AIR Named a Vendor with Broad ARISE Alignment in SACR's Inaugural ARISE Report

What ARISE measures

ARISE starts from a simple point: a valid credential doesn't make a live agent action valid. Agents call tools, use credentials, query data and trigger workflows at machine speed. Traditional identity controls decide access before an action or review it afterward, and SACR defines ARISE as the layer that decides whether an agent's action should go ahead before it completes.

The framework has three layers:

• Deterministic governance: what the agent is allowed to access.
• Behavioral and intent analysis: whether what the agent is doing still makes sense.
• Dynamic runtime governance: whether the action should continue, be narrowed, be escalated or be stopped right now.

SACR pairs this with a maturity model, ARISE Control Depth. It sets level 4, inline intervention before an action completes, as the production baseline for agents that touch sensitive data, credentials or critical workflows.

Where SACR places AIR

SACR's initial view is that "AIR sits between AI supply-chain security, runtime agent control, and identity-aware data movement control." The report finds AIR's ARISE alignment strongest where AIR Control and AIR Defend govern live agent behavior, tool use, MCP use and data movement.

That matches how we built the platform. Our four products work as one:

• ^{AIR Control} governs the agent fleet across endpoint, cloud and SaaS. Every agent, sanctioned or shadow, is held to policy.
• ^{AIR Filter} is the agent context firewall. It vets skills, plugins, MCPs and add-ons, and is extending to web content and internal data.
• ^{AIR Defend} secures agent actions at runtime with observability, alerting, blocking and steering.
• ^{AIR Marketplace} is a curated store of pre-vetted external and certified internal add-ons.

The gap we're focused on

SACR lists the capabilities where the market is still immature. The first on its list is detecting behavioral drift after a tool or MCP server has already been approved. Our research keeps showing why that gap matters.

• In June, a test skill we published passed the scanners we tried. We then changed the external page it pointed to, and it reached roughly 26,000 agents before we ended the research.
• In October, we published our finding that an official OpenAI skill for deploying apps on Render told those apps to send authentication tokens to a domain nobody owned. We registered it and confirmed live production apps were sending real tokens. OpenAI and Render fixed the issue in August, before we went public.

In both cases the component was approved once, then changed or misbehaved later. That's why AIR re-checks what agents consume on every load and enforces inside the agent's context, before the action completes.

What CISOs should take from ARISE

SACR advises buyers not to treat visibility-only tools as runtime enforcement, and to test runtime-enforcement claims in a live workflow. Of its questions for vendors, these are the three we'd ask first:

1. What tools, MCP servers, SaaS apps and data sources can each agent touch?
2. Can the product block, pause or restrict an action before it completes?
3. Can it detect tool drift, or only pre-launch risk?