HiddenLayer

Prebuilt integrations reach CI/CD, MLOps, data pipelines and SIEM/SOAR, with integrations for Microsoft Sentinel, Splunk and a GitHub Action, and the runtime plugs into agent gateways and execution frameworks to block or redact agent traffic as it passes through. Named frameworks and gateways include LangChain, LiteLLM, the OpenAI and AWS Strands guardrails SDKs, Azure API Management and the TrueFoundry AI Gateway, and the JFrog Artifactory integration blocks malicious model downloads.

SourceHiddenLayer, docs.hiddenlayer.ai integrationsread 2026-10-05

HiddenLayer runs a fixed product pipeline across four modules (discovery, supply chain scanning, attack simulation, runtime detection and response). It does not orchestrate the customer's agents, and customers do not build flows in it. The platform is agentless and model agnostic and needs no training data.

SourceHiddenLayer, hiddenlayer.com/platformread 2026-10-05

AI Discovery builds an inventory of the customer's AI applications, models and assets, and supply chain scanning produces an AIBOM for each model, a map of the customer's AI assets. There is no knowledge store for agents to draw on. Discovery covers Bedrock, Bedrock Agents and SageMaker on AWS, Databricks Unity Catalog, and Azure AI Foundry and Azure ML.

SourceHiddenLayer, docs.hiddenlayer.ai and integrationsread 2026-10-05

Agentic runtime policies assign each detection rule an action of Block, Detect or Redact on the customer's agent sessions. The customer sets these policies, and there is no step that asks a person to approve an agent action before it goes through. A rule only describes a condition, the policy decides what happens, and a policy takes effect once a project references it.

SourceHiddenLayer, docs.hiddenlayer.ai agentic policyread 2026-10-05

HiddenLayer reports SOC 2 Type II covering security, availability and confidentiality, and offers single sign-on, user management and a console audit log. Runtime redaction can strip entity types such as US Social Security numbers, email addresses and phone numbers from output.

SourceHiddenLayer, hiddenlayer.com/security and docs.hiddenlayer.ai agentic policyread 2026-10-05

Agentic Sessions reconstruct each of the customer's agent sessions as "a clean, ordered, turn-by-turn replay: the user prompts, the model's tool calls and results, and the final answers, with any blocked or redacted moments marked in place", which records each tool call the customer's agents make. Runtime detections flow to Microsoft Sentinel through Log Analytics, to Splunk, or to any application by webhook.

SourceHiddenLayer, docs.hiddenlayer.ai agentic sessions and integrationsread 2026-10-05

There is no memory for the customer's agents or for an agent of HiddenLayer's own. The inventory and AIBOM map the customer's AI assets, and session replay records past sessions. Neither is memory that an agent reads.

SourceHiddenLayer, docs.hiddenlayer.airead 2026-10-05

Self-hosted installation of the platform is available (embedded cluster or Helm), and AI Runtime Security is deployed by Helm in the customer's environment, alongside the AWS-hosted SaaS. HiddenLayer says it deploys in minutes without exposing model weights, prompts or customer data.

SourceHiddenLayer, docs.hiddenlayer.ai self hosted Helm install and hiddenlayer.com/platformread 2026-10-05

Prebuilt detection rules and red team prompt sets ship with the platform, though the catalog has no name and there are no prebuilt agents. The detection rules cover prompt injection, PII, code, suspicious URLs and exfiltration hosts, oversized inputs, guardrail refusals and message language.

SourceHiddenLayer, docs.hiddenlayer.ai attack simulation and agentic policyread 2026-10-05

Runtime detection fires on every prompt, tool call and response passing the runtime proxy or agent gateway, and supply chain scans run in CI/CD through the GitHub Action, so neither waits for a person to start it. Model scans also run from Azure DevOps, Jenkins and JFrog Artifactory, and runtime detections can go out by webhook as they happen.

SourceHiddenLayer, docs.hiddenlayer.ai agentic sessions and integrationsread 2026-10-05

HiddenLayer secures and tests models instead of serving or routing them. The runtime proxy accepts several LLM API formats so it can sit in front of different providers, but it does not pick or route models. From the console, red team tests can run against a range of foundation model providers.

SourceHiddenLayer, docs.hiddenlayer.ai API format support and attack simulationread 2026-10-05

HiddenLayer offers a Python SDK, API keys and API routes, and an AI Supply Chain Security CLI, and attack simulations can be run via API. There are Java and TypeScript SDKs as well. A runtime policy applies to a project, and an evaluation call names that project in a header.

SourceHiddenLayer, docs.hiddenlayer.ai Python SDK, integrations and agentic policyread 2026-10-05

Red teaming covers the customer's own deployed AI applications. AI Attack Simulation runs red team and system prompt evaluations via API against any application reachable from the internet, reports success rates, failure reasons and interactions, and can run in the release pipeline. System prompt evaluations also suggest improved prompts, and results become baselines that teams track and compare over time. The application under test needs a public interface.

SourceHiddenLayer, docs.hiddenlayer.ai attack simulationread 2026-10-05

There is no browser or computer use. HiddenLayer's products inspect prompts, tool calls and model files instead of operating applications themselves.

SourceHiddenLayer, docs.hiddenlayer.ai and hiddenlayer.com/platformread 2026-10-05