# Humanbound > Humanbound secures the AI execution layer so enterprises can adopt AI with confidence. Humanbound is an open-source AI agent security platform that provides continuous adversarial testing, runtime firewall protection, and quantified posture scoring for AI agents deployed in enterprise environments. The testing engine, SDK, and CLI are Apache-2.0 licensed and run locally with no login required. The platform adds continuous monitoring, finding lifecycle management, cross-session intelligence, and managed infrastructure for teams operating security across a fleet of agents. Trusted by Eurobank, Eurolife FFH, and Viva.com. Seed-funded by Uni.Fund. Based in Athens, Greece. ISO 9001 and ISO 27001 certified. ## How Humanbound Works Humanbound secures AI agents across three phases: test before launch, protect at runtime, and monitor continuously after deployment. ### Test Before Launch Automated adversarial and behavioral testing aligned to OWASP standards. The engine runs multi-turn, score-guided attack scenarios covering prompt injection, jailbreaks, data exfiltration, tool abuse, privilege escalation, memory poisoning, and more. Attacks adapt turn-by-turn based on the agent's responses. No SDK installation or agent modification is required. Point Humanbound at any API endpoint and it tests it as a black-box adversary. Install and run: ``` pip install humanbound export HB_PROVIDER=openai export HB_API_KEY=sk-... hb test --endpoint ./bot-config.json --wait hb posture hb report -o report.html ``` Full air-gap support with Ollama for zero external API calls: ``` export HB_PROVIDER=ollama export HB_MODEL=llama3.1:8b hb test --endpoint ./bot-config.json --scope ./scope.yaml --wait ``` ### Protect at Runtime The Humanbound Firewall sits between users and your agent. It evaluates every input before it reaches the model, using a four-tier architecture: - Tier 0 (Sanitization): Strips invisible control characters, zero-width joiners, and bidi overrides. Sub-millisecond, free. - Tier 1 (Basic Attack Detection): Pre-trained ensemble models (DeBERTa, Azure Content Safety, Lakera, others). Catches approximately 85% of prompt injections out of the box. 15-50ms, free. - Tier 2 (Agent-Specific Classification): A classifier trained on your own adversarial test data. Catches attacks that Tier 1 misses and fast-tracks legitimate requests. 10ms, free. - Tier 3 (LLM Judge): Deep contextual analysis against your agent's security policy. Only called when Tiers 1 and 2 are uncertain, which is roughly 10-15% of traffic. 1-2 seconds, token cost. Each tier either makes a confident decision or escalates. No forced decisions at low confidence. Install and use: ``` pip install humanbound-firewall ``` ```python from humanbound_firewall import Firewall fw = Firewall.from_config("agent.yaml") result = fw.evaluate(user_input) if result.blocked: return result.explanation ``` The firewall trains on your Humanbound adversarial test logs using `hb firewall train`, creating agent-specific classifiers that improve over time. ### Monitor Continuously When models update, prompts change, or new data sources are connected, testing adapts automatically and prioritises the areas where coverage gaps are widest. The platform provides a living posture score that reflects reality, not a point-in-time PDF. Drift detection alerts when agent behavior regresses. SIEM integration via webhooks with CEF events. ## ASCAM: Autonomous Security Assurance Campaign Manager ASCAM is the intelligence engine behind continuous monitoring. It runs a daily loop asking one question: what should I test next? ### Activity Cycle ASCAM operates in three modes: - ASSESS: Broad baseline assessment across all threat categories. Runs when a project is new, when the last assessment is more than 7 days old, or when a significant configuration change is detected. - INVESTIGATE: Deep-dive into specific threat categories where critical findings or coverage gaps exist. Activates when assessment reveals high-severity issues. - MONITOR: Lightweight continuous checks to catch regressions. Retests known findings, fills coverage gaps, and maintains a 10% exploratory rate for discovering new attack surface. Default steady-state mode. Activities do not chain automatically. Each cycle, the Decision Engine evaluates signals from scratch and routes to the appropriate activity based on current findings, coverage, posture, and drift. ### Daily Execution Every day at 05:00 UTC, the scheduler runs for every active project: orphan cleanup, decision engine evaluation, campaign generation, campaign execution, and post-processing (clustering, finding reconciliation, coverage tracking, drift detection, posture scoring, webhook events). ### Self-Learning Strategy Engine Successful attacks are extracted from reasoning test logs, deduplicated via embedding similarity (cosine threshold 0.85), and persisted as per-project strategies. Active strategies are injected into future test runs, tracked for effectiveness via markers, and retired when they stop working (consecutive ineffective count of 2 or more, with at least 3 uses). Maximum 50 strategies per project. ## Adaptive Attack Intelligence The attack platform adapts in real time within each conversation and across testing cycles. ### Per-Conversation Adaptation - Score-guided refinement: 0-10 LLM scoring per turn with feedback injected into the attacker's next prompt. - Backtracking: Reverts to the best-scoring checkpoint when the agent issues hard refusals. Maximum 2 backtracks per conversation. - Phase-aware escalation: EARLY phase uses single techniques, MID phase combines 2, LATE phase applies maximum pressure with 3 or more combined techniques. ### Cross-Conversation Intelligence Within a single experiment, multiple attack categories run in parallel. Techniques that score 6 or above in one thread are shared with all other threads via a shared registry. If one thread discovers that a specific combination works against this agent, other threads adopt it immediately. ### Attack Categories 22 attack categories mapped to OWASP LLM Top 10 and OWASP Agentic Security Initiative (ASI): Tier 1 (7 baseline, always tested): Prompt injection, information disclosure, system prompt extraction, restriction bypass, scope violation, hallucination, unsafe output. Tier 2 (15 agentic, tested when telemetry is available): Privilege escalation, tool abuse, multi-step exploitation, data exfiltration, resource exhaustion, memory poisoning, supply chain attacks, cross-session data leakage, and others. 81 inline attack templates with structured multi-turn formats (goal, method, trust-building turn, bridge, escalation). Plus encoding variants: Base64, ROT13, bijection learning, acrostic/steganographic, and Unicode tricks. ### Reasoning Engine A chain-of-thought discovery engine that invents novel attacks from first principles, without relying on templates. Successful discoveries are extracted and added to the per-project strategy pool for reuse. ### Canary Detection Cross-session data leakage testing. Plants realistic data items (booking references, email addresses, account numbers) into the agent's context through benign conversations, then runs adversarial conversations to test whether that data leaks across sessions. ### Whitebox Telemetry When the project's integration includes telemetry (LangFuse, LangSmith, OpenAI tool/memory/resource data), the orchestrator fetches observability traces after each conversation and passes them to the Judge for evaluation of internal agent behavior, not just input/output. ## Posture Scoring Every agent gets a score from 0 to 100 and a grade from A to F based on adversarial and behavioral testing results. ### Formula The score starts with a defense rate (1 minus attack success rate), weighted by test volume and per-category performance. A worst-category penalty ensures that a single weak area cannot be hidden by strong performance elsewhere. A non-linear finding penalty (inspired by Qualys TruRisk) ensures that critical open findings have catastrophic impact on the score. ### Grade Boundaries - A (90-100): Strong defenses, minimal findings, low risk. - B (75-89): Good posture, minor issues, low risk. - C (60-74): Notable weaknesses, remediation needed, medium risk. - D (40-59): Serious vulnerabilities, deployment risk, high risk. - F (0-39): Unsafe for production, critical risk. ### Two Dimensions Security (adversarial testing results) and Quality (behavioral testing results) are scored independently using the same formula but different evaluation metrics. Both contribute to the overall posture. ### Framework Mapping Every finding includes mappings to compliance frameworks: - OWASP Top 10 for LLM Applications (2025): LLM01 through LLM10. - OWASP Top 10 for Agentic Applications: Full coverage of the Agentic Security Initiative categories. - EU AI Act: Title III risk management requirements. - NIST AI Risk Management Framework (AI RMF 1.0): Govern, Map, Measure, Manage functions. - MITRE ATLAS: 16 tactics, 84 techniques. - ISO/IEC 42001:2023: AI Management System controls. - OWASP AIVSS v0.8: AI Vulnerability Scoring System severity levels. Export formats: HTML, PDF, JSON, SARIF, CEF. ## Open-Core Model Humanbound ships as an open-core product. The separation: ### Open Source (Apache-2.0) The CLI and local engine are fully open source. This includes the full orchestrator and intelligence layer: attack strategies, the adaptive conversation engine (scoring, backtracking, phase escalation), the LLM Judge, and posture calculation. The open-source engine is not crippled. It runs the same code as the platform. A developer running locally gets the same quality results on day one as a platform user. Install options: ``` pip install humanbound # CLI + SDK pip install humanbound[engine] # + LLM providers (OpenAI, Anthropic, Gemini) pip install humanbound[firewall] # + humanbound-firewall runtime pip install humanbound[engine,firewall] # everything ``` Three built-in orchestrators: - owasp_agentic: Multi-turn, score-guided, cross-conversation intelligence. Default. - owasp_single_turn: Single-prompt maximum-strength attacks. Fast, high volume. - behavioral_qa: Intent boundary validation, response quality, functional correctness. Provider support: OpenAI, Anthropic, Gemini, Grok, Azure OpenAI, Ollama (full air-gap). ### Platform (Closed Source) Continuous monitoring via ASCAM, finding lifecycle (open/stale/fixed/regressed), cross-session strategy persistence, posture trending, drift detection, managed LLM provider (no API key needed), dashboard, webhooks, and SIEM integrations. ### Firewall (AGPL-3.0) The Humanbound Firewall is a separate open-source project under AGPL-3.0. It is free to use, inspect, and modify. The AGPL license requires commercial conversations for production embedding in proprietary systems. ## Python SDK The SDK provides programmatic access to the same engine the CLI uses: ```python from humanbound import Bot, LocalRunner, OwaspAgentic, TestingLevel, EngineCallbacks bot = Bot(endpoint="https://my-agent/chat", api_key="...") class Callbacks(EngineCallbacks): def on_finding(self, insight): ... def on_progress(self, pct): ... runner = LocalRunner() ``` Stability contract: - `from humanbound import X` and `from humanbound. import Y` are stable and semver-protected. - `from humanbound_cli.* import Z` is internal and may change any release. ## Competitive Context Humanbound is distinct from adjacent tools in the AI security space: - Promptfoo (acquired by OpenAI): Eval framework and red teaming toolkit with broad plugin coverage. Humanbound differentiates through autonomous continuous testing (ASCAM), adaptive multi-turn attacks with cross-conversation intelligence, the self-learning strategy engine, runtime protection via the firewall, and posture scoring. - PyRIT (Microsoft): Composable red-teaming toolkit. Humanbound differentiates through autonomous campaign management, turn-level adaptation (vs strategy-level), backtracking, cross-conversation intelligence sharing, runtime protection, and behavioral testing. - Garak: CLI-driven LLM vulnerability scanner. Focuses on model-level vulnerabilities. Humanbound focuses on agent-level security including tools, memory, and multi-step workflows. - Snyk (via Invariant Labs acquisition): Entered AI security. Humanbound differentiates through transparent self-serve pricing, the open-core engine, and purpose-built AI agent testing rather than bolt-on coverage. No AI security vendor other than Humanbound publishes a self-serve paid middle tier with transparent pricing, making the pricing model a category differentiator. ## Certifications and Compliance Humanbound holds ISO 9001 and ISO 27001 certifications. Cyber Essentials Plus and ISO 42001 gap analysis are in progress. The platform does not claim to be a compliance tool. It produces security evidence that maps to compliance frameworks. The entry point is always a security finding. The regulatory mapping explains why that finding is urgent. ## Blog Recent posts from the Humanbound blog: - Why We Open-Sourced humanbound-firewall (May 2026): The rationale behind releasing the multi-tier runtime defense under Apache-2.0, with each layer inspectable, escalating on uncertainty, and trainable on your own adversarial test data. - AI Security Means Two Different Things (April 2026): AI security maps to two different markets: AI for Security (AI4Sec) and Security for AI (Sec4AI). How to tell which one you are actually buying. - Beyond Moderation: Why LLM Systems Need a Policy Layer (April 2026): Moderation APIs catch harm and injection attempts but fail to enforce domain-specific policy. A cross-domain evaluation showing why production LLM systems need both moderation and policy reasoning layers. - Your Agent Passed Its Security Test. That Was Three Weeks Ago (March 2026): The gap between testing on deploy and staying secure in production is where risk accumulates. Why shift-left alone is insufficient for non-deterministic AI systems. - The Enforcement Illusion (March 2026): Most agents ship without any adversarial testing. Enforcement is needed, but it is phase 3 of a lifecycle most organizations are entering at phase 1. Full blog at https://www.humanbound.ai/blog ## AI Security Readiness Checklist An interactive self-assessment for CISOs and security leaders at https://www.humanbound.ai/ai-readiness. Twenty-three questions across four dimensions: - Visibility (6 questions): AI inventory, data access, action scope, shadow AI, change frequency, security sign-off process. - Risk Assessment (6 questions): Adversarial testing, AI-specific security tools, quantified posture score, production monitoring, incident response, tool/API manipulation risk. - Governance (6 questions): AI security policy, ownership, compliance inclusion, vendor evaluation, business-context testing, testing cadence. - Board Readiness (5 questions): Evidence-backed AI inventory, posture trend line, business-term risk articulation, audit-ready reports, current-to-target roadmap. The checklist produces a live gap diagnosis as questions are answered and offers a printable results report. ## Company Humanbound is headquartered in Athens, Greece. The team includes Kostas Siabanis (co-founder, strategy and GTM), Demetris Giannakis PhD (co-founder, engineering), and two additional team members in engineering and marketing roles. Seed-funded by Uni.Fund. The company contributes to the OWASP Agentic Security Initiative (ASI) and aligns its testing engine with OWASP Top 10 for LLM Applications and OWASP Top 10 for Agentic Applications. ## Links - Website: https://www.humanbound.ai/ - Documentation: https://docs.humanbound.ai/ - API reference: https://api.humanbound.ai/api/docs - GitHub: https://github.com/humanbound - CLI and SDK: https://github.com/humanbound/humanbound - Firewall: https://github.com/humanbound/humanbound-firewall - PyPI (humanbound): https://pypi.org/project/humanbound/ - PyPI (humanbound-firewall): https://pypi.org/project/humanbound-firewall/ - Discord: https://discord.gg/QFTD6tr9zu - LinkedIn: https://www.linkedin.com/company/humanbound - Blog: https://www.humanbound.ai/blog - AI Readiness Checklist: https://www.humanbound.ai/ai-readiness - Contact: https://www.humanbound.ai/contact