Cisco’s State of AI Security report found that 83% of surveyed organisations plan to deploy agentic AI into their business operations, but only 29% believe they can do so securely, a gap that many cybersecurity teams are already feeling firsthand.
The lack of cyber readiness is understandable, because AI agents generate a new kind of network traffic that most existing tools were never built to handle. Networks are being flooded with natural language prompts, business context, sensitive data and automated commands that are constantly moving between users, models and agents. But existing network security tools were never designed to manage this kind of traffic, so they can’t even begin to protect it from security threats.
To remedy this deficiency, many cybersecurity providers have created dedicated AI firewalls, a newer category of solution designed to protect AI models, applications and systems from threats like prompt injection attacks and data exfiltration.
Security professionals need to understand that these new AI network firewalls are different from the “AI-powered firewalls” that simply use AI features to ward off threats. We saw this very clearly when Check Point launched its new AI Network Firewall in July, giving businesses a way to inspect and control AI network traffic within the firewall systems they already use, rather than installing an entirely new security infrastructure.
The Network Layer As One Piece Of A Bigger Picture
The corporate network is an efficient place to intercept and control AI traffic, because most AI system data, prompts and third-party tool calls pass through it on their way to the AI agent, application or web browser they’re destined for. By intercepting it there, security teams can apply consistent policies across AI traffic, without having to manually configure every single user endpoint and model.
That’s not to say AI firewalls will protect everything. Enforcement at the network level only works for traffic that passes through it. It cannot do anything to enforce an agent making a direct cloud-to-cloud tool call to adhere to corporate security policies. Similarly, if an employee is using an agent on a personal device that connects to the internet outside the corporate network, it won’t be covered either.
This is why network-level protection is just one piece of the puzzle. Companies must implement a broader AI security strategy, such as identity governance, endpoint and browser-based visibility and access controls at the point where tools are called, to ensure full protection.
Where Traditional Firewalls Fall Short With AI Traffic
Conventional firewalls have been a staple of the cybersecurity industry for years, because they’re extremely reliable when it comes to older threats like malware. Unfortunately, while they can detect the presence of AI traffic, they can’t analyse its content or purpose.
For instance, they can’t analyse what users are prompting models and agents to do, and they can’t surface an AI agent’s real intent. Similarly, they lack the ability to determine if an agent’s request is sanctioned, or if it has somehow been manipulated through a malicious prompt or input.
This gap in capability is the reason only 29% of organisations feel truly ready to deploy AI agents securely. Existing firewalls were designed to recognise and analyse traditional network traffic such as HTTP requests, so they can’t parse what an AI agent’s traffic actually contains or is for.
Seeing AI Traffic Before You Can Govern It
If you want to be able to govern AI traffic, you’re going to need to understand its nature. AI network firewalls must be able to discover all of the AI applications, agents and tools being used by an organisation.
This includes those that were sanctioned by the security team, and also the “shadow AI” tools and agents that company employees use without permission. Without this deep visibility and knowledge of what your AI traffic really is, it’s impossible to govern it.
Once you can understand your AI traffic, the next thing to implement is intent-based classification. This is what allows security teams to understand the intended outcome of each prompt or agent action.
At the network layer, this is far more important than keyword-based detection. Most employees prompt their AI agents in natural language, which can be colourful and varied, rendering rigid keyword-matching all but useless. Instead, the firewall needs to analyse the objective of the traffic and the context around it, to flag whether someone is trying to get around the safety rules and steal sensitive data or perform actions they shouldn’t be doing.
Stopping Manipulated Prompts Before They Land
Modern AI network firewalls need to be able to perform two critical tasks: block prompt injection attacks and adversarial inputs before they reach their destination, and prevent sensitive data from leaving the network.
Prompt injection attacks involve tricking AI models into ignoring their safety guardrails so they can perform unauthorised actions. If the injection attempts aren’t detected and blocked, this can lead to a wide range of harmful outcomes, from data leakage to unauthorised system actions.
Protecting sensitive data is harder, because the context is important. AI firewalls must allow authorised actions to proceed, so this means they need the ability to prevent data escaping the network based on what the prompt is being used for, rather than the destination.
This way, employees will be able to send snippets of sensitive code to a public repository when such actions are legitimate and necessary. But if someone is trying to steal the entire codebase, the firewall can prevent it.
Keeping Agent Access Dynamic, Not Static
AI agents are extremely powerful, with the ability to communicate, gather data and execute various tasks using third-party systems via the Model Context Protocol. This is why security teams need to dynamically control what agents and their MCP traffic can do. Policies cannot be static. Instead, they must be based on the context of the action, the user’s access permissions and the level of risk.
This dynamic control should be consistent throughout the organisation, so that the security policies don’t vary based on which tools or entry points the agent is trying to use.
If an agent tries to access sensitive financial data, restrictions must apply no matter where the request originates from, so attackers can’t use trial-and-error to find a “backdoor” past the guardrails.
Tools Of The Trade
Security teams have a number of options when it comes to monitoring and securing AI traffic, including both specialised AI security platforms and integrations with their existing network infrastructure.
- Prompt Security is a standalone AI security platform that provides real-time prompt and model response inspection. It’s designed to spot and intercept prompt injection attacks and other techniques malicious actors use to manipulate AI systems and steal data the moment they happen, before they reach their intended destination. This tool now operates as part of SentinelOne’s Singularity Platform, following SentinelOne’s acquisition of Prompt Security in 2025
- Check Point’s AI Network Firewall launched in July, bringing AI traffic inspection capabilities directly into customers’ existing firewalls, with its AI-application defences built on technology from Lakera, the AI security startup Check Point acquired in 2025. Its job is to discover and control AI traffic crossing the network, including the tools employees use, AI applications and AI agents and their MCP traffic, without having to install new hardware or set up a separate console
- F5 Networks customers can also use that company’s native AI Guardrails tool, embedded into its Application Delivery and Security Platform. Built on technology from its 2025 acquisition of CalypsoAI, the platform inspects AI interactions at the inference layer in real time and is designed to work across proprietary, open-source and fine-tuned models rather than being tied to any single one
With 83% of enterprises eager to adopt AI agents, but only 29% believing they’re actually ready to do so, securing AI traffic at the network layer has become an urgent need. Businesses face pressure to deploy AI systems before their competitors do, so it isn’t realistic to wait until every risk is eliminated.
Closing this security gap depends on giving security teams more visibility and control at the network layer, where the vast majority of AI traffic flows.
