Agentic Defense Platform Z-ADP
Consultative deception & containment demonstrator · post-Mythos threat model
01Deception Arena
02AI-SPM Posture · Glasswing
03Containment ROI
04Threat Intel
05Auto-Heal
06ThreatLabz Report
Threat Actor
Autonomous AI
Mythos-class agent
Attack Speed
{{ speedVal }}{{ speedUnit }}
to full lateral spread
Blast Radius
{{ blastVal }}
{{ blastSub }}
Zscaler Posture
{{ postureText }}
{{ postureSub }}
Defense Mode
Zscaler OFF
Zscaler ON
{{ modeHint }}
Attack Chain
{{ s.title }}
{{ s.desc }}
Threat Canvas — Live Attack Graph
{{ statusText }}
AI Agent
mythos-7b · unmanaged
Authorized App
crm.internal
Auth Service
10.0.1.15
{{ svcR.label }}
10.0.5.23
Zscaler Decoy
{{ decoy.sub }}
Sensitive DB
{{ db.sub }}
Observed Anomalous Contained
Verdict
{{ verdictIcon }}{{ verdictText }}
{{ verdictDesc }}
Telemetry
{{ t.k }} {{ t.v }}
MITRE ATT&CK
{{ m.id }} {{ m.name }}
Deception Scenario Studio
Author your own talk tracks in markdown · link OWASP Top 10 for LLM threats · train presales
Scenario Library
{{ c.code }} {{ c.name }}
Green dot = a saved talk track exists. Edits persist in your browser.
{{ activeThreatCode }} · {{ activeThreatName }}
# heading · **bold** · *italic* · `code` · - list · 1. steps · > quote · [text](url) · --- rule
{{ mdHtml }}
OWASP Top 10 · LLM 2025
Click to link a threat into your scenario.
{{ o.code }}{{ o.name }}
{{ o.blurb }}
{{ o.z }}

AI Security Posture Mapper

PROJECT GLASSWING

Ingest an LLM pipeline definition. Z-ADP maps every inference flow, scores guardrail coverage, and generates a Zscaler inline policy to close the gaps — shifting the conversation from static DLP to continuous AI-SPM.

Pipeline Definition
acme-support-rag.json 
{{ pipelineJson }}
Posture Score
{{ spmScoreLabel }}
{{ spmScore }}
{{ spmScoreDesc }}
Findings
{{ f.sev }}
{{ f.title }}
{{ f.desc }}
Zscaler Remediation — Generated Policy
{{ remStatus }} 
{{ remYaml }}

90-Day Deception & Containment Calculator

Quantify the exposure delta between legacy detection and Zscaler instant containment, aligned to the Cloud Security Alliance post-Mythos emergency mandate.

Variables
Time-to-Detect (legacy){{ calc.ttd }} min
Cost per minute of breach{{ costStr }}
Number of internal APIs{{ calc.apis }}
Exposure per agentic incident — legacy
{{ perLegacyStr }}
With Zscaler containment
{{ perZStr }}
Attack Surface vs. Time
Legacy perimeterZscaler deception
{{ g.label }} Zscaler contains ~0.9s {{ g.label }} Minutes since initial access
90-Day Exposure · Legacy
{{ legacy90Str }}
assumes {{ incidents }} agentic incidents / quarter
90-Day Exposure · Z-ADP
{{ z90Str }}
instant deception + isolation
Avoided Loss / 90 Days
{{ saved90Str }}
{{ savedPct }} reduction in exposure
AI Security Threat Intel
Curated feed of agentic-AI attacks, LLM CVEs, and prompt-injection research · use in discovery to show the threat is real and current
Updated Jul 18, 2026
By the numbers · 2026
{{ s.v }} {{ s.k }}
The Zscaler angle
Nearly every story here is a manipulated agent reaching something it never should. Zero Trust + inline AI inspection and deception cut the blast radius — walk the prospect from a headline straight into the Deception Arena.
Open Deception Arena
Self-Healing Security Pipeline
Continuous OWASP ZAP scans → auto-filed GitLab issues → AI-drafted fix → human-in-the-middle approval → CI/CD deploy & re-scan
Remediation loop armed
Remediation loop
{{ h.n }}
{{ h.t }}
{{ healDetailTitle }}
{{ healDetailDesc }}
Merge Request !219
fix: parameterize /api/reports query · src/routes/reports.js
CWE-89
{{ mrBanner }}
- const q = `SELECT * FROM reports WHERE id = ${req.query.id}`;
- return db.query(q);
+ const q = 'SELECT * FROM reports WHERE id = $1';
+ return db.query(q, [req.query.id]);
+ // test: reports.injection.test.js
Drafted by the remediation agent · 2 files changed · ZAP alert “SQL Injection” will re-verify on deploy.
Approve & merge
Request changes
Human-in-the-middle gate — approval required before CI deploys
GitLab Issues
{{ i.kindLabel }} {{ i.id }} {{ i.prio }}
{{ i.title }}
{{ i.status }} by {{ i.by }}
Admin Access
Approved admins can file feature requests & bug fixes straight into GitLab
Sign in to create GitLab issues from the UI.
GContinue with Google
oproxb@gmail.com is the first approved admin. Other accounts land in a pending-approval state.
Choose an account
O
oproxb@gmail.com
Approved admin
D
dev.contractor@gmail.com
Not yet approved
Cancel
Access pending approval
Signed in as {{ authEmail }}. An approved admin (oproxb@gmail.com) must grant access before you can file issues.
Sign out
New GitLab issue
Feature request
Bug fix
{{ p.label }}
Create issue in GitLab
O
{{ authEmail }}
Approved admin
Issues you create are labeled and dropped into the same backlog the remediation agent watches. New items appear at the top of the GitLab Issues list above.
Sign out
THREATLABZ Enterprise AI Security Report · 2026
How the enterprise really uses — and leaks to — AI
A year of AI/ML traffic, data movement and data-loss signals across enterprise environments. Toggle a metric to explore the leaderboard.
18,033TB
enterprise data transferred to AI/ML apps — up 93% YoY
+99.3%
ChatGPT DLP violations YoY — mostly name & national-identifier leakage
+100%
Codeium DLP violations YoY — rising source-code & IP leakage risk
Transaction volume
Data transferred
DLP violations
{{ metTitle }}
{{ metSub }}
{{ r.rank }} {{ r.name }}
{{ r.val }}
Top blocked AI apps
{{ b.rank }} {{ b.name }}
Grammarly and ChatGPT alone account for over 5,600 TB of data sent to AI — the apps handling the highest-value enterprise content are also the busiest. That is exactly where inline inspection and DLP matter most.