AI detection and response
Also written AI-DR
A security category for detecting, investigating and responding to threats in how AI is used — agents, model calls, MCP tools, AI applications — modelled on endpoint detection and response. An AI-DR control records what the AI did, alerts on risky behaviour and can block or contain it, rather than only reviewing models or configurations before deployment.
How MoorAI handles it: MoorAI checks what goes into an agent and what the agent reads, runs and replies, where it happens, and can coach, alert, mask, block, require a signed justification or end the session.
See also on-device AI-DR · detection vs prevention · runtime AIBOM
Related terms
-
On-device AI-DR
Defence & response
AI detection and response that runs on the machine where the agent runs, in or beside the agent process, rather than in a cloud service or network gateway…
-
Detection vs prevention
Testing & measurement
Detection notices something and produces a record; prevention stops it from happening. They are routinely conflated in agent-security claims, and the gap…
-
Runtime AIBOM
Defence & response
An AIBOM built from what is running and being used, not only from what is installed or declared: which model servers are listening, which MCP servers…
Defence & response
The vocabulary of running controls for agents: knowing what AI is present, cutting what it may do down to what it uses, catching misuse, and reconstructing an incident afterwards. Where MoorAI implements a term, a separate line under the definition says how; the definition itself stays vendor-neutral. To check one agent's configuration against these ideas, use the free permission right-sizer.