Prisma AIRS Platform Overview

How API Intercept, Network Intercept, AI Gateway, and AI Model Security work together, and where inspection actually happens.

Prisma AIRS (AI Runtime Security) is Palo Alto Networks' multi-layer platform for securing AI applications, AI models, and AI agents. It addresses threats that traditional network security cannot: prompt injection, sensitive data leakage through LLMs, model supply-chain attacks, and rogue AI agent behavior.

Which Integration Is Right for You?

AIRS has four distinct integration paths. The right choice depends on whether you control the application source, how quickly you need to deploy, and what threat coverage you need. Answer two questions to get a recommendation.

Three Security Layers

AIRS secures AI at three distinct layers. Each layer has a different integration point, different visibility, and different coverage:

Strata Cloud Manager (SCM) as the Management Plane

Every AIRS component is configured, monitored, and managed through Strata Cloud Manager. SCM is not an inspection point; it is the operator control plane that connects licensing, policy, and telemetry for all pillars.

Panorama vs. SCM: Management Boundaries

AIRS Firewall VMs (used by Network Intercept, K8s & Containers, and Microperimeter) support Panorama management (requires Panorama 11.2.5+). The remaining pillars are SCM-only: API Intercept, AI Gateway, Model Security, Red Teaming, and Agent Discovery.

Pillar Comparison

One row per attribute. Use this to compare coverage, deployment complexity, and trade-offs before choosing an integration path.

API Intercept: Security-as-Code

API Intercept embeds security directly in application source code. The developer calls the PAN Scan API before sending a prompt to an LLM, after receiving a response, or both. No network infrastructure changes are required. Works with any LLM, any framework.

What Is Inspected (per security profile)

Verdict Simulator

Type a sample prompt to see what the JSON scan request and verdict response would look like. This is a local simulation; no real API call is made. It uses pattern-based detection to illustrate how each engine flags content.

← Type a prompt and click Simulate

← Result appears here

Network Intercept: Microperimeter / AIRS Firewall

Network Intercept provides inline L7 inspection of AI traffic without code changes. A software agent (panredirect) installed on each Linux workload redirects packets to a dedicated AIRS Firewall VM. The firewall decapsulates, inspects, and if AI traffic is detected, forwards content to the PAN AI Security cloud for deeper analysis before returning a verdict.

AI Gateway: Centralized LLM Proxy

AI Gateway acts as a proxy between AI applications and LLM providers. Instead of calling OpenAI or Anthropic directly, applications call the AI Gateway endpoint. The gateway enforces workspace budgets, rate limits, model allowlists, and basic guardrails, and logs every interaction for auditability. PII detection and deep threat scanning are handled by API Intercept, not AI Gateway.

AI Model Security: Pre-Deployment Scanning

AI Model Security scans ML model artifacts before they reach production. This is a pre-deployment gate, not a runtime tool. A developer or CI pipeline calls the Model Security CLI or Python SDK with a model URI and a security group. The PAN scanning service downloads the model, evaluates it against all enabled rules, and returns a PASS or FAIL verdict with PAIT threat codes for any violations.

K8s & Container Protection: PAN-CNI

For Kubernetes workloads, AIRS uses the PAN Container Networking Interface (PAN-CNI) plugin instead of a standalone panredirect agent. PAN-CNI is deployed via Helm to each K8s node and intercepts pod-level network traffic at the node. A Tag Collector DaemonSet discovers pod IP-to-label mappings from the cloud provider (AWS VPC CNI or Azure CNI) and pushes them to the AIRS Firewall, enabling policy that targets specific pod workloads by Kubernetes label.

Microperimeter: Standalone panredirect

The Microperimeter guide covers the panredirect agent in depth as a standalone deployment, useful for on-premises Linux servers, bare-metal hosts, or any environment where a full Terraform-based cloud deployment is not available. The core mechanics are identical to the Network Intercept GENEVE hairpin, but this guide focuses on agent configuration, steering rules, exception management, and diagnostics without the cloud deployment tooling.

AI Red Teaming: Adversarial Testing

AI Red Teaming is a pre-production testing service, not a runtime protection layer. The operator points the PAN Red Teaming platform at a target AI application, selects attack categories, and the platform autonomously fires 500+ adversarial attack scenarios sourced from Unit 42 and the Huntr researcher community. Results are mapped to OWASP LLM Top 10, NIST RMF, and MITRE ATLAS and delivered in a structured report within hours.

How Verdicts Are Generated

Each AIRS pillar uses a different verdict mechanism. Here is how each one scores content and issues an action decision.

API Intercept Verdict Logic

The Scan API runs multiple independent detection engines in parallel. Each engine returns a boolean flag (true / false). The overall action field is determined by the security profile: if any enabled engine fires with action = Block, the overall verdict is block.

The full response contains per-detection booleans so the application can log exactly which engine triggered and why:

{
  "action": "block",
  "category": "malicious",
  "prompt_detected": {
    "injection": true,
    "dlp": false,
    "url_cats": false,
    "toxic_content": false,
    "db_security": false,
    "malicious_code": false
  },
  "response_detected": {
    "dlp": false,
    "url_cats": false,
    "agent": false,
    "topic_violation": false
  },
  "scan_id": "...",
  "report_id": "..."
}

Network Intercept Verdict Logic

The AIRS Firewall identifies AI traffic by matching against known LLM endpoint URLs (or all traffic if Custom Model Support is enabled). Recognized AI traffic is forwarded to the PAN AI Security cloud. The cloud returns a verdict and the firewall enforces the action configured in the Security Policy Rule:

If the PAN AI Security cloud takes longer than Max Inline Latency (configurable 1–300 seconds), the Inline Timeout Action fires (Allow, Alert, or Block). This prevents inspection latency from disrupting user-facing AI applications.

AI Model Security Verdict Logic

The scanning service evaluates all enabled rules in the Security Group. Each rule is either blocking or non-blocking:

• Blocking rule violation: model FAILS. CI pipeline should reject the model.
• Non-blocking rule violation: model passes but a finding is returned. Use for informational checks.

The response includes an aggregate_eval_outcome (PASS/FAIL), severity counts (critical/high/medium/low), and a violations array with PAIT threat codes, affected file hashes, and remediation guidance.

Detection Engines — Technical Detail

Threat Intelligence Sources

Where Scanning Agents Live

A common question is: where does inspection actually happen? The answer differs by pillar:

Data Residency

SLS (Strata Logging Service) allows region selection at activation time (US, UK, India, Canada, Singapore). Logs can be stored in the customer's chosen SLS region. However, the AI scoring that produces those logs still occurs in the US.

API Intercept Rate Limits

API Intercept rate limits are automatically calculated from your Monthly Billion Tokens (MBT) subscription:

Formula: RPS = 50 + max(0, MBT − 5) × 5. Payload limits: 2 MB per synchronous scan, 5 MB per asynchronous scan, 100 URLs max per request.

Coverage Gap Map

Which pillar covers which threat? Use this matrix before finalizing your deployment plan. A gap means no protection, not "someone else handles it."

Individual Pillar Guides

Deep-dive deployment and configuration guides for each AIRS component: