What are the AI security vendor categories? A guide to the market map

AI security vendors fall into four categories in the CISO Tribune vendor directory, the network's single record of who sells what: AI model and agent security, AI firewalls and guardrails, workforce AI usage security, and AI governance. Each one defends against a different point of failure — the model and its agents, the traffic in front of a deployed AI application, what staff do with AI tools nobody approved, and whether an organization can show a regulator or a board that any of this is under control.

This page explains what each category covers and why it is a separate line of business, not a list ranking who is in it — cisonews.ai's own vendor map does that, filed by category with no scoring or "best of" language, per NETWORK-RULES §8.4.

AI model and agent security

This category scans, red-teams and monitors models, AI applications and autonomous agents at runtime for attacks and unsafe behavior — the defender's answer to the stages an attacker actually goes through. MITRE ATLAS, the adversarial-AI counterpart to the ATT&CK framework, names the sequence directly: Reconnaissance against the target AI system, Resource Development, Initial Access, then stages specific to AI systems such as ML Attack Staging and Exfiltration of the model itself or its training data.

A vendor in this category might scan a model for extraction or poisoning risk before deployment, red-team an agent's tool-calling behavior, or watch an agent's actions at runtime for a step outside its intended scope. cisonews.ai's own AI agents topic hub and MITRE ATLAS technique index track the real incidents this category exists to prevent.

AI firewalls and guardrails

Where the previous category defends the model itself, this one sits inline in front of an AI application already in production: filtering prompts, responses and tool calls before they reach a model or a user. The risk it answers is named directly in the OWASP Top 10 for LLM Applications' first-ranked risk, prompt injection — inputs that alter an LLM's behavior in unintended ways, including inputs a human reader would never flag as suspicious.

A guardrail product typically inspects for exactly this class of risk, plus adjacent ones OWASP also ranks, such as supply-chain risk from third-party models, data and plugins an application pulls in without the same scrutiny applied to the application's own code.

Workforce AI usage security

This category is not about an AI product a company built; it is about the AI tools employees already use on their own, often called shadow AI. The UK National Cyber Security Centre frames the risk plainly: staff pasting sensitive data into a public chatbot outside any system the organization secured or reviewed.

A vendor here discovers which AI tools and AI-enabled browser extensions staff are actually using, and what data is leaving the organization through them, so a security team is choosing to allow or block a tool with evidence, not guessing.

AI governance

The last category is the only one not aimed at a specific technical attack: inventory, policy, risk assessment and regulatory-compliance tracking for AI systems across an organization. It answers to frameworks rather than exploits, chiefly NIST's AI Risk Management Framework, whose four functions — Govern, Map, Measure, Manage — describe exactly what this category's tooling is built to operationalize: knowing what AI systems exist, what their risks are, and whether anyone is actually managing them.

A governance product is as likely to produce an audit trail for a regulator as a block on an attacker; cisonews.ai's own regulation tracker and the AI security rules topic hub cover the rules this category exists to help an organization meet.

How the categories relate

The four are not mutually exclusive, and the directory files a vendor by every category it genuinely sells into, not one forced choice: a platform that governs AI policy might also discover shadow AI use, since both are visibility problems before they are control problems. What the categories share is the point of failure each answers for: the model and its agents, the traffic around a deployed application, the tools staff add on their own, and the paper trail a regulator or a board will eventually ask to see.

Where to go next

The AI security vendor map lists every vendor the directory carries, filed into these four categories, alphabetically, with no ranking. Each name links to that vendor's one canonical page on cisotribune.com, which carries what it sells and the source for every fact (NETWORK-RULES §8.1). cisonews.ai does not keep vendor pages of its own.