AIDR means AI detection and response: watching AI systems for misuse or attack and acting on what you see. It is often confused with guardrails, which block bad inputs and outputs, and with AI posture management, which checks configuration. The terms overlap, so this glossary separates them by what each one does and when.
There is no single standard definition of AIDR. Vendors use the word differently, so treat the entries below as working definitions and ask suppliers to define their own.
Terms that describe what happens at runtime
AIDR. Detection and response aimed at AI systems. The idea mirrors endpoint detection and response, but the telemetry is prompts, model outputs, tool calls and agent actions. The response part matters. A product that only logs is monitoring, not response.
Guardrail. A control that sits in the path and allows, blocks or rewrites something. A guardrail might refuse a prompt that asks for another customer's data, or stop an agent from calling a tool it was never granted. Guardrails prevent. AIDR detects and reacts, often using the same signals.
LLM firewall. A common name for a guardrail layer placed in front of a model, inspecting prompts and responses. The word firewall suggests network filtering, but the inspection is about content and intent. Safeguard's AI Gateway, which fills this role, is in early access.
Prompt injection. Text that tries to change what a model does by hiding instructions in input, including content the model fetched itself. It heads the OWASP Top 10 for LLM Applications 2025 as LLM01.
Excessive agency. OWASP's LLM06. An LLM system holds more permissions than its task needs. This is the reason agent permissions are a security topic and not only a product choice.
Terms that describe what you review before and after
AI-SPM. AI security posture management. It inventories models, datasets, endpoints and settings, and checks them against a baseline. It answers "what do we have and is it configured sanely", not "is something happening now".
AI-BOM. A bill of materials for AI components: model, version, training data sources, libraries. It is to a model what an SBOM is to a build.
AI red teaming. Deliberate testing in which people or tools try to make a system misbehave, then report what worked. Done before release and on a schedule. It finds weaknesses, while AIDR finds attempts in production.
Evaluation. Measuring quality or safety against a test set, for example how often a model refuses a banned request. Evaluations are repeatable and cheap, but a passing score does not mean the system holds up against a determined person.
Terms people confuse with each other
Detection vs prevention. Prevention stops the event. Detection notices it. You need both because prevention rules never cover everything, and detection with no response path produces alerts nobody acts on.
Monitoring vs response. Monitoring collects. Response contains: revoke a token, disable a tool, quarantine a session, notify an owner. Ask any vendor which actions are automatic, which need approval, and which are manual.
Model security vs application security. Model security concerns the model itself, including poisoning (LLM04) and extraction. Application security concerns how your software uses the model, including output handling (LLM05) and tool access. Most teams that build on hosted models spend more time on the second.
Agent identity vs user identity. An agent acts under credentials, and those credentials need an owner, scope and expiry like any other account. Tracking which agent holds what access is a separate job from checking what a user typed.
A quick way to tell which term you need
Ask what you are trying to do. Stop bad content in real time, look at guardrails. Discover what AI you run, look at inventory and AI-SPM. Find weaknesses before launch, run red teaming. Know when someone attacks live systems and act, look at AIDR.
What to do
- Write your own one-line definition for each term and share it internally.
- Ask vendors which of these terms their product covers, in writing.
- List your AI systems and the permissions each tool or agent holds.
- Decide who can disable an agent or tool in an emergency.
- Add AI events, such as tool calls and blocked prompts, to your normal logging.
Where Safeguard fits
Safeguard offers an MCP Guardrail, a proxy placed in front of MCP servers to enforce policy on tool access, and agent identity, which tracks which agent holds what access at what level. Both are generally available. The AI Gateway is early access. Safeguard is not a full AIDR replacement.
Quick check
Is AIDR the same as an LLM firewall?
No. A firewall blocks in the request path. AIDR adds detection across activity and a response workflow. Many products combine both.
Does a clean red team report mean AIDR is unnecessary?
No. Red teaming is a point in time test. Live systems face new inputs every day.
Sources
Last reviewed: 18 October 2026.
