01 — Red-Team ASI Coverage Matrix

What each vendor actually covers.

Primary — Capability directly maps to this risk category using the same definitions
Secondary — Inferred or adjacent link; capability addresses the category
No Coverage — Claims only; No publicly available evidence
Red-team-only OWASP ASI coverage matrix for 5 vendors. P indicates primary coverage, S indicates secondary coverage, dash indicates no coverage.
ASI Code Category Name Adversa Lasso NOMA Palo Microsoft Coverage
ASI01 Goal Hijack P P S P S 100%
ASI02 Tool Misuse & Exploitation P P P P P 100%
ASI03 Identity & Privilege Abuse P — — P S 60%
ASI04 Supply Chain Compromise P S S — P 80%
ASI05 Unexpected Code Execution P — P — — 40%
ASI06 Memory & Context Poisoning P P P P S 100%
ASI07 Insecure Inter-Agent Communication — — — — — 0%
ASI08 Cascading Agent Failures P — — — — 20%
ASI09 Human-Agent Trust Exploitation — — — — — 0%
ASI10 Rogue Agents S S — — P 60%
Total Coverage 8 / 10 5 / 10 5 / 10 4 / 10 6 / 10
02 — Findings

Five things the data makes clear.

Finding 01 · Saturation
Vendors focus on agentic risks that are testable through existing attack techniques.
Goal Hijack (ASI01), Tool Misuse (ASI02), and Memory & Context Poisoning (ASI06) are covered by all 5 vendors because they can be tested the same way you test a chatbot — feed it a bad input, see if it does something wrong. Vendors are convering agentic risk categories that most resemble familiar LLM and AppSec testing. But, it does not mean they're the most dangerous agentic risks - they are just the easiest ones to tool up for.
Identity & Privilege Abuse (ASI03) has solid coverage at 3/5 — it borrows from IAM testing playbooks. Supply Chain Compromise (ASI04) is covered at 4/5 via indirect injection testing.
Finding 02 · Breadth vs. Depth
Most vendors opt to offer high ASI coverage breadth through multiple capabilities.
Two of the broadest vendors by overall platform score — Noma (9/10) and Lasso (7/10) — both drop to 5/10 once you strip out AI-SPM and runtime monitoring, which aren't red-teaming. Their breadth comes from being wide security platforms, not from deep adversarial testing. Adversa, a pure red-team tool, scores 8/10 without any of that padding.
Finding 03 · Blind Spots
The most structurally novel agentic risk is not covered.
What happens when agents talk to each other (ASI07)? When a failure in one agent cascades to others (ASI08)? When a person trusts an AI agent's output more than they should (ASI09)? Only one vendor touches on Cascading Agent Failures (ASI08) risk. According to AIRQ framework, multi-agent and computer-use agents carry the highest blast radius and lowest existing defenses of any agent type. They're untested because testing them requires multiple systems running simultaneously, which no current product has built.
Human-Agent Trust Exploitation (ASI09) sits outside automated red-teaming entirely — the target isn't a system, it's a person's judgment.
Finding 04 · Permission Layer
Most vendors do not test whether the agent should have had the access in the first place.
Most red-teaming asks: "can I make the agent misbehave through a bad prompt?" But clients are asking "should this agent have access to that tool or MCP server at all? Does it hold permissions it was never supposed to have? Was access ever revoked?" Vendors test how agents behave; most vendors do not test what agents are allowed to do. Clients are concerned about the access at this time.
Prisma just released "Privilege Misuse Detection" (June 2026) and claims its one of the higher priorities, where it tests whether a user can manipulate an agent into bypassing its permissions, but this is still a behavior testing. Noma's AI-SPM inventories agent permissions and MCP servers, but inventory is posture management, not adversarial red-teaming. Adversa tests OAuth bypass and auth flaws which is exploit-focused, not governance-focused.
Finding 05 · Business Translation Gap
Vendors surface vulnerabilities and non-technical users are left to infer how it can harm their business.
Vendors output findings mapped to various technical framework. None of them go further into translating these findings into business impact (i.e., "you have an Insecure Inter-Agent Communication (ASI07) exposure" to "this is what that means for your business, who it harms, and how much it could cost.") Non-technical stakeholders receive the same raw output with no guidance on its impact, risk severity, or whether the finding warrants immediate action or accepted risk based on their risk tolerance.
Clients mention they don't want that translation to come from their legal team — they want it streamlined from the vendor doing the testing.
03 — Implications for Fortify

Where the market leaves room.

Fortify enters as a traditional AI red-teaming tool. These are the four market positions the data most directly opens up. Full opportunity mapping with the 4 AI Harms dimension in Appendix C.

Opportunity 01 · Business Translation
Translate findings into business decisions to stand out in usability.
Clients want to know whether they're exposed and what the cost implications are. No vendor in this analysis connects findings to business impact effectively. The recommendation is for Fortify to brand its output around the 4 AI Harms. For example, "This is a Commerce harm exposure — x blast radius, and based on your risk tolerance, fix it now." This can help turn the red teaming report into a business decision tool.
Opportunity 02 · Communication
Communicate risks and how Fortify actively combats them clearly to non-technical buyers.

Most vendors are poor at explaining what they cover and why it matters to anyone outside a security team. Several claim "100% OWASP coverage" without per-category evidence. Some inflate scores by conflating the OWASP LLM Top 10 and the Agentic Top 10. Fortify can differentiate by making its coverage claims legible via direct ASI code linkage, per-category evidence, attack scenarios, and findings written for product owners and executives with usability as a priority — not just for technical users.

Prisma's $900 withdrawal example: non-technical buyer can immediately grasp what the commercial risk looks like.

Opportunity 03 · Capability Gap
Assess Insecure Inter-Agent Communication (ASI07).
There is a gap in Insecure Inter-Agent Communication (ASI07) risk coverage. From this analysis, no vendors are red-teaming message spoofing, prompt injection across agent chains, or trust assumptions between agents. Testing it would be hard because it require a multi-agent harness and the framework itself flags it as a structurally new attack class. AIRQ framework mentions that the 'Coding agents' and 'Computer agents' have the widest attack surfaces and largest blast radiuses with the thinnest defenses. If Fortify can own risk category, this could significantly improve our market position.
Opportunity 04 · Access Controls
Identify the actions an agent is permitted to perform.
Clients are asking questions such as "why does this agent have access to that MCP server in the first place?" Current red-teaming asks whether an agent can be manipulated — it doesn't ask whether the agent's access grants were appropriate to begin with. Mapping the permission and authorization layer to identify who gave the agent what access, whether it matches its role, whether it was ever revoked is one of the most frequently mentioned capability request.
04 — The 4 AI Harms

A business language for agentic risk.

The 4 AI Harms framework maps risk along two axes, giving security teams a ready-made language for briefing non-technical stakeholders.

Vendor positions on the 4 AI Harms quadrant diagram
Note
Full vendor placements and harm mapping in Appendix C, Section C2.
05 — For Discussion

Open Questions.

Intended as discussion questions for the product team.

Prisma claims Goal Hijack (ASI01), Tool Misuse (ASI02), and Identity & Privilege Abuse (ASI03) represent the highest blast-radius risks for enterprise AI. Adversa on the other hand offers 8/10 breadth strategy. How should Fortify approach this market? is it more valuable to be broad vs. depth vs. novelty?
Insecure Inter-Agent Communication (ASI07) and Human-Agent Trust Exploitation (ASI09) are the ASI gaps across the market. This is partly because buyers are not demanding it yet, and hard to test. Is Fortify interested in exploring these risk coverages?
Platform vendors bundle red-teaming inside a broader security lifecycle. Alongside Adversa, Fortify currently compete as a standalone red-team tool - how should Fortify differentiate?
The 4 AI Harms (People Data, Company Data, Commerce, Reputation) offer a business-language bridge to ASI categories. Which harm quadrant should Fortify position itself in? How can it help market Fortify?