Every security team can recite the surfaces they defend. Network. Endpoints. Users. Applications. Cloud.
That list held steady for twenty years. It shaped how tools got bought, how teams got structured, how budgets got justified.
AI added five more: prompts, models, agents, MCP tool calls, and the API connections running between them.
None of these show up in a SIEM. None of them respond to a firewall rule. Most of them are already live in production.
An attacker who understands how a model handles instructions can manipulate it without ever touching the network. A malicious tool call through an agent can move data without triggering a single endpoint alert.
The vendors see it. Gartner puts this market at $2.8B in 2026, reaching $16.4B by 2030. Acquisition activity in AI security has picked up noticeably this year.
What stays with me is the gap between deployment and governance. Teams are shipping agents faster than they are building the ability to watch them.
That gap is where the next few years of incidents will come from. Vert Noir Corp helps Seattle dental practices get HIPAA-compliant by identifying the gaps that actually matter and building the smallest solution that closes them.