AppSentinels Redefines API Security for AI Agent Era at RSAC 2026

API Security Startup Targets Workflow‐Level Threats from AI Agents

AT RSAC 2026, AppSentinels unveiled a major expansion of its platform to address a critical blind spot in modern application security: the rapid, automated chaining of APIs by AI agents. The company argues that traditional tools, which monitor individual endpoints, are no longer sufficient when AI agents can orchestrate complex workflows at machine speed.

“It’s not a single endpoint… it’s the way workflows are stitched together,” said Puneet Tutliani, co‑founder and CEO of AppSentinels. “That stitching is where problems emerge.” His warning comes as enterprises increasingly rely on AI agents that autonomously execute multi‑step processes across internal and external APIs.

Background: The Collapse of Security Boundaries

The shift is driven by a broader transformation in software development. AI is compressing the development life cycle, blurring the lines between writing, deploying, and operating code. In many cases, these steps now happen simultaneously, orchestrated by the same AI agents.

The result is not just faster development—it’s a collapse of traditional security boundaries. “When those boundaries collapse, so do the control points security teams have relied on,” explained a senior security architect familiar with the trends at the conference. Startups like AppSentinels are responding by shifting focus left—into requirements, the code generation tools, and the pipelines—and down into runtime environments.

AppSentinels’ Solution: Continuous Testing + Runtime Governance

AppSentinels, originally known for API security (featured at RSAC 2025), now combines continuous testing with runtime governance to model and monitor entire workflows. The system tracks how APIs are used in combination, not just in isolation, and provides visibility into which AI agents are operating and how they leverage APIs and tools.

This approach aims to detect logic flaws, bypassed controls, and unintended side effects that would be difficult to trigger manually. By treating AI agents as first‑class participants in business logic, AppSentinels attempts to secure the “stitching” that traditional endpoint‑focused tools miss.

Why This Matters for Enterprise Security

As AI agents automate complex sequences across APIs, the risk profile changes dramatically. A single flawed workflow can cascade across systems before human operators even notice. AppSentinels’ new agent‑driven interaction support is a direct response to this emerging threat landscape.

“The old assumption that risk lives only in individual API calls is now obsolete,” said Tutliani. “Security must evolve to where the logic is executed—and that logic increasingly spans multiple APIs, guided by AI.”

What This Means

For security teams, the message is clear: static endpoint protection is not enough. Organizations must adopt tools that understand workflows, monitor agent behavior, and enforce governance at runtime. The shift reflects a larger trend where application security moves from a series of discrete checkpoints to a continuous, context‑aware process.

Early adopters at RSAC 2026 praised the approach. “This is the first product I’ve seen that actually maps how AI agents interact with our APIs in real time,” noted a CISO from a Fortune 500 company who spoke on condition of anonymity because he was not authorized to comment publicly. “It changes how we think about trust and control.”

Looking Ahead

AppSentinels’ expansion signals that the API security market is pivoting to address AI‑specific risks. As more startups follow, the industry may see a new category emerge—one focused on securing AI‑driven workflows rather than just protecting endpoints. The company expects to release additional features in the coming months, including deeper integration with CI/CD pipelines and AI agent orchestration platforms.

“We’re still at the beginning of understanding what AI agents can do—and what can go wrong,” Tutliani concluded. “Our goal is to make security an enabler, not a blocker, in that journey.”