ledger.

Patterns across the evidence

Synthesis · Lighthouse Advisory interpretation

2 patterns, each supported by at least two sources

  1. Two independent reviews of Prisma AIRS agree it is a strong scanning and gateway layer but leave approvals, containment and contract terms for buyers to solve

    AnchorTerminal (re-checked Nov. 2) and Checkable AI (re-checked this week) reviewed public documentation for Prisma AIRS from different angles: API and contract terms, and agent-security controls. Both credit detector breadth, gateway features and documentation. Both point to gaps buyers must close themselves: no human-approval workflow or kill switch, 30 of 38 controls not addressed, payloads flagged malicious retained up to 10 years, no SLA and an EULA ban on publishing benchmarks. Interpretation: SLED buyers should treat AIRS as one layer in an agent-control matrix, and get records and legal review before production. Neither review tested a live deployment.

    Operating questionBefore an agency puts agent traffic through Prisma AIRS, has it mapped which controls AIRS does not provide and cleared the retention and benchmark terms with counsel?

    Supporting evidenceAnchorTerminal (independent agent-tool review site)Checkable AI (agent-researched knowledge base with human review)

  2. Allow/block content verdicts are not enough for AI agents in security operations

    The StateFence preprint finds that poisoned telemetry can corrupt SOC agent decisions, and that generic filtering can delete the indicators analysts need. Task-specific guards and multi-source checks for high-risk actions worked better on its benchmarks. Checkable AI separately finds Prisma AIRS gives allow/block verdicts with no human-approval step or agent kill switch documented. Interpretation: SLED SOCs adopting agentic tools should add per-task safeguards, approvals for consequential actions, and poisoned-evidence testing on top of any content-scanning product. The evidence comes from benchmarks and documentation, not from live public-sector deployments.

    Operating questionDoes each agentic SOC workflow have task-specific safeguards and human approval for containment actions, tested with poisoned evidence before go-live?

    Supporting evidenceHaowen Dai and Alejandro Guerra-Manzanares, arXivCheckable AI (agent-researched knowledge base with human review)

Evidence ledger

Full record · every source keeps its link and limitations

3 records
  1. Independent researchMixedNew this fortnight

    Independent desk review grades the Prisma AIRS AI Runtime Security API a C (61.6/100), citing 10-year retention of malicious payloads and an EULA ban on published benchmarks

    AnchorTerminal scores the Prisma AIRS AI Runtime Security scan API 61.6 of 100 (grade C, "mixed, material gaps"), from public evidence re-checked Nov. 2, 2026; performance and task-success testing are still pending. Strengths: public OpenAPI documents, up to ten detection types in one call including MCP tool events, rotating API keys and OAuth roles, regional hosts and FedRAMP Moderate support since October 2026. Weaknesses: no public price or trial (capacity bought as Software NGFW credits in billion-token steps), payloads judged malicious retained up to 10 years even after the subscription ends, an EULA that forbids publishing benchmark or comparison tests, a 99.9% availability objective without an SLA, and a Python SDK credential-logging fix still unreleased. It also notes a detector failure can arrive inside an HTTP 200 response, as URL filtering did in the US on Oct. 15.

    AnchorTerminal (independent agent-tool review site)Global product; US, Germany, India and Singapore regional hostsAnchorTerminal tool review, evidence last checked Nov. 2, 2026 (facts verified Oct. 8, 2026)

    Why it matters, evidence and limitations
    Why it matters
    State agencies, universities and health departments evaluating Prisma AIRS as a guardrail for chatbots and agents get a rare non-vendor read on contract and data-handling terms. Interpretation: the 10-year retention of flagged payloads matters for public-records, CJIS, FERPA and HIPAA data that may be inside prompts; the benchmark-publication ban limits how universities and auditors can share evaluation results. FedRAMP Moderate support helps, but SLED buyers should confirm state-level authorizations separately.
    Evidence and measured results
    Opened and read the full review page, including the facts table, strengths/weaknesses and category scoring notes. Desk review of public documentation, status history and package registries; no live performance testing yet.
    Limitations and uncertainty
    Desk review of public evidence only; performance and task success not yet scored; scoring weights are the reviewer's own; vendor has not claimed the listing; some facts dated Oct. 8 and not re-read Nov. 2.
    Prisma AIRS AI Runtime Security review: pricing, alternatives, grade C Role takeaways & implementation
  2. Independent researchCautionaryUndated source

    Checkable AI control review of Prisma AIRS: 8 of 38 agent-security controls documented as supported, with no human-approval step, agent kill switch or delegated identity

    Checkable AI maps Prisma AIRS (AI Runtime, AI Supply Chain Security, AI Red Teaming, AI Gateway, AI Agent Discovery and Cortex AISPM integration) against 38 agent-security controls using only public vendor documentation, and finds 8 supported and 30 not addressed. Supported items include the AI Gateway model gateway with per-team budgets and guardrails, governed agent-to-agent calls (Americas region only), and a hybrid data plane that keeps payloads in the customer environment. Gaps include no human-approval workflow (verdicts are allow or block), no local file or shell permission model for agents, no sandbox or agent kill switch, no delegation of the initiating user's identity, no per-agent retrieval filtering and no behavioral baseline. The review states it is not a test of a live deployment. The page was last checked Nov. 5, 2026 (the site's own date, likely Australian time), after an earlier Oct. 19 check.

    Checkable AI (agent-researched knowledge base with human review)Global product; review published for Australia, EU and US audiencesCheckable AI knowledge base, scope documented Oct. 9, 2026; last checked Nov. 5, 2026 (site date)

    Why it matters, evidence and limitations
    Why it matters
    SLED agencies and universities piloting AI agents (caseworker assistants, IT help-desk agents, coding agents) are often told one platform covers agent security. Interpretation: this independent mapping shows Prisma AIRS is a content-inspection and gateway layer; approvals for consequential actions, agent permission scopes and kill switches must come from other controls. Transferability caveat: the review is documentation-based and written for a multi-country audience, not tested in a US public-sector environment.
    Evidence and measured results
    Opened and read the full knowledge-base page, including the control-area table and per-control findings with quoted vendor statements. Documentation review, not hands-on testing.
    Limitations and uncertainty
    Documentation-based review, not a live test; agent-researched with human review; findings may change as the vendor documents new features; Americas-only availability noted for some gateway features.
    Palo Alto Networks Prisma AIRS: AI security controls and findings Role takeaways & implementation
  3. Academic researchMixedNew this fortnight

    Preprint: StateFence shows poisoned telemetry can corrupt SOC LLM agents' triage and response, and that task-aware defenses beat generic filtering

    Preprint, not peer reviewed. The authors show that malicious instructions embedded in telemetry, tickets, retrieval results or memory can propagate through SOC LLM agent tasks (alert triage, incident summaries, response recommendations, IOC extraction). On a controlled benchmark of 64 attacked cases per task-model setting across four models (Claude Opus 4.5, Gemini 3 Flash Preview, Grok 4 Fast, Qwen3-32B), undefended triage attack success exceeded 50% for the two weakest model conditions. Their task-aware defense cut Claude summarization attack success from 23.44% to 6.25%, and on a public SOC validation set reached 91.41% task success with 8.59% attack success. Generic filtering applied to IOC extraction removed real indicators (51-75% recall versus 93.75-98.44% with the task-aware route), and sanitization alone was counterproductive for triage. Authors note results come from fixed benchmarks and depend on model and schema.

    Haowen Dai and Alejandro Guerra-Manzanares, arXivNot location-specific (controlled and public SOC benchmarks)arXiv preprint 2611.02605v1, submitted Nov. 2, 2026

    Why it matters, evidence and limitations
    Why it matters
    Independent evidence relevant to agentic SOC products such as Cortex XSIAM and AgentiX that state SOCs, regional/joint SOCs and university security operations are adopting. Interpretation: logs and tickets that agents read are attacker-controllable, so agentic triage needs per-task safeguards; a generic prompt filter may strip the indicators analysts need. Transferability caveat: benchmark cases, not a live public-sector SOC, and Palo Alto products were not tested.
    Evidence and measured results
    Opened the arXiv abstract page (v1, submitted Nov. 2, 2026, DOI pending registration) and read the HTML full text, including datasets, target models, Tables 2-5 and the Limitations section.
    Limitations and uncertainty
    Preprint, not peer reviewed; controlled benchmarks; manually defined task mappings; results vary by model; no vendor SOC products evaluated; no public-sector sample.
    StateFence: Task-State Protection Against Evidence-Chain Contamination in Blue-Team LLM Agents (Preprint, not peer reviewed) Role takeaways & implementation

How to read this edition

Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.

Independent research
Research conducted outside the implementing organization.
Academic research
Research produced through an academic institution or peer-reviewed venue.