AI runtime security is the inline defense layer that inspects and controls AI activity while it happens – evaluating prompts, responses, and agent actions at the moment of execution rather than assessing configuration beforehand or reviewing logs afterward. Analysts increasingly use it as the category name for that layer specifically.
- Inline defense that inspects and controls AI activity as it executes
- Narrower and more specific than LLM security, which spans the lifecycle
- Requires placement in the request path, not adjacent observation
- Increasingly the category name analysts and buyers use for this layer
Why is AI runtime security important?
Runtime security matters because posture assessment and log review both operate outside the moment that counts. A configuration review tells you an agent is over-permissioned. A log tells you it acted. Neither is positioned to stop the action, and for an agent capable of writing to production or moving money, that gap is the whole problem.
The threat landscape reflects it. CrowdStrike documented malicious prompts injected into legitimate AI tools at more than 90 organizations during 2025, generating commands that stole credentials and cryptocurrency. Attacks arriving through content an agent reads cannot be prevented by hardening a configuration, because no configuration was violated.
The term is also worth using precisely because analysts have converged on it. Gartner and Forrester both use runtime security to name the inline layer, which makes it the phrase buyers now bring to vendor conversations. Treating it as a loose synonym for LLM security loses the distinction that made it useful.
What is AI runtime security?
AI runtime security is the set of controls that operate on AI activity during execution. Prompts are inspected before reaching a model, responses before reaching a user or downstream system, and agent actions before they complete.
Inline placement is the defining requirement. A control that observes from beside the request path can describe activity but cannot alter it, which makes it monitoring regardless of how sophisticated the analysis is. Runtime security sits in the path and returns a decision: allow, block, or modify.
The distinction from LLM security is one of scope rather than disagreement. LLM security is the broad discipline spanning training data integrity, deployment access control, inference-time inspection, and surrounding application architecture. Runtime security is the inference and action layer of that discipline. Every runtime control is an LLM security control; most LLM security controls are not runtime controls. Conflating them tends to produce evaluations that test one layer and assume the rest.
Types of AI runtime security
Runtime controls divide by what they inspect and by what they can do about it.
By inspection point, input controls evaluate prompts for injection attempts and sensitive data. Output controls evaluate responses for policy violations and confidential content. Action controls evaluate tool calls and permission changes before execution – the layer that text inspection cannot reach, since a tool call produces no output to filter.
By response capability, detection-only controls flag and record. Blocking controls refuse the request. Steering controls modify or redirect it so the task continues within policy, which matters because a control limited to refusal turns every marginal case into failed work.
A third axis is where enforcement sits architecturally. Gateway-based enforcement covers everything routed through it. Endpoint enforcement reaches local activity a gateway never sees. Most environments need both.
AI runtime security & Onyx
Onyx enforces at runtime through AI Guard, which inspects model calls inline using small language models trained for the task rather than pattern matching alone. Inspection covers prompts, responses, and agent actions, and every decision is recorded against the agent identity that triggered it.
Steering is what distinguishes the enforcement itself. An action can be modified or redirected at action time rather than only blocked, so an agent's task completes inside policy instead of failing at the boundary. Just-in-Time access then narrows what any action could reach, evaluating permissions at the request boundary rather than at role assignment, which removes the standing privileges most runtime incidents depend on. Runtime and prompt injection defense covers the inbound path, and AI Security covers the wider defense layer around it.
