Exabeam expands agent behaviour analytics for AI threat detection

Exabeam, known for its behaviour intelligence capabilities, has announced updates to its Agent Behaviour Analytics (ABA) system. The enhancements come as organisations increase their use of AI assistants and face growing requirements to monitor and secure digital interactions.

The updated functionality is designed to improve visibility into how AI agents, including tools such as OpenAI ChatGPT and Microsoft Copilot, are used. This supports organisations in establishing baseline AI behaviour, identifying potential misuse, and detecting emerging insider threats in environments involving AI agents.

The updated features of Exabeam include:

• AI Behaviour Baselining: Creation of dynamic profiles for users and AI agents to monitor interaction patterns such as request volumes, tool usage, and activity spikes. Deviations from expected behaviour can trigger alerts for investigation.
• Prompt and Model Abuse Detection: Detection of prompt injection and model manipulation attempts, supported by an updated detection library to identify abnormal AI agent activity.
• Identity and Privilege Monitoring: Monitoring of AI agent permissions and changes to roles or access rights, with oversight aligned to traditional enterprise identity controls.
• Agent Lifecycle Monitoring: Visibility across the full lifecycle of AI agents, from creation through to usage, ensuring actions remain auditable and traceable for security teams.
• Coverage for OWASP Top 10 for Agentic AI: Alignment with OWASP standards to support structured approaches to managing AI-related security risks.

The increased adoption of AI agents is contributing to a more complex threat landscape, with both human users and autonomous agents interacting with enterprise systems at scale.

These updates to ABA are intended to support enterprises in improving oversight of AI-related activity. Enhancements to Exabeam’s New-Scale and LogRhythm platforms also aim to streamline workflows and reduce alert fatigue, supporting threat detection and response processes.