9. The AI Application Security Continuous Loop

Introduction

The Blueprint layers define what to protect. Layer by layer, you’ve built a defense architecture that covers data, models, infrastructure, users, access services, and zero-day threats. But security is not a one-time deployment – it’s a continuous cycle. Vulnerabilities evolve, attack techniques advance, and the AI systems you deploy today will face threats that didn’t exist when you first assessed them.

AI Scanner and AI Guard form the operational heartbeat of AI security. Scanner proactively assesses models for vulnerabilities before and during deployment. Guard provides runtime protection by filtering inputs and outputs in real time. Together, they create a continuous loop: scan for weaknesses, protect against them, validate that protections work, and improve based on what you learn. This cycle runs indefinitely – because attackers never stop adapting, and neither should your defenses.

AI Scanner: Proactive Assessment

AI Scanner is a pre-deployment and periodic assessment tool that evaluates AI models for vulnerabilities. Think of it as a penetration test specifically designed for AI systems – it probes models using known attack techniques and reports what succeeded, what the model is vulnerable to, and what needs remediation before the model reaches production.

What AI Scanner Does

Scanner evaluates models against a comprehensive library of attack techniques:

• Attack technique testing: Scanner runs known prompt injection variants, jailbreak attempts, and adversarial inputs against the model. It doesn’t wait for an attacker to find these vulnerabilities – it finds them first.
• Vulnerability identification: Scanner identifies which specific vulnerability categories the model is susceptible to, mapped to OWASP categories. A model might resist prompt injection but be vulnerable to system prompt leakage – Scanner distinguishes between these.
• Harmful content pattern detection: Scanner tests whether the model will generate harmful, biased, or policy-violating content under various conditions. This includes testing safety alignment under adversarial pressure.
• Data leakage assessment: Scanner probes whether the model has memorized and will reproduce sensitive training data – a key indicator of information disclosure risk.

OWASP Mapping

Scanner’s assessment capabilities map directly to the attack categories you studied in Chapter 2:

Deployment Options

Scanner is available in two deployment modes:

• Trend-hosted (cloud): Scanner runs in Trend Micro’s cloud infrastructure. Organizations send model API endpoints to be assessed. Ideal for teams that want assessment without infrastructure overhead.
• Self-hosted (on-premises/private cloud): Scanner runs within the organization’s own infrastructure. Model data never leaves the network. Required for organizations with strict data residency or air-gapped environments.

AI Guard: Runtime Protection

If Scanner is the pre-flight safety check, Guard is the in-flight protection system. AI Guard operates in the live request path, inspecting every prompt that enters and every response that exits an AI system in real time. It is the enforcement layer that turns Scanner’s findings into active defenses.

What AI Guard Does

Guard sits between applications and AI services, filtering traffic in both directions:

• Prompt injection blocking: Guard detects and blocks injection attempts – both direct injections in user prompts and indirect injections embedded in documents, tool outputs, or other data the model processes.
• Harmful content prevention: Guard filters responses that contain violent, illegal, abusive, or policy-violating content before they reach users.
• Sensitive information leakage detection: Guard scans model outputs for PII, credentials, system prompt fragments, and other sensitive data, redacting or blocking responses that would leak this information.
• Compliance enforcement: Guard applies content policies that ensure model outputs meet regulatory and organizational requirements – particularly important for industries with strict content regulations.

GA and Deployment

AI Guard reached general availability on December 1, 2025. Like Scanner, Guard offers dual deployment options:

• Trend-hosted: Guard runs as a cloud service. API traffic is routed through Trend’s filtering infrastructure. Low latency is maintained through optimized processing pipelines.
• Self-hosted: Guard runs within the organization’s network, ensuring no AI traffic leaves the environment. Required for organizations handling classified data or operating under strict data sovereignty requirements.

OWASP Mapping

Guard’s runtime capabilities defend against attack categories at the point of interaction:

The Continuous Loop

Scanner and Guard are not standalone tools – they form a continuous cycle where each phase feeds the next. Assessment informs protection, protection generates data that drives reassessment, and reassessment improves protection. The loop never stops because the threat landscape never stops changing.

The Scan-Protect-Validate-Improve Cycle

graph LR
    S["<b>SCAN</b><br/><small>AI Scanner assesses<br/>models for vulnerabilities.<br/>Attack technique testing,<br/>data leakage probing,<br/>poisoning detection.</small>"]
    P["<b>PROTECT</b><br/><small>AI Guard deploys<br/>runtime guardrails based<br/>on Scanner findings.<br/>Injection blocking,<br/>output filtering.</small>"]
    V["<b>VALIDATE</b><br/><small>Monitor Guard<br/>effectiveness. Re-scan<br/>periodically. Measure<br/>detection rates and<br/>false positives.</small>"]
    I["<b>IMPROVE</b><br/><small>Update Guard rules<br/>from new findings.<br/>Feed blocked patterns<br/>back into Scanner.<br/>Tighten protections.</small>"]

    S -->|"Identifies<br/>vulnerabilities"| P
    P -->|"Runtime logs<br/>& blocked threats"| V
    V -->|"New patterns<br/>& gaps"| I
    I -->|"Updated threat<br/>intelligence"| S

    style S fill:#1C90F3,color:#fff
    style P fill:#2d5016,color:#fff
    style V fill:#ffa726,color:#fff
    style I fill:#6a1b9a,color:#fff

Phase-by-Phase Breakdown

1. SCAN – Assess Models for Vulnerabilities

Scanner runs a comprehensive assessment against the model, testing every known attack technique in its library. The output is a vulnerability report that identifies:

• Which attack categories the model is susceptible to
• How severe each vulnerability is (does it require sophisticated exploitation or can a script kiddie trigger it?)
• Which specific prompt patterns succeeded
• What remediation is recommended

This assessment happens both pre-deployment (as a gate in the CI/CD pipeline) and periodically (scheduled re-assessments to catch drift or newly discovered vulnerability patterns).

2. PROTECT – Deploy Runtime Guardrails

Based on Scanner’s findings, Guard rules are configured to defend against the identified vulnerabilities. If Scanner found that the model is susceptible to role-play jailbreaks, Guard is configured with semantic detection rules for role-play patterns. If Scanner found data leakage risk, Guard’s output filtering is configured to detect and redact the specific data patterns that were exposed.

Guard’s rules are not generic – they are tuned to the specific model’s vulnerabilities, as identified by Scanner.

3. VALIDATE – Monitor and Reassess

With Guard deployed, the organization monitors its effectiveness:

• Detection rates: How many real attacks is Guard catching? Are there attack patterns that bypass the current rules?
• False positive rates: Is Guard blocking legitimate requests? High false positive rates degrade user experience and lead to teams disabling protections.
• New attack patterns: Are attackers using techniques that weren’t in Scanner’s library at the time of the last assessment?
• Periodic re-scanning: Scanner runs scheduled assessments to verify that Guard’s protections are still effective and to detect new vulnerabilities introduced by model updates, configuration changes, or newly discovered techniques.

4. IMPROVE – Update and Tighten

The Validate phase generates insights that drive improvement:

• Guard rule updates: New blocked patterns from Guard logs are incorporated into rule sets. If Guard catches a novel injection variant, that pattern is added to the detection rules.
• Scanner library updates: Attack techniques discovered through Guard’s blocking logs are added to Scanner’s testing library. The next assessment will include these patterns.
• Policy refinements: False positive analysis leads to policy tuning – making rules more precise to catch attacks without blocking legitimate use.
• Feedback to Blueprint layers: Findings feed back to the relevant Blueprint layers. If Guard is catching an unusual volume of data exfiltration attempts, that triggers a Layer 1 (Data) review.

The improvement phase feeds directly back into the next scan – and the loop begins again.

Scanner/Guard Across Blueprint Layers

Scanner and Guard are not confined to a single Blueprint layer. They operate across the entire stack, contributing assessment and protection capabilities to every layer you’ve studied.

The key insight: Scanner and Guard are the tools that make the Blueprint operational. The Blueprint defines what to protect. Scanner and Guard continuously verify that it’s protected and actively enforce those protections in real time.

Trend Vision One Integration

AI Scanner and AI Guard are GA components within the Trend Vision One platform. Scanner integrates with CI/CD pipelines for automated pre-deployment assessment, while Guard deploys as an inline filter between applications and AI services. Both components feed findings back to the Vision One console, providing security teams with unified visibility across the entire AI security posture. Scanner assessment results appear alongside AI-SPM findings and Guard blocking logs in a single investigation timeline – enabling security teams to trace a vulnerability from its discovery (Scanner assessment) through its runtime defense (Guard blocking) to its impact on overall posture (AI-SPM risk score).