Black Hat USA 2026 | Ramin Farassat, Menlo Security

Clips
More from Black Hat USA 2026

Ramin Farassat

CPO

Menlo Security

play_circle_outline Menlo MARS Runtime Agent Visibility and Action Logging

play_circle_outline Orchestration layer as critical enforcement point for agent controls

play_circle_outline Mitigating Prompt Injection and Data Exfiltration with Real-Time Sensitive Data Masking

play_circle_outline Balancing speed of AI adoption with security and trust

Info
Transcript

Ramin Farassat, Menlo Security

Ramin Farassat

CPO Menlo Security

In this interview from Black Hat 2026, Ramin Farassat, chief product officer of Menlo Security, joins theCUBE's Krista Case to discuss how enterprises can secure AI agents as they gain access to sensitive data and take autonomous action. Farassat introduces Menlo Agent Runtime Security (MARS), built to monitor agents end-to-end as they perform tasks. He explains why agents can be "gullible," easily fooled by prompt injection into treating malicious commands as legitimate data, and why orchestration-layer enforcement must happen in real time rather than defens... Read more

explore Keep Exploring

What is Menlo MARS (Menlo Agent Runtime Security) and how does it address the risks posed by AI agents? add

Why is the orchestration layer the right place to enforce security for AI agents that access different tools, data, and external content? add

What is prompt injection, why are agents vulnerable to it, and how can it be mitigated (for example, in the MARS system)? add

How can enterprises balance the pressure to roll out AI quickly with the need for security and trust, and how does Menlo’s MARS (or the approach of enabling AI agents to act on trusted data) provide guardrails, visibility, and real-time controls to enable safe production adoption? add

bolt Powered by CUBE AI

Ramin Farassat, Menlo Security

search

Krista Case

>> Welcome back to theCUBE. We're live here at Black Hat 2026 at the Mandalay Bay in Las Vegas. We're talking today all things AI agents, and we're talking about the impact as they start to move into enterprise operations. They're doing things like reading web pages, documents, and emails. They're accessing enterprise data, and then they're using all of that information in context to start making decisions and take action. What we've seen is that security teams have spent years protecting users from malicious content, but now they have to start protecting the business from these AI agents that are acting on it. And this requires some new controls in terms of how AI agents interact with this untrusted information before they reach enterprise systems. I'm sitting down right now with Ramin Farassat, Chief Product Officer with Menlo Security. Ramin, thank you so much for joining us today.

Ramin Farassat

>> Great to be here, Krista.

Krista Case

>> Absolutely. Thank you again. So Ramin, we're seeing that security decisions are starting to move a little bit closer to that moment of action. So beyond just knowing that an AI agent exists or what it has permission to access, we need to start being able to evaluate what it's actually doing as it interacts with these enterprise systems and this sensitive data. So can you talk about where you're seeing traditional enterprise security controls fall short in this context?

Ramin Farassat

>> Sure. I think it'd be fair for me to give a quick brief overview of what we introduced beginning of this year.

Ramin Farassat

>> Sure.

Ramin Farassat

>> As part of our, what we call our Menlo MARS. MARS stands for Menlo Agent Runtime Security. And earlier this year we announced that we are just as our customers are, we're very concerned about the risks associated with AI agents. What can the agents do? And you briefed it really well. Agents have access to your data. That data can be exfiltrated And also agents could be quite gullible. An agent could be fooled with commands and prompts through prompt poisoning to perform tasks that it's not designed to be performing. So we built a platform specifically for that to be able to monitor what the agent is doing in runtime as it's performing the task end-to-end, we're monitoring what it's doing. And that's something that our customers are very interested and excited about. They want to be able to have visibility You mentioned that, that's something that, by the way, the regulatory organizations are coming up with information on. They're asking customers to make sure that they have full visibility into the actions of the agents. And that's something that we built into our platform.

Krista Case

>> Absolutely. Thank you. And yes, we saw the MARS announcement, certainly very exciting. And I wanted to also ask you a little bit about, so you talked about, runtime visibility. I also wanted to ask you about the orchestration, perspective and how you're seeing this be a critical control point because it's really where AI agents are accessing different tools, different data, and maybe any other external content. So when we think about enforcing security, why is this orchestration layer the right place to do that?

Ramin Farassat

>> Yeah, I think you need to look at it from the perspective of, one, what are the agents doing? Two, where are the agents? Today we see agents everywhere. We see them as an integrated part of applications. We see agents as part of the browsers that we use. If you're using a browser, you have this small sidebar that's within the browser, which is an agentic capability within the browser to be able to perform actions for you. You can ask it a question, but it also has access to the data that you have within the browser. So the visibility becomes very important because it's not one place and it's not one path that the agent can take. To get to where it's trying to get to.

Krista Case

>> Absolutely. And so when it comes to, actually enforcing what it can or cannot do, that's where that orchestration piece comes in as well.

Ramin Farassat

>> Exactly. And the orchestration has to be in runtime. Some companies have proposed dealing with agents in a defensive mode. We believe you have to be proactive.

Krista Case

>> Certainly. And like you say, especially at runtime when these agents are acting at machine scale.

Ramin Farassat

>> That's correct. That's correct. And the agents are also acting an order of magnitude faster.

Krista Case

>> Yes.

Ramin Farassat

>> And at a much higher number of agents, quantity of the agents. So, you have to have a system that can deal with that, that can deal with the performance and the speed of the agents.

Krista Case

>> Absolutely. So, Ramin, you spoke a moment or two ago about prompt injection attacks, and I wanted to double-click on those because they're an interesting security problem. here at Black Hat, we've been talking a lot about the vulnerability side of things, following the discussion around these frontier AI models like Anthropic Mythos and how they can uncover and exploit those at the speed and scale like never before, building on the comments you were just making, about AI. But when it comes to prompt injection, as you were alluding to, the agent is acting on information that it believes is legitimate. So can you maybe elaborate a little bit on why these particular types of attacks are so difficult to defend against? And then maybe frame the MARS platform that I know you mentioned, Menlo had that announcement. Maybe frame the MARS launch maybe in that context and how it's addressing that.

Ramin Farassat

>> Yeah. Let me start with prompt injection. Earlier I mentioned that agents could be thought of as being gullible. And the reason for that is because when we are interacting with the agents, the data that they're going through could be data or it could be an actual command. And sometimes they get fooled by that. They may assume that they're going through normal data and they see something that looks like a command and they act on it. For a human, we would ask a question. We would be questioning, why is there a command in the middle of the data that I'm going through? But the agent doesn't ask that question. It may continue to perform the task and act on that command and be fooled. I don't believe there will be a prompt injection technology that's going to be 100% safe and complete, that's going to stop every possible threat that could be out there. So what you have to do is you have to use that as one of the tools that you have in your tool bag to deal with various different types of threats. And that's what we did with MARS. We set policies, we control the actions that the agent can take despite what other commands would be telling it to do. We also make sure that we take information, the data that the agent is consuming, and remove sensitive information from that. We look for sensitive information in real time and we can mask that data as well.

Krista Case

>> And Ramin, I wanted to double-click on that piece of it, Because as we're alluding to here, it's very important that these AI agents are making decisions based on accurate and trusted information. There's the whole garbage in, garbage out, if they're not act— if they're either operating on either sensitive data or inaccurate data, then we're not going to get the outcomes that we're looking for. So maybe can you talk a little bit about why that particular piece of it? So, the focus on making sure that AI agents are acting on that trusted information, why that's such an important part of the security piece of the equation.

Ramin Farassat

>> Yeah. Imagine an agent has been designed to automate a task. You as the person who's designing that agent may actually allow it to use your identification. So that agent now has all of the capabilities that you had with all the access that you had to a specific part of that application and the data that's within, that's behind that application. Now, if that agent has been fooled by a command to take that data that you've had access to and send it outside your company, your company is now at risk. And that's where prompt injection comes into play. Prompt injection avoidance is to make sure that not only the agent understands what's the command and what's the data that it's accessing, but if there is something that's malicious, that you stop it before the agent can act on it.

Krista Case

>> Absolutely. And maybe we could also frame this in another conversation that I've been hearing a lot over the last couple days, which is that there's this pressure from enterprises to adopt and roll out AI as much and as quickly as possible. And security teams are having to make decisions about speed versus trust. And how can they not get in the way of enterprises adopting AI but provide at least a sufficient level of security and confidence to do so? So maybe you can talk about how the MARS announcement or just in general what we've been talking about here, AI agents being able to act on trusted data, for example, how this approach helps enterprises with sort of making that transition and helping enterprises to adopt AI in production.

Ramin Farassat

>> That's right. So you're absolutely right. All enterprises, they believe that they have to roll out AI. A year ago, we used to talk about stopping users from using specific tools, not letting them be able to develop their own programs, not be able to build agents. That's all gone. So next step that some companies took was to be able to put some guardrails around the actions of the agent by not allowing the agent to perform certain tasks. We have some customers that decided, for example, not to allow the agents to be able to get to the web because they believe that if the agent goes to the web and there's malicious information on the web, the agent could be affected. Problem is you can't do that anymore either because the agent has to be able to access the web to be able to retrieve information and get the job that it's trying to get done. So that's where we came in. That's where Menlo comes in. We make sure that we set specific rules and policies around the action of the agent based on what it was designed to do, and then as it's performing those actions, we'll provide full visibility and logging, and can stop the agent in real time as it's performing a task if the agent gets exposed.

Krista Case

>> So on the visibility, the logging, the ability to intervene, Ramin, I'd like to talk with you a little bit about what the human's role is in that equation. So what does the human oversight look like? Because we do need the ability to have visibility into what's going on, but also if something goes wrong, we need the evidence of what happened and again, that ability to intervene. So again, I think the question is, as these agents move into runtime, what does the human role look like, especially considering that we want to make sure that the human is not getting in the way and slowing down the speed that these agents can operate at?

Ramin Farassat

>> That's right. It's a really good point. And that, in fact, was one of the first things that we concentrated on. Bringing in the ability to have a human in the loop. As the agent is performing a function, have two capabilities. One, observability as a human, knowing actually what the agent is doing, and actually if something is going wrong, very quickly notify the human so the human can check the work of the agent and make sure it's actually doing what it's supposed to be doing. But also sometimes it's in a different way. You may have an application that the agent is accessing and the application requires more information. So you have to stop the action that the agent is performing, let the human come in, enter some information, and let the agent continue to do what it was doing. And that's what human-in-the-loop capability is that we brought in as part of MARS.

Krista Case

>> Yes, thank you, Ramin. And I think we're going to have the human-in-the-loop for the foreseeable future, right? I think it's definitely a conversation of one plus one equals three in terms of the human really augmenting what the AI can do in terms of, we're talking about the control. So the question is, as you think over the next maybe 12 to 18 months, what are some of the areas of expertise that you think humans will bring to the table that will be especially valuable in this equation?

Ramin Farassat

>> Yeah, let me first bring up another point that's really important. Human in the loop is definitely needed, and that's something that we've implemented into our system. But none of these tools on their own are going to be sufficient to truly protect our customers. So in addition to that, we've also brought in a lot of AI capabilities within our platform to be able to do things in an automated fashion, to be able to know what the agent is doing. And as we discover something that the agent is not supposed to be able to do, that we can stop it in real time. But the human functionalities are really, really key here as well. Being able to set rules based on policies and stop the action as the agent is performing a task. Check to see where the agent is, what type of function it's performing, and then go back to the original task. That's something that we do with our MaaS as well.

Krista Case

>> Absolutely. And how does the human think about keeping up with how perhaps the agent's behavior, might be evolving over time? maybe the role of the agent, its function to the business, maybe it's evolving and adapting over time. I'm anticipating that that might be dynamic. So can you talk about how that interaction between the human and the AI from a security perspective evolves?

Ramin Farassat

>> Great question. It all starts with visibility and observability, knowing what's actually happening out there. We used to talk about shadow AI as it applied to humans, knowing which applications have AI inside them. Now we talk about shadow agent. How do I know what agents are actually within my environment? What are those agents doing? And as they're performing the function, what's actually happening? That's really important and key to our customers, which is why we actually require agents to register and authenticate with our solution, with our MaaS solution, before they can actually perform the action. And as that action is being performed, continuously provide logging information and proof to the company. One of the things that companies are very concerned about right now, especially outside the US, is regulatory reasons that they have to provide data, and they need to know exactly what the agent did, what action it performed, and be able to present that for regulatory reasons. Those are things that we can do.

Krista Case

>> Yes, I think the auditability and the logging, as you mentioned, Ramin, for compliance requirements, I think we're going to be hearing more and more about that moving forward, especially potentially as those legislations evolve. And I think also even just from a security perspective, to be able to trace back if an agent does go rogue, I think that's going to be very important.

Ramin Farassat

>> That's right.

Krista Case

>> Yeah, absolutely. So I'm also kind of interested to get your perspective. We have obviously, we're here at Black Hat, we have a lot of practitioners, naturally that are here at the show. And I think the CISO role, they're trying to navigate all this deluge of information. So if they're thinking about maybe kind of where to begin in terms of effective governance for AI agents, what might be the piece of advice that you would give them in terms of, again, what's that starting point?

Ramin Farassat

>> Yeah, I get that question all the time from CISOs. Where do we even start? We have two classes of customers, customers that have deployed. They're very, very savvy and they understand exactly what to do with their AI agents. They ask the more difficult questions in terms of guardrails and how do they make sure that they're monitoring and observing everything that's happening. And then we have customers that know that their users are using various tools, they're using Claude, Cursor, they're building their own agents. And they want to know what to do about that. They know that their users are asking them to enable capabilities within their browsers using the sidebar. So that's what we usually tell our customers. I usually tell our customers to start simple, make sure that you start opening up some doors. For example, the browser sidebar, allow your users to use it with full guardrails that we provide. From there, let's look at how you can deal with the assistants, the development assistant tools, Claude, Cursor, Claude Code, if you're using Copilot, how do I make sure that I secure that chain and make sure that when those tools are reaching the internet and accessing the internet, that they can do that in a protected fashion? From there, moving to the more complex environment, which is autonomous agents. How do I deal with all the different autonomous agents? How do I bring visibility? And once I have visibility, how do I set policies? In fact, we've made it a little bit easier for them. We give them templates of policies so they can apply a template to be able to get there much faster than if they had to figure it out themselves.

Krista Case

>> I see, certainly. And plus, that gives them, I think practitioners are just struggling with understanding kind of the nuances of the requirements for securing these AI agents. So even beyond getting them up and running faster, it's also lending them that expertise.

Ramin Farassat

>> That's right, that's right. And the thing to keep in mind, and I know this may sound basic, but look, agents can scale much, much faster than we do with humans. They're much, much faster. They work at the speed of light. And then on top of it, With the agents, we also need to realize that an agent is smart enough to potentially take multiple paths. So making sure that you secure one path doesn't necessarily mean that you are fully secure.

Krista Case

>> It's going to find another way to do its job.

Ramin Farassat

>> That's right

Krista Case

>> . Absolutely. And Ramin, one more, I guess, question. So we've been talking a lot about governance and runtime. You also have talked a couple times about visibility. What I'm kind of hearing over the last couple of days is that practitioners are almost trying to solve both problems at the same time. So they are contending with understanding how AI is being used in their organization and where it's being used. And at the same time, they're trying to make sure that they're not behind in setting those guardrails.

Ramin Farassat

>> They're not doing what? Sorry.

Krista Case

>> Yeah. So making sure that they have the visibility side of things, understanding where AI is in use and how it's being used. And then also almost simultaneously make sure that they're applying security policies and guardrails quickly. I'm wondering, are you seeing that customers are almost trying to do both at once? And maybe how is Menlo addressing a double-click on how Menlo is addressing the visibility side of things as well?

Ramin Farassat

>> Yeah, yeah. It's a really good point. You see, if you're looking for visibility, but then you're not taking an action on that, you're still exposed. So in essence, you're going to have to have a system that gives you the visibility and can act on that visibility at the same time. And that's why we built the MARS solution to be real-time. It works at the speed of the agent and it works real-time. Visibility alone is not going to be enough. And if you don't have the visibility, you're not going to be able to actually take action either. So yes, what we're seeing with customers is exactly that. But they are looking at it in steps and increments. They're saying, If I'm going to be focusing on the tools that my users are using, for example, Claude Code, how do I put in a guardrail specifically on Claude Code? So I'm going to focus on that and I'm going to look at the channel that it's taking to be able to potentially get to the web or to an application. I'm going to secure that. I'm going to have visibility and security for that specific use case that I'm looking at.

Krista Case

>> That makes a lot of sense. So they're going hand in hand.

Ramin Farassat

>> Yeah, that's right.

Krista Case

>> Well, Ramin, Thank you so much. It's been a pleasure. We really appreciate you joining theCUBE.

Ramin Farassat

>> Thank you so much.

Krista Case

>> And thank you for joining. Make sure you check back in just a couple of minutes. We're going to be right back on the air live here again from Black Hat 2026.