One Policy for AI Security Across Every Cloud You Run

Your teams choose the best platform for each job. A model is pulled from Hugging Face, fine-tuned in Azure Machine Learning, registered in Databricks Unity Catalog, and served from Amazon SageMaker to an agent on Amazon Bedrock. Meanwhile, a developer hands the codebase to a coding agent on a laptop. Each platform secures its own part of that path. HiddenLayer connects to all of them, so the security team can see the whole path and apply one policy to it.

Your cloud's controls, and the layer beneath them

Major cloud providers have built controls for the AI they host, and it's wise to make good use of them. Amazon Bedrock Guardrails and Google Cloud Model Armor screen prompts and responses. Microsoft Defender for Cloud assesses how AI workloads are configured. These controls focus on what goes into a model, what comes out of it, and how the workload around it is set up.

HiddenLayer works alongside them, in the order a security team already thinks: find what you have, check it, test it, then protect it in production. Each step builds on the one before, and each runs across every platform you connect.

Start with what you have

You can't secure a model you don't know exists, so HiddenLayer starts with discovery. Connecting a cloud uses the access model that cloud already has. On AWS, it is a prepared CloudFormation template that creates a role you control. On Azure, it is a sign-in and an approval that grants read-only access, with no long-lived credentials. On Databricks, it is a service principal. You can start with a single account and add the rest as you go.

What comes back is one inventory: models and agents in Amazon Bedrock, models and endpoints in SageMaker, models, endpoints, and agents in Azure AI Foundry, the models, registries, and endpoints in Azure Machine Learning, and the catalogs, models, and endpoints in Databricks Unity Catalog. Every step that follows starts from that inventory.

Check every model you find

Discovery is what makes scanning possible. On Azure and Databricks, the same connection that lists a model also retrieves it for analysis, so the inventory becomes a set of scanned assets with a compliance status rather than a list of names. AI Supply Chain Security looks inside each model file for arbitrary code execution, embedded payloads, graph payloads, tokenizer tampering, and other threats that travel with the file from one platform to the next. Model Intelligence adds each model's architecture and lineage, so risk inherited from an upstream model is visible before deployment.

New models are checked on the way in. Scanning runs in the pipelines and repositories your teams already use, including GitHub Actions, Jenkins, Azure DevOps, JFrog Artifactory, and Hugging Face, and it can stop a flagged model before it reaches production. The default policy is strict: any detection marks a model noncompliant until you decide otherwise.

Test it the way an attacker would

A model that scans clean can still be talked into misbehaving once it sits inside an application or an agent. AI Attack Simulation draws on HiddenLayer's adversarial research and red team expertise to run automated attacks against your generative and agentic AI applications, with configurable test sets. The results show where an application is weak before an attacker finds it, and where runtime policy needs to be tighter.

Protect it in production

AI Runtime Security puts what you have learned into effect. It starts with a default policy, provisioned on first use with no configuration, that detects prompt injection and redacts personal data and API keys. Its system rules are written and maintained by HiddenLayer, and when HiddenLayer improves one, customers inherit the improvement automatically. It connects through the gateways and frameworks your teams already use, including LiteLLM, Azure API Management, AWS Strands, LangChain, and the OpenAI Agents SDK.

The same policy reaches the developer workstation, where AI Runtime Security follows a coding agent through each risky step of its session, from tool calls to shell commands, and blocks, redacts, or records according to the policy you set. Detections can flow to Splunk or Microsoft Sentinel, where your analysts already work.

One layer across every platform you adopt

Your teams will keep adding platforms. Each one brings its own console, its own controls, and its own view of AI. HiddenLayer gives the security team a single inventory across AWS, Azure, and Databricks, a way to scan models before deployment, and a single policy that spans from production traffic to the developer's laptop. Connecting the next account or workspace is an integration, done from the same settings page. And when it is time to buy, the full platform is available on AWS Marketplace, Microsoft Azure Marketplace, and Google Cloud Marketplace.

Your teams decide where AI runs. HiddenLayer makes sure security is already there.

‍