Educational & interactive threat model · 2026

Securing the
Agentic Enterprise

AI agents are not an app bolted onto old infrastructure. They are a new trust topology, where untrusted text, non-human identities, and autonomous action collapse the boundaries classic security kept apart. This is the end-to-end map of where they get attacked, what defends them, and what still has no answer.

By Danny Livshits · an end-to-end view across the full agentic deployment stack
50
canonical risks
11
deployment layers
70
verified real incidents
7
trust boundaries
36
under-served / open
Figure 1 · the spine

The end-to-end deployment, and where it gets attacked

A single request crosses eleven layers and seven trust boundaries. Click any layer to see the surfaces it exposes, the validated incidents that hit it, the controls that help, and where coverage runs out.

deployment_attack_surface.map click a layer · highest-severity risk colors each badge
Critical layer High Medium request / action flow return / control flow TBn = trust boundary (hover for detail) badge = count of mapped risks
The taxonomy

Fifty risks across eight families

Every risk is mapped to the layers it touches, the OWASP LLM and Agentic threat IDs, a validated real-world example, and an honest call on how well it is solved. Filter, then click a card for the full entry.

Coverage & honest gaps

Risk to solution, and where it runs out

The analytical core: each risk against its strongest controls and an explicit gap status. Four risks are open problems no product solves; most of the rest are under-served by shipping tools.

End-to-end mitigation

Nine moves that contain the consequential half

Most agentic risk is contained, not prevented. These cross-cutting moves neutralize the damaging half of nearly every attack even when detection fails.

The evidence

Every claim is a real, verified incident

The taxonomy is built on documented, primary-source-verified events, not hypotheticals. Browse the full incident index; each links to its source and the risks it demonstrates.

Read the analysis

Two parts, dual register

Part 1 builds the shared map and tours the attack surface. Part 2 catalogs all 31 risks, surveys the solution market, and prescribes an end-to-end control architecture. Each part opens with an executive bottom line and drops into practitioner depth.

About, method & scope

How this was built, and what it does not claim

An honest account of the method, sources, scope, and limitations behind the model.

Author

By Danny Livshits. This is independent security research. Two of the author's open-source research tools are referenced where relevant and disclosed as such, not as products: a2a-audit (an A2A agent-card posture auditor) and Agent Guard (open prompt-injection detection models). Their inclusion is disclosed, and they are rated on the same honest scale as every other control.

Method

Attack vectors were enumerated across thirteen domains, then every candidate incident was adversarially verified against its primary source (CVE record, vendor advisory, or original disclosure) before entering the dataset. Findings were clustered into a canonical taxonomy mapped to an eleven-layer reference architecture grounded in Google SAIF, CSA MAESTRO, and the OWASP Agentic Security Initiative. Two further passes expanded the taxonomy to 50: an adversarial review surfaced eleven cross-cutting risks, and a code-security pass closed the build-time and operational gaps (AI-generated insecure code, secure development lifecycle, patch and vulnerability management, runtime drift detection, and decommissioning) so the framework now runs end-to-end from how an agent is built to how it is retired.

Sources & standards

Risks are mapped to the OWASP Top 10 for LLM Applications 2025, the OWASP Agentic threat taxonomy, MITRE ATLAS, CSA MAESTRO, and NIST AI RMF. Every incident in the index carries a primary-source link; the live dataset is open in data.json and the source is MIT-licensed on GitHub.

Scope & limitations

This is a security-and-controls view of enterprise AI agents. It does not cover model bias, content safety, or AI ethics except where they create a security consequence. Several load-bearing examples (Morris II, Sleeper Agents, agentic misalignment) are controlled research demonstrations, labeled as such, not in-the-wild incidents. Coverage and gap calls reflect the public market as of the date below and will drift; verify every control against your own environment.

How to cite

Livshits, Danny. Securing the Agentic Enterprise: An End-to-End View of AI Agent Risk. 2026. https://dannyliv.github.io/e2e-Agentic-Risks/

Last updated

June 2026. The taxonomy, mapping, and incident index are versioned with the repository; the most current state is always the live site and data.json.