New Features - Prisma AIRS - August 2026

The AI Discovery with Cortex AISPM feature gives you complete visibility into your organization's AI assets and their security posture from within Prisma AIRS powered by Cortex Cloud. By connecting to Cortex Cloud's AI Security Posture Management (AI-SPM), Prisma AIRS can now:

• Discover and inventory every AI model, endpoint, dataset, and agent running in your cloud environments (AWS, Azure, GCP).

• Surface posture risks associated with those assets.

• Show dependency relationships between assets so you can understand blast radius.

• Recommend security workflows to initiate Red teaming for the discovered AI Agents and endpoints for assessing the risk of exposure and protection through runtime.

  Note: If you previously had to switch between Cortex Cloud and Prisma AIRS to get a complete picture of AI security posture, this integration brings discovery and risk data into a single platform.

  Note: This is available in Americas Region SCM tenants only. The Cortex Cloud tenant can be in any region.

AI Skill Security lets you scan AI skill packages for security and governance risks before you deploy them in your enterprise. A skill is a reusable package that extends the capabilities of an AI agent and can include executable scripts, prompt files, configuration files, and other resources. Because skills may execute code, access enterprise systems, or communicate with external services, allowing unvetted skills into your environment exposes you to supply chain risks that standard application security tools are not designed to detect.

When you upload a skill package, AI Skill Security performs static analysis of the package contents and evaluates the findings against a configurable set of security rules. The scan produces an Allowed or Blocked verdict along with detailed findings that identify the affected file, the type of behavior detected, and guidance for remediation. The built-in rules cover prompt integrity, arbitrary code execution, secrets disclosure, data exfiltration, obfuscated behavior, behavior integrity, and excessive permissions.

You can configure each rule independently, choosing whether a finding blocks the skill or is recorded as an alert only. After reviewing scan results, you can trust a specific skill version to allow it through future scans when findings represent known acceptable risks or confirmed false positives. Removing trust from a skill causes it to be re-evaluated against your current rule configuration on the next scan. To get started, see AI Skill Security.

Cloud Tracer gives network security and cloud administrators real-time visibility into how traffic moves within a single cloud, across regions, or spanning multiple clouds. Trace the exact hop-by-hop path between any two endpoints with detailed visualizations directly in the Strata Cloud Manager (SCM) UI. Instantly spot where connectivity breaks—whether it is a misconfigured route, a firewall drop, or a security policy violation.

Prisma AIRS now provides real-time visibility into running red teaming scans with Live Scan Progress. The in-progress scan page surfaces error rates, estimated completion time, a detailed error console, and a live indicator showing exactly what the scan is currently testing — replacing a view that previously showed only a status badge and a completed attack count.

When a scan runs against a target with intermittent connectivity, or content guardrails, failures can accumulate silently for hours. Without visibility into error rates during execution, users discover problems only after the scan completes or fails. Similarly, scans can take anywhere from twenty minutes to several hours depending on the attack library size and target response latency, and users have had no way to estimate when a scan will finish. Live Scan Progress closes both gaps and adds the context needed to decide whether a running scan is healthy or needs any attention.

Teams running frequent scans, particularly against rate-limited endpoints or agents behind content guardrails can now monitor scan health in real time, catch failing scans early, and make informed decisions about whether to continue or abort and reconfigure. The estimated completion time also helps users plan around long-running scans instead of checking back repeatedly.

Prisma AIRS encrypts all of your AI security scan data — including prompts, model responses, and tool calls — before storing it. Managing encryption keys provides direct control over this process. With this feature you can:

• Rotate - this creates a new key version and promotes it to primary; future uploads use the new version, and existing data remains accessible via the old version.

• Disable (per key version) - this disables a specific key version by number; data encrypted with that version becomes inaccessible within approximately 1 minute.

• Enable (per key version) - this re-enables a previously disabled key version, restoring read access to data encrypted with it.

Prisma AIRS AI Red Teaming now includes Memory Poisoning as a goal category, enabling you to test whether your AI agents are vulnerable to attacks that corrupt persistent memory through normal conversation. Because injected false information persists beyond the original session, these attacks silently influence future interactions and are difficult to detect.

When you select Memory Poisoning as a goal category in an AI Red Teaming scan, the system first determines whether the target agent is susceptible by analyzing whether it can both write data to a persistent store and retrieve that data in a later session. Agents without persistent memory are excluded from the test. For susceptible agents, AI Red Teaming generates attack scenarios tailored to the agent's function and the type of data it stores.

Results are scored and presented in the agent's scan report alongside findings from other goal categories, and each finding includes the specific scenario that was tested. If any memory poisoning attack succeeds, AI Read Teaming notifies you in the report to review and remove injected content from the agent's memory before resuming normal operations. Because AI Red Teaming does not modify the target agent's memory store, you must manually review and remove any injected content after the scan.

You should run memory poisoning tests when your AI agents store information across sessions, such as user preferences, past conversation context, or shared knowledge bases. In domains like healthcare, finance, or customer service, a compromised agent memory can cause the agent to relay incorrect information, violate policies, or expose sensitive data with no indication that the underlying data was tampered with.

Prisma AIRS AI Red Teaming now includes a dedicated n8n connection method, enabling organizations to red-team AI agents built in n8n directly from AI Red Teaming. Instead of manually configuring a generic REST or streaming target, you can point AI Red Teaming at their n8n agent's production webhook URL and begin scanning immediately.

Teams building AI agents on n8n previously had to configure these targets through the generic REST or streaming connection methods, which required manual setup of request formatting, response parsing, and session management. This added friction and created room for misconfiguration, particularly for multi-turn conversations where session state must persist across exchanges. The n8n connection method eliminates this overhead by handling the integration natively.

This connection method sends attack prompts to an n8n workflow's webhook endpoint using HTTP POST and reads the AI model's responses. It supports both REST and streaming scan modes and handles multi-turn conversations by generating a session ID that the n8n simple memory node uses to maintain context across turns. If your workflow includes file extraction nodes, you can enable multimodal file attacks, which deliver documents as base64-encoded payloads for the workflow to decode before passing content to the AI model.

The n8n connection method appears as a new option when creating an Agent target type. To configure it, you need an active n8n instance with a published workflow and the production webhook URL. If your organization builds AI agents or automated workflows on n8n and needs to assess their resilience to adversarial attacks, this connection method provides a direct path from your n8n deployment to a full red-teaming assessment without intermediate setup.

Prisma AIRS Runtime API now integrates natively with OpenAI Codex Enterprise. Security teams can enforce real-time threat prevention and Data Loss Prevention (DLP) across every developer prompt in their organization directly from the OpenAI Codex Enterprise admin dashboard; no plugins, no traffic steering, no developer workflow changes required.

Once configured, all prompts across your OpenAI organization are automatically routed through Prisma AIRS for inline inspection. If a threat is detected, a block verdict is issued before the prompt reaches the destination model or any connected MCP server.

Coverage includes:

• Secrets, credentials, PII, and proprietary code (DLP).

• Malicious code patterns, malicious URLs, and prompt manipulation attacks (threat detection).

Prisma AI Runtime Security now integrates with Anthropic Inference Hooks to inspect and govern Claude prompts before inference, including traffic from Claude, Claude.ai, Design, and Cowork.

When a user submits a prompt on a Claude surface within an enterprise tenant that has Prisma AIRS configured, Anthropic sends the prompt to the AIRS Runtime API for inspection before the model processes it. If Prisma AIRS returns a block verdict, the prompt is not forwarded to the model and the user receives a customizable error message instead.

What you can do with this integration:

• Apply your existing Prisma AIRS scan profiles to all Claude traffic in your organization.

• Block policy-violating prompts on the inference path, not after the fact.

• Correlate blocked prompts to Prisma AIRS scan reports using the reference ID returned in the denial.

• Cover all Claude surfaces from a single policy.

Note: This feature is available in the US region. Text content only.

You can now monitor Prisma AIRS Model Security scan activity in Strata™ Logging Service, so your security team can investigate AI model threats, track policy enforcement trends, and correlate scan findings alongside other security events without switching between tools.

Each log entry captures a complete record of the scan, including the overall verdict (ALLOWED, BLOCKED, or ERROR), the model source and version, the security group applied, the number of rules evaluated, and per-violation details such as the rule triggered, the threat category, and the affected file path. Once you enable Strata Logging Service on your tenant, scan entries appear automatically in the Log Viewer with no additional configuration required in Model Security.

With scan results in Strata Logging Service, you can search, filter, and export model security activity alongside your other security logs, building a durable, auditable record for monitoring, incident investigation, and compliance reporting.