[{"data":1,"prerenderedAt":1195},["ShallowReactive",2],{"{\"cv\":1786654911610,\"version\":\"published\"}widgets\u002Fnavigation-bar":3,"{\"cv\":1786654911610,\"resolve_relations\":[\"ResourceFeatureCard.resource\"],\"version\":\"published\"}\u002Fblog\u002Fmcp-servers-enterprise-bounded-access-tamper-evident-logs":66},{"data":4,"headers":45},{"story":5,"cv":42,"rels":43,"links":44},{"name":6,"created_at":7,"published_at":8,"updated_at":9,"id":10,"uuid":11,"content":12,"slug":32,"full_slug":33,"sort_by_date":22,"position":34,"tag_list":35,"is_startpage":15,"parent_id":36,"meta_data":22,"group_id":37,"first_published_at":38,"release_id":22,"lang":39,"path":40,"alternates":41,"default_full_slug":22,"translated_slugs":22},"Navigation Bar","2026-08-05T05:55:49.585Z","2026-08-07T15:41:09.255Z","2026-08-07T15:41:09.269Z",205700094329908,"be34732b-2155-45e7-8ee2-86e1157a8cb4",{"_uid":13,"component":14,"showMarketingBanner":15,"marketingBannerContent":16},"e7a8d72d-8af8-452e-87b2-de4098162fb9","NavigationBar",false,{"type":17,"content":18},"doc",[19],{"type":20,"attrs":21,"content":23},"paragraph",{"textAlign":22},null,[24],{"text":25,"type":26,"marks":27},"See us at Black Hat booth #7505","text",[28],{"type":29,"attrs":30},"textStyle",{"color":31},"#000000","navigation-bar","widgets\u002Fnavigation-bar",0,[],205696803161001,"e116d2fb-7cac-4697-9dcb-91d9283aecc3","2026-08-05T06:19:33.200Z","default","\u002F",[],1786654679,[],[],{"cache-control":46,"connection":47,"content-length":48,"content-type":49,"date":50,"etag":51,"referrer-policy":52,"sb-be-version":53,"server":54,"vary":55,"via":56,"x-amz-cf-id":57,"x-amz-cf-pop":58,"x-cache":59,"x-content-type-options":60,"x-frame-options":61,"x-permitted-cross-domain-policies":62,"x-request-id":63,"x-runtime":64,"x-xss-protection":65},"max-age=0, public, s-maxage=604800, stale-if-error=3600","keep-alive","986","application\u002Fjson; charset=utf-8","Thu, 13 Aug 2026 21:02:21 GMT","W\u002F\"6f15609f6622677bb823fe979b6299c5\"","strict-origin-when-cross-origin","5.941.0","nginx\u002F1.29.1","Origin","1.1 2733aa94cc15bc99c6328b4e904aa4cc.cloudfront.net (CloudFront)","n3yA5k1sGF1b7Wr4qAuOwjOT7xwFK56yclKVoylLbtI4evqsUGDoWQ==","CMH68-P7","Miss from cloudfront","nosniff","SAMEORIGIN","none","78257a34-20b2-4891-976d-ffb29348dd32","0.023761","0",{"data":67,"headers":1185},{"story":68,"cv":42,"rels":686,"links":1184},{"name":69,"created_at":70,"published_at":71,"updated_at":72,"id":73,"uuid":74,"content":75,"slug":678,"full_slug":679,"sort_by_date":680,"position":681,"tag_list":682,"is_startpage":15,"parent_id":661,"meta_data":22,"group_id":683,"first_published_at":684,"release_id":22,"lang":39,"path":22,"alternates":685,"default_full_slug":22,"translated_slugs":22},"MCP servers in the enterprise","2026-07-25T19:45:39.384Z","2026-07-27T21:02:06.333Z","2026-07-27T21:02:06.349Z",202011194996501,"6676e3aa-65e0-4b25-9a37-62457ac20acc",{"Tags":76,"_uid":77,"body":78,"title":79,"content":80,"component":199,"seoOgImage":200,"keyTakeaways":206,"previewImage":233,"previewTitle":79,"relatedContent":235,"seoDescription":677,"previewDescription":677},"MCP Server, AI Agent Security, Compliance Evidence, Audit Logging, Enterprise Infrastructure, secure architecture","69a52ed9-008b-4441-a3c4-57b32d15254b",[],"MCP servers in the enterprise: Bounded access, tamper-evident logs, and why both matter",{"type":17,"content":81},[82,91,117,125,133,141,151,159,167,175,183,191],{"type":20,"attrs":83,"content":84},{"textAlign":22},[85],{"text":86,"type":26,"marks":87},"The Model Context Protocol (MCP) crossed into enterprise infrastructure fast: ",[88],{"type":29,"attrs":89},{"color":90},"#003B5C",{"type":92,"content":93},"blockquote",[94,108],{"type":95,"attrs":96,"content":99},"heading",{"level":97,"textAlign":98},2,"center",[100],{"text":101,"type":26,"marks":102},"By early 2026, 97 million monthly SDK downloads.",[103,106],{"type":29,"attrs":104},{"color":105},"#2CD5C4",{"type":107},"bold",{"type":95,"attrs":109,"content":110},{"level":97,"textAlign":98},[111],{"text":112,"type":26,"marks":113},"Gartner projects that 40% of enterprise applications will include task-specific AI agents by year's end. ",[114,116],{"type":29,"attrs":115},{"color":105},{"type":107},{"type":20,"attrs":118,"content":119},{"textAlign":22},[120],{"text":121,"type":26,"marks":122},"The organizations running MCP in production aren't running experiments; Pinterest is already handling 66,000 monthly tool invocations across hundreds of active users. The evaluation phase is largely over. The question security teams are asking now is whether the MCP implementations inside their environments are actually bounded, or just assumed to be.",[123],{"type":29,"attrs":124},{"color":90},{"type":20,"attrs":126,"content":127},{"textAlign":22},[128],{"text":129,"type":26,"marks":130},"That distinction matters, because connecting an AI agent to your infrastructure without defining precisely what it can call, in what sequence, touching what resources, is a surface area problem wearing a productivity label.",[131],{"type":29,"attrs":132},{"color":90},{"type":20,"attrs":134,"content":135},{"textAlign":22},[136],{"text":137,"type":26,"marks":138},"Xiid's MCP server is built for security teams who already know this.",[139],{"type":29,"attrs":140},{"color":90},{"type":95,"attrs":142,"content":143},{"level":97,"textAlign":22},[144],{"text":145,"type":26,"marks":146},"An agent-facing operating surface with defined edges",[147,150],{"type":29,"attrs":148},{"color":149},"#F68D2E",{"type":107},{"type":20,"attrs":152,"content":153},{"textAlign":22},[154],{"text":155,"type":26,"marks":156},"Xiid Commander is where people operate Xiid directly: configuring SealedTunnel routes, assigning access profiles, validating traffic, and managing deployments. The MCP server extends a selection of those functions to AI agents as callable tools: discover STLinks, configure routes, apply profiles, deploy setups, and return structured results. The tools exposed define exactly what the agent can do. The surface is bounded by design, not by policy.",[157],{"type":29,"attrs":158},{"color":90},{"type":20,"attrs":160,"content":161},{"textAlign":22},[162],{"text":163,"type":26,"marks":164},"When a workflow calls for a specific sequence like setting up a protected service path for a client, for example, an agent running through Xiid's MCP tools executes each step, returns status and IDs, and produces a complete record of what happened. The person reviews the result. The security posture doesn't depend on the agent making sound decisions; it's shaped by the tools available to it. That's not just a subtle difference in architecture. It's the whole point.",[165],{"type":29,"attrs":166},{"color":90},{"type":95,"attrs":168,"content":169},{"level":97,"textAlign":22},[170],{"text":171,"type":26,"marks":172},"Every operation produces evidence you can stand behind.",[173],{"type":29,"attrs":174},{"color":149},{"type":20,"attrs":176,"content":177},{"textAlign":22},[178],{"text":179,"type":26,"marks":180},"Each Xiid MCP tool call generates a structured log: what was requested, which tool ran, which resources were touched, and what the result was. Those logs are digitally signed, per-line rolling, and tamper-evident, which is the same cryptographic logging discipline Xiid applies to direct-access operations. Per-line signing means any modification to a record is detectable. The full chain is independently verifiable.",[181],{"type":29,"attrs":182},{"color":90},{"type":20,"attrs":184,"content":185},{"textAlign":22},[186],{"text":187,"type":26,"marks":188},"For security and compliance teams, that's the difference between automation they can explain in a review and automation they have to reconstruct. Regulated environments, federal contractors, and any team with a meaningful audit requirement should care about that specifically, because auditors now ask about it.",[189],{"type":29,"attrs":190},{"color":90},{"type":20,"attrs":192,"content":193},{"textAlign":22},[194],{"text":195,"type":26,"marks":196},"MCP adoption in enterprise environments isn't slowing down, and the organizations that will have the fewest problems with it are the ones that treated agent-facing infrastructure with the same discipline they applied to their human-facing control planes from the start. Commander for people, MCP for agents. Same Xiid protection underneath either way.",[197],{"type":29,"attrs":198},{"color":90},"BlogPost",{"id":201,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":203,"copyright":202,"fieldtype":204,"meta_data":205,"is_external_url":15},202013852440356,"","https:\u002F\u002Fa.storyblok.com\u002Ff\u002F292462593318313\u002F3124x2083\u002F25b7a18691\u002Fglobal-business-internet-network-connection-iot-internet-things-business-intelligence-concept-busines-global-network-futuristic-technology-background-ai-generative.jpg","asset",{},{"type":17,"content":207},[208],{"type":209,"content":210},"bullet_list",[211,219,226],{"type":212,"content":213},"list_item",[214],{"type":20,"attrs":215,"content":216},{"textAlign":22},[217],{"text":218,"type":26},"Connecting an AI agent to enterprise infrastructure without defining precisely what it can call in what sequence, touching what resources, is a surface area problem wearing a productivity label.",{"type":212,"content":220},[221],{"type":20,"attrs":222,"content":223},{"textAlign":22},[224],{"text":225,"type":26},"Xiid's MCP server bounds agent access by design, not by policy: the tools exposed define exactly what the agent can do, so security posture doesn't depend on the agent making sound decisions.",{"type":212,"content":227},[228],{"type":20,"attrs":229,"content":230},{"textAlign":22},[231],{"text":232,"type":26},"Every MCP tool call produces digitally signed, per-line tamper-evident logs which gives compliance teams automation they can explain in an audit, not reconstruct after the fact.",{"id":201,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":203,"copyright":202,"fieldtype":204,"meta_data":234,"is_external_url":15},{},[236],{"_uid":237,"variant":238,"resource":239,"component":666,"background":667},"2d63d19d-6f82-4604-854f-eb5efbc63636","oneThirdLeftPhoto",[240],{"name":241,"created_at":242,"published_at":243,"updated_at":244,"id":245,"uuid":246,"content":247,"slug":669,"full_slug":670,"sort_by_date":671,"position":672,"tag_list":673,"is_startpage":15,"parent_id":661,"meta_data":22,"group_id":674,"first_published_at":675,"release_id":22,"lang":39,"path":22,"alternates":676,"default_full_slug":22,"translated_slugs":22,"_stopResolving":665},"How Xiid MCP server satisfies compliance controls","2026-07-25T19:31:11.744Z","2026-07-27T21:02:00.410Z","2026-07-27T21:02:00.428Z",202007641096635,"232f8e86-b067-4538-a324-96e8f693e3ab",{"Tags":248,"_uid":77,"body":249,"title":250,"content":251,"component":199,"seoOgImage":426,"keyTakeaways":430,"previewImage":455,"previewTitle":250,"relatedContent":457,"seoDescription":668,"previewDescription":668},"MCP Server, AI Agent Security, Compliance Evidence, Audit Logging, Enterprise Security",[],"How Xiid's MCP server satisfies SOC 2, ISO 27001, and NIST audit controls",{"type":17,"content":252},[253,261,293,301,309,317,359,367,375,383,402,410,418],{"type":20,"attrs":254,"content":255},{"textAlign":22},[256],{"text":257,"type":26,"marks":258},"Regulated organizations are adopting AI agents faster than their compliance documentation is keeping up. Agents are moving from answering questions to taking actions like:",[259],{"type":29,"attrs":260},{"color":90},{"type":209,"content":262},[263,273,283],{"type":212,"content":264},[265],{"type":20,"attrs":266,"content":267},{"textAlign":22},[268],{"text":269,"type":26,"marks":270},"Configuring infrastructure",[271],{"type":29,"attrs":272},{"color":90},{"type":212,"content":274},[275],{"type":20,"attrs":276,"content":277},{"textAlign":22},[278],{"text":279,"type":26,"marks":280},"Deploying services",[281],{"type":29,"attrs":282},{"color":90},{"type":212,"content":284},[285],{"type":20,"attrs":286,"content":287},{"textAlign":22},[288],{"text":289,"type":26,"marks":290},"Modifying access paths",[291],{"type":29,"attrs":292},{"color":90},{"type":20,"attrs":294,"content":295},{"textAlign":22},[296],{"text":297,"type":26,"marks":298},"The audit frameworks that govern those actions haven't changed because a workflow is now automated. They still require that every relevant action be traceable, attributable, and tamper-resistant.",[299],{"type":29,"attrs":300},{"color":90},{"type":20,"attrs":302,"content":303},{"textAlign":22},[304],{"text":305,"type":26,"marks":306},"That's where most enterprise automation has a gap. Logs exist, but they live in writable systems. An administrator with sufficient access can modify records without detection, and access controls on log storage are not the same thing as tamper-proof evidence. It's precisely why NIST 800-53 AU-9, FedRAMP High, and ISO 27001:2022 treat protection of audit information as a distinct, enforceable requirement rather than folding it into general logging guidance.",[307],{"type":29,"attrs":308},{"color":90},{"type":20,"attrs":310,"content":311},{"textAlign":22},[312],{"text":313,"type":26,"marks":314},"Xiid's MCP server closes this gap structurally. Every agent-driven operation through the MCP surface produces a structured record that is backed by digitally signed, per-line rolling, tamper-evident logs including:",[315],{"type":29,"attrs":316},{"color":90},{"type":209,"content":318},[319,329,339,349],{"type":212,"content":320},[321],{"type":20,"attrs":322,"content":323},{"textAlign":22},[324],{"text":325,"type":26,"marks":326},"What was requested",[327],{"type":29,"attrs":328},{"color":90},{"type":212,"content":330},[331],{"type":20,"attrs":332,"content":333},{"textAlign":22},[334],{"text":335,"type":26,"marks":336},"Which tool ran",[337],{"type":29,"attrs":338},{"color":90},{"type":212,"content":340},[341],{"type":20,"attrs":342,"content":343},{"textAlign":22},[344],{"text":345,"type":26,"marks":346},"Which Xiid resources were touched",[347],{"type":29,"attrs":348},{"color":90},{"type":212,"content":350},[351],{"type":20,"attrs":352,"content":353},{"textAlign":22},[354],{"text":355,"type":26,"marks":356},"What the result was",[357],{"type":29,"attrs":358},{"color":90},{"type":20,"attrs":360,"content":361},{"textAlign":22},[362],{"text":363,"type":26,"marks":364},"Per-line signing means any alteration to a single entry is detectable. The integrity of the full sequence is independently verifiable. Compliance teams get automation they can explain in an audit, not because someone reconstructed it after the fact, but because the evidence was produced at the time of execution.",[365],{"type":29,"attrs":366},{"color":90},{"type":95,"attrs":368,"content":369},{"level":97,"textAlign":22},[370],{"text":371,"type":26,"marks":372},"Specific framework controls satisfied by Xiid MCP evidence",[373],{"type":29,"attrs":374},{"color":149},{"type":20,"attrs":376,"content":377},{"textAlign":22},[378],{"text":379,"type":26,"marks":380},"The table below maps Xiid MCP server capabilities to specific controls across major compliance frameworks.",[381],{"type":29,"attrs":382},{"color":90},{"type":20,"attrs":384,"content":385},{"textAlign":22},[386,392,397],{"type":387,"attrs":388},"image",{"id":389,"alt":202,"src":390,"title":202,"source":202,"copyright":202,"meta_data":391},202009261421875,"https:\u002F\u002Fa.storyblok.com\u002Ff\u002F292462593318313\u002F1024x604\u002Fed375b68ff\u002Fscreenshot-2026-06-18-142056.png",{},{"type":387,"attrs":393},{"id":394,"alt":202,"src":395,"title":202,"source":202,"copyright":202,"meta_data":396},202009542522189,"https:\u002F\u002Fa.storyblok.com\u002Ff\u002F292462593318313\u002F1279x721\u002F187435f7f6\u002Fscreenshot-2026-06-18-142714.png",{},{"type":387,"attrs":398},{"id":399,"alt":202,"src":400,"title":202,"source":202,"copyright":202,"meta_data":401},202009542542670,"https:\u002F\u002Fa.storyblok.com\u002Ff\u002F292462593318313\u002F1281x619\u002Fb9c6b22f73\u002Fscreenshot-2026-06-18-142510.png",{},{"type":95,"attrs":403,"content":404},{"level":97,"textAlign":22},[405],{"text":406,"type":26,"marks":407},"ISO 27001:2022 5.28 deserves specific attention",[408],{"type":29,"attrs":409},{"color":149},{"type":20,"attrs":411,"content":412},{"textAlign":22},[413],{"text":414,"type":26,"marks":415},"For organizations currently working through their ISO 27001:2022 gap analysis, 5.28 (Collection of Evidence) is one of the newer controls that many teams are still figuring out how to satisfy. It requires that evidence be preserved, protected, and usable for audit or incident investigation. Xiid's per-line cryptographic signing satisfies both the preservation and the integrity requirements directly, without requiring additional tooling.",[416],{"type":29,"attrs":417},{"color":90},{"type":20,"attrs":419,"content":420},{"textAlign":22},[421],{"text":422,"type":26,"marks":423},"For finance, healthcare, federal contractors, and defense supply chain organizations, audit-ready evidence from automated operations is no longer a nice-to-have. Auditors are asking about it specifically. The question is \"What did the agent actually do, and how do you know the record is accurate?\" now has a structural answer in Xiid's MCP server.",[424],{"type":29,"attrs":425},{"color":90},{"id":427,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":428,"copyright":202,"fieldtype":204,"meta_data":429,"is_external_url":15},187908650626754,"https:\u002F\u002Fa.storyblok.com\u002Ff\u002F292462593318313\u002F4000x2667\u002Fa4c9a34027\u002Fcloud-storage-background-remixed-from-public-domain-by-nasa.jpg",{},{"type":17,"content":431},[432],{"type":209,"content":433},[434,441,448],{"type":212,"content":435},[436],{"type":20,"attrs":437,"content":438},{"textAlign":22},[439],{"text":440,"type":26},"Regulated organizations are deploying AI agents that take real infrastructure actions, but most automation logs live in writable systems so an administrator with sufficient access can alter records without detection.",{"type":212,"content":442},[443],{"type":20,"attrs":444,"content":445},{"textAlign":22},[446],{"text":447,"type":26},"Xiid's MCP server produces structured, per-line cryptographically signed records of every agent-driven operation, satisfying NIST 800-53 AU-9, FedRAMP High, ISO 27001:2022 (including the newer 5.28 evidence collection control), and SOC 2 logging requirements.",{"type":212,"content":449},[450],{"type":20,"attrs":451,"content":452},{"textAlign":22},[453],{"text":454,"type":26},"The question auditors now ask specifically—\"What did the agent actually do, and how do you know the record is accurate?\"—has a structural answer in Xiid's MCP implementation.",{"id":427,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":428,"copyright":202,"fieldtype":204,"meta_data":456,"is_external_url":15},{},[458],{"_uid":237,"variant":238,"resource":459,"component":666,"background":667},[460],{"name":461,"created_at":462,"published_at":463,"updated_at":464,"id":465,"uuid":466,"content":467,"slug":656,"full_slug":657,"sort_by_date":658,"position":659,"tag_list":660,"is_startpage":15,"parent_id":661,"meta_data":22,"group_id":662,"first_published_at":663,"release_id":22,"lang":39,"path":22,"alternates":664,"default_full_slug":22,"translated_slugs":22,"_stopResolving":665},"Autonomous Attack Paths: The Security Problem AI Is Creating","2026-06-15T23:14:03.060Z","2026-07-27T21:02:43.123Z","2026-07-27T21:02:43.140Z",187906633990832,"6695913d-e1ca-4003-ab26-03235c624cb5",{"Tags":202,"_uid":77,"body":468,"title":461,"content":469,"component":199,"seoOgImage":622,"keyTakeaways":626,"previewImage":651,"previewTitle":461,"relatedContent":653,"seoDescription":654,"previewDescription":655},[],{"type":17,"content":470},[471,476,484,489,494,501,506,511,516,521,528,533,538,543,548,556,563,568,573,578,585,590,595,600,605,612,617],{"type":20,"attrs":472,"content":473},{"textAlign":22},[474],{"text":475,"type":26},"Traditional security was built for a world where humans initiated the actions that mattered. A user logs in, a browser makes a request, and a person clicks and authenticates. Security controls positioned themselves between those human actions and potential harm.",{"type":20,"attrs":477,"content":478},{"textAlign":22},[479],{"text":480,"type":26,"marks":481},"AI changes the initiator.",[482],{"type":483},"italic",{"type":20,"attrs":485,"content":486},{"textAlign":22},[487],{"text":488,"type":26},"AI agents, copilots, autonomous workflows, and machine-driven orchestration now act on their own. Systems talk to other systems. Machine identities inherit trust, trigger processes, and chain actions across environments faster than any human response team can keep up.",{"type":20,"attrs":490,"content":491},{"textAlign":22},[492],{"text":493,"type":26},"The result is a new category of risk: autonomous attack paths.",{"type":95,"attrs":495,"content":496},{"level":97,"textAlign":22},[497],{"text":498,"type":26,"marks":499},"When the Attacker Is a Machine",[500],{"type":107},{"type":20,"attrs":502,"content":503},{"textAlign":22},[504],{"text":505,"type":26},"In the not-so-distant past, attack paths relied on compromised credentials, vulnerable endpoints, and lateral movement executed by an adversary operating at human speed. Detection had a fighting chance because the threat actor was constrained by the same clock as the defender.",{"type":20,"attrs":507,"content":508},{"textAlign":22},[509],{"text":510,"type":26},"Autonomous attack paths don’t operate on that clock.",{"type":20,"attrs":512,"content":513},{"textAlign":22},[514],{"text":515,"type":26},"They emerge through interconnected AI agents, machine identities carrying excessive permissions, API chaining, and inherited trust relationships that expand faster than any governance process can track. When an AI system acts on incorrect conclusions or gets compromised, it doesn’t wait for human review. It propagates. Across APIs. Across cloud environments. Across infrastructure that was never designed to contain it.",{"type":20,"attrs":517,"content":518},{"textAlign":22},[519],{"text":520,"type":26},"This is what the industry consistently underestimates. Hallucinations are no longer just content problems. When autonomous systems hold broad infrastructure access, a wrong output becomes an operational event.",{"type":95,"attrs":522,"content":523},{"level":97,"textAlign":22},[524],{"text":525,"type":26,"marks":526},"The Trust Model That No Longer Holds",[527],{"type":107},{"type":20,"attrs":529,"content":530},{"textAlign":22},[531],{"text":532,"type":26},"Most security teams understood their attack surface: human users, browser sessions, static trust boundaries, predictable network behavior.",{"type":20,"attrs":534,"content":535},{"textAlign":22},[536],{"text":537,"type":26},"Autonomous systems don’t operate inside those boundaries. They communicate continuously, orchestrate dynamically, and create connectivity paths that never appeared in the architecture diagram, because they weren’t human-initiated and never passed through controls built for human-initiated actions.",{"type":20,"attrs":539,"content":540},{"textAlign":22},[541],{"text":542,"type":26},"In many environments today, security teams have lost visibility into what autonomous systems can actually reach, which machine identities carry inherited trust, and where unintended connectivity paths exist. That’s not a configuration gap. It’s a structural one.",{"type":20,"attrs":544,"content":545},{"textAlign":22},[546],{"text":547,"type":26},"Organizations must move from reactive, perimeter-based security to preventive, deterministic security for the AI era.",{"type":20,"attrs":549,"content":550},{"textAlign":22},[551],{"type":387,"attrs":552},{"id":553,"alt":202,"src":554,"title":202,"source":202,"copyright":202,"meta_data":555},187907524509359,"https:\u002F\u002Fa.storyblok.com\u002Ff\u002F292462593318313\u002F1536x1024\u002F6aadafddb5\u002Fimage-5.png",{},{"type":95,"attrs":557,"content":558},{"level":97,"textAlign":22},[559],{"text":560,"type":26,"marks":561},"Reachability Is the New Attack Surface",[562],{"type":107},{"type":20,"attrs":564,"content":565},{"textAlign":22},[566],{"text":567,"type":26},"The detect-and-respond model was built for a world where perimeters held and human response times were acceptable. Autonomous infrastructure operates outside both of those assumptions.",{"type":20,"attrs":569,"content":570},{"textAlign":22},[571],{"text":572,"type":26},"When AI systems create dynamic connectivity paths and machine identities outnumber human users, detection is no longer a sufficient answer. The question shifts: what can these systems reach in the first place? Broad connectivity with implicit trust has been the default architecture of most enterprise environments. That’s now a liability rather than an operational convenience.",{"type":20,"attrs":574,"content":575},{"textAlign":22},[576],{"text":577,"type":26},"Reachability itself becomes the attack surface.",{"type":95,"attrs":579,"content":580},{"level":97,"textAlign":22},[581],{"text":582,"type":26,"marks":583},"Containing What You Can’t Outrun",[584],{"type":107},{"type":20,"attrs":586,"content":587},{"textAlign":22},[588],{"text":589,"type":26},"Securing autonomous environments demands a different architectural question. Not “how do we detect and respond faster?” but “what can autonomous systems reach, and how do we constrain it?”",{"type":20,"attrs":591,"content":592},{"textAlign":22},[593],{"text":594,"type":26},"That means limiting machine-to-machine connectivity to what’s operationally necessary. Enforcing identity-based trust at the process level, not the device or subnet level. Reducing the blast radius of any autonomous action, because propagation speed makes post-incident containment increasingly inadequate.",{"type":20,"attrs":596,"content":597},{"textAlign":22},[598],{"text":599,"type":26},"The organizations getting ahead of these issues aren’t layering more monitoring onto environments built for human-speed threats. They’re rebuilding for autonomous systems from the start to constrain reachability before any action is taken, rather than racing to contain propagation after the fact.",{"type":20,"attrs":601,"content":602},{"textAlign":22},[603],{"text":604,"type":26},"The next generation of security challenges won’t be defined solely by vulnerabilities. They’ll be defined by autonomous attack paths operating at machine speed. The architecture that contains them won’t be a faster version of what exists today.",{"type":95,"attrs":606,"content":607},{"level":97,"textAlign":22},[608],{"text":609,"type":26,"marks":610},"Ready to Reduce Your Autonomous Attack Surface? ",[611],{"type":107},{"type":20,"attrs":613,"content":614},{"textAlign":22},[615],{"text":616,"type":26},"As AI systems become more deeply embedded in enterprise infrastructure, machine-to-machine trust, autonomous reachability, and identity governance become the new security fundamentals. Xiid builds infrastructure designed to contain autonomous attack paths before they propagate.",{"type":20,"attrs":618,"content":619},{"textAlign":22},[620],{"text":621,"type":26},"Learn how Xiid is helping organizations build unreachable-by-design infrastructure for the AI era.",{"id":623,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":624,"copyright":202,"fieldtype":204,"meta_data":625,"is_external_url":15},187907272670894,"https:\u002F\u002Fa.storyblok.com\u002Ff\u002F292462593318313\u002F4000x3000\u002Ff7fd3ab9ec\u002F3d-render-abstract-extruding-hexagons.jpg",{},{"type":17,"content":627},[628],{"type":209,"content":629},[630,637,644],{"type":212,"content":631},[632],{"type":20,"attrs":633,"content":634},{"textAlign":22},[635],{"text":636,"type":26},"AI agents, copilots, and autonomous workflows act at machine speed across systems, creating a new category of risk called \"autonomous attack paths\" that don't operate on the human clock traditional detection was built to match.",{"type":212,"content":638},[639],{"type":20,"attrs":640,"content":641},{"textAlign":22},[642],{"text":643,"type":26},"Most security teams have lost visibility into what autonomous systems can actually reach: machine identities carry inherited trust, API chaining creates connectivity paths that never appeared in architecture diagrams, and a hallucination or compromise propagates across environments before any human review is possible.",{"type":212,"content":645},[646],{"type":20,"attrs":647,"content":648},{"textAlign":22},[649],{"text":650,"type":26},"The detect-and-respond model is structurally inadequate for autonomous infrastructure. The right question is \"What can these systems reach?\" not \"How do we respond faster?\" which means constraining reachability before any action is taken.",{"id":623,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":624,"copyright":202,"fieldtype":204,"meta_data":652,"is_external_url":15},{},[],"AI agents and autonomous workflows are creating machine-driven attack paths traditional security architectures weren’t built to contain. Learn how reachability control and identity-based trust reduce autonomous risk.","As organizations deploy AI agents, autonomous workflows, copilots, and machine-driven orchestration platforms, the actions that matter are no longer primarily human-initiated.","autonomous-attack-path-security","blog\u002Fautonomous-attack-path-security","2026-05-15",40,[],193139877037850,"a91363df-33c5-4c77-a8b8-60617b0e425c","2026-05-15T18:52:00.000Z",[],true,"ResourceFeatureCard","white","AI agents are taking real infrastructure actions now. Most enterprise logging can't prove what happened. Xiid's MCP server can.","mcp-server-compliance-ai-agent-audit-evidence","blog\u002Fmcp-server-compliance-ai-agent-audit-evidence","2026-06-18",20,[],"d823dd07-7571-4146-a592-223af453349e","2026-06-18T19:43:00.000Z",[],"MCP is in enterprise production. The question now is whether your implementation is actually bounded or just assumed to be.","mcp-servers-enterprise-bounded-access-tamper-evident-logs","blog\u002Fmcp-servers-enterprise-bounded-access-tamper-evident-logs","2026-06-29",30,[],"54b98463-fe99-4d34-954d-bb09e6a5fc62","2026-06-29T19:56:00.000Z",[],[687,1028],{"name":241,"created_at":242,"published_at":243,"updated_at":244,"id":245,"uuid":246,"content":688,"slug":669,"full_slug":670,"sort_by_date":671,"position":672,"tag_list":1026,"is_startpage":15,"parent_id":661,"meta_data":22,"group_id":674,"first_published_at":675,"release_id":22,"lang":39,"path":22,"alternates":1027,"default_full_slug":22,"translated_slugs":22},{"Tags":248,"_uid":77,"body":689,"title":250,"content":690,"component":199,"seoOgImage":841,"keyTakeaways":843,"previewImage":865,"previewTitle":250,"relatedContent":867,"seoDescription":668,"previewDescription":668},[],{"type":17,"content":691},[692,699,728,735,742,749,787,794,801,808,820,827,834],{"type":20,"attrs":693,"content":694},{"textAlign":22},[695],{"text":257,"type":26,"marks":696},[697],{"type":29,"attrs":698},{"color":90},{"type":209,"content":700},[701,710,719],{"type":212,"content":702},[703],{"type":20,"attrs":704,"content":705},{"textAlign":22},[706],{"text":269,"type":26,"marks":707},[708],{"type":29,"attrs":709},{"color":90},{"type":212,"content":711},[712],{"type":20,"attrs":713,"content":714},{"textAlign":22},[715],{"text":279,"type":26,"marks":716},[717],{"type":29,"attrs":718},{"color":90},{"type":212,"content":720},[721],{"type":20,"attrs":722,"content":723},{"textAlign":22},[724],{"text":289,"type":26,"marks":725},[726],{"type":29,"attrs":727},{"color":90},{"type":20,"attrs":729,"content":730},{"textAlign":22},[731],{"text":297,"type":26,"marks":732},[733],{"type":29,"attrs":734},{"color":90},{"type":20,"attrs":736,"content":737},{"textAlign":22},[738],{"text":305,"type":26,"marks":739},[740],{"type":29,"attrs":741},{"color":90},{"type":20,"attrs":743,"content":744},{"textAlign":22},[745],{"text":313,"type":26,"marks":746},[747],{"type":29,"attrs":748},{"color":90},{"type":209,"content":750},[751,760,769,778],{"type":212,"content":752},[753],{"type":20,"attrs":754,"content":755},{"textAlign":22},[756],{"text":325,"type":26,"marks":757},[758],{"type":29,"attrs":759},{"color":90},{"type":212,"content":761},[762],{"type":20,"attrs":763,"content":764},{"textAlign":22},[765],{"text":335,"type":26,"marks":766},[767],{"type":29,"attrs":768},{"color":90},{"type":212,"content":770},[771],{"type":20,"attrs":772,"content":773},{"textAlign":22},[774],{"text":345,"type":26,"marks":775},[776],{"type":29,"attrs":777},{"color":90},{"type":212,"content":779},[780],{"type":20,"attrs":781,"content":782},{"textAlign":22},[783],{"text":355,"type":26,"marks":784},[785],{"type":29,"attrs":786},{"color":90},{"type":20,"attrs":788,"content":789},{"textAlign":22},[790],{"text":363,"type":26,"marks":791},[792],{"type":29,"attrs":793},{"color":90},{"type":95,"attrs":795,"content":796},{"level":97,"textAlign":22},[797],{"text":371,"type":26,"marks":798},[799],{"type":29,"attrs":800},{"color":149},{"type":20,"attrs":802,"content":803},{"textAlign":22},[804],{"text":379,"type":26,"marks":805},[806],{"type":29,"attrs":807},{"color":90},{"type":20,"attrs":809,"content":810},{"textAlign":22},[811,814,817],{"type":387,"attrs":812},{"id":389,"alt":202,"src":390,"title":202,"source":202,"copyright":202,"meta_data":813},{},{"type":387,"attrs":815},{"id":394,"alt":202,"src":395,"title":202,"source":202,"copyright":202,"meta_data":816},{},{"type":387,"attrs":818},{"id":399,"alt":202,"src":400,"title":202,"source":202,"copyright":202,"meta_data":819},{},{"type":95,"attrs":821,"content":822},{"level":97,"textAlign":22},[823],{"text":406,"type":26,"marks":824},[825],{"type":29,"attrs":826},{"color":149},{"type":20,"attrs":828,"content":829},{"textAlign":22},[830],{"text":414,"type":26,"marks":831},[832],{"type":29,"attrs":833},{"color":90},{"type":20,"attrs":835,"content":836},{"textAlign":22},[837],{"text":422,"type":26,"marks":838},[839],{"type":29,"attrs":840},{"color":90},{"id":427,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":428,"copyright":202,"fieldtype":204,"meta_data":842,"is_external_url":15},{},{"type":17,"content":844},[845],{"type":209,"content":846},[847,853,859],{"type":212,"content":848},[849],{"type":20,"attrs":850,"content":851},{"textAlign":22},[852],{"text":440,"type":26},{"type":212,"content":854},[855],{"type":20,"attrs":856,"content":857},{"textAlign":22},[858],{"text":447,"type":26},{"type":212,"content":860},[861],{"type":20,"attrs":862,"content":863},{"textAlign":22},[864],{"text":454,"type":26},{"id":427,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":428,"copyright":202,"fieldtype":204,"meta_data":866,"is_external_url":15},{},[868],{"_uid":237,"variant":238,"resource":869,"component":666,"background":667},[870],{"name":461,"created_at":462,"published_at":463,"updated_at":464,"id":465,"uuid":466,"content":871,"slug":656,"full_slug":657,"sort_by_date":658,"position":659,"tag_list":1024,"is_startpage":15,"parent_id":661,"meta_data":22,"group_id":662,"first_published_at":663,"release_id":22,"lang":39,"path":22,"alternates":1025,"default_full_slug":22,"translated_slugs":22,"_stopResolving":665},{"Tags":202,"_uid":77,"body":872,"title":461,"content":873,"component":199,"seoOgImage":997,"keyTakeaways":999,"previewImage":1021,"previewTitle":461,"relatedContent":1023,"seoDescription":654,"previewDescription":655},[],{"type":17,"content":874},[875,879,885,889,893,899,903,907,911,915,921,925,929,933,937,943,949,953,957,961,967,971,975,979,983,989,993],{"type":20,"attrs":876,"content":877},{"textAlign":22},[878],{"text":475,"type":26},{"type":20,"attrs":880,"content":881},{"textAlign":22},[882],{"text":480,"type":26,"marks":883},[884],{"type":483},{"type":20,"attrs":886,"content":887},{"textAlign":22},[888],{"text":488,"type":26},{"type":20,"attrs":890,"content":891},{"textAlign":22},[892],{"text":493,"type":26},{"type":95,"attrs":894,"content":895},{"level":97,"textAlign":22},[896],{"text":498,"type":26,"marks":897},[898],{"type":107},{"type":20,"attrs":900,"content":901},{"textAlign":22},[902],{"text":505,"type":26},{"type":20,"attrs":904,"content":905},{"textAlign":22},[906],{"text":510,"type":26},{"type":20,"attrs":908,"content":909},{"textAlign":22},[910],{"text":515,"type":26},{"type":20,"attrs":912,"content":913},{"textAlign":22},[914],{"text":520,"type":26},{"type":95,"attrs":916,"content":917},{"level":97,"textAlign":22},[918],{"text":525,"type":26,"marks":919},[920],{"type":107},{"type":20,"attrs":922,"content":923},{"textAlign":22},[924],{"text":532,"type":26},{"type":20,"attrs":926,"content":927},{"textAlign":22},[928],{"text":537,"type":26},{"type":20,"attrs":930,"content":931},{"textAlign":22},[932],{"text":542,"type":26},{"type":20,"attrs":934,"content":935},{"textAlign":22},[936],{"text":547,"type":26},{"type":20,"attrs":938,"content":939},{"textAlign":22},[940],{"type":387,"attrs":941},{"id":553,"alt":202,"src":554,"title":202,"source":202,"copyright":202,"meta_data":942},{},{"type":95,"attrs":944,"content":945},{"level":97,"textAlign":22},[946],{"text":560,"type":26,"marks":947},[948],{"type":107},{"type":20,"attrs":950,"content":951},{"textAlign":22},[952],{"text":567,"type":26},{"type":20,"attrs":954,"content":955},{"textAlign":22},[956],{"text":572,"type":26},{"type":20,"attrs":958,"content":959},{"textAlign":22},[960],{"text":577,"type":26},{"type":95,"attrs":962,"content":963},{"level":97,"textAlign":22},[964],{"text":582,"type":26,"marks":965},[966],{"type":107},{"type":20,"attrs":968,"content":969},{"textAlign":22},[970],{"text":589,"type":26},{"type":20,"attrs":972,"content":973},{"textAlign":22},[974],{"text":594,"type":26},{"type":20,"attrs":976,"content":977},{"textAlign":22},[978],{"text":599,"type":26},{"type":20,"attrs":980,"content":981},{"textAlign":22},[982],{"text":604,"type":26},{"type":95,"attrs":984,"content":985},{"level":97,"textAlign":22},[986],{"text":609,"type":26,"marks":987},[988],{"type":107},{"type":20,"attrs":990,"content":991},{"textAlign":22},[992],{"text":616,"type":26},{"type":20,"attrs":994,"content":995},{"textAlign":22},[996],{"text":621,"type":26},{"id":623,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":624,"copyright":202,"fieldtype":204,"meta_data":998,"is_external_url":15},{},{"type":17,"content":1000},[1001],{"type":209,"content":1002},[1003,1009,1015],{"type":212,"content":1004},[1005],{"type":20,"attrs":1006,"content":1007},{"textAlign":22},[1008],{"text":636,"type":26},{"type":212,"content":1010},[1011],{"type":20,"attrs":1012,"content":1013},{"textAlign":22},[1014],{"text":643,"type":26},{"type":212,"content":1016},[1017],{"type":20,"attrs":1018,"content":1019},{"textAlign":22},[1020],{"text":650,"type":26},{"id":623,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":624,"copyright":202,"fieldtype":204,"meta_data":1022,"is_external_url":15},{},[],[],[],[],[],{"name":461,"created_at":462,"published_at":463,"updated_at":464,"id":465,"uuid":466,"content":1029,"slug":656,"full_slug":657,"sort_by_date":658,"position":659,"tag_list":1182,"is_startpage":15,"parent_id":661,"meta_data":22,"group_id":662,"first_published_at":663,"release_id":22,"lang":39,"path":22,"alternates":1183,"default_full_slug":22,"translated_slugs":22},{"Tags":202,"_uid":77,"body":1030,"title":461,"content":1031,"component":199,"seoOgImage":1155,"keyTakeaways":1157,"previewImage":1179,"previewTitle":461,"relatedContent":1181,"seoDescription":654,"previewDescription":655},[],{"type":17,"content":1032},[1033,1037,1043,1047,1051,1057,1061,1065,1069,1073,1079,1083,1087,1091,1095,1101,1107,1111,1115,1119,1125,1129,1133,1137,1141,1147,1151],{"type":20,"attrs":1034,"content":1035},{"textAlign":22},[1036],{"text":475,"type":26},{"type":20,"attrs":1038,"content":1039},{"textAlign":22},[1040],{"text":480,"type":26,"marks":1041},[1042],{"type":483},{"type":20,"attrs":1044,"content":1045},{"textAlign":22},[1046],{"text":488,"type":26},{"type":20,"attrs":1048,"content":1049},{"textAlign":22},[1050],{"text":493,"type":26},{"type":95,"attrs":1052,"content":1053},{"level":97,"textAlign":22},[1054],{"text":498,"type":26,"marks":1055},[1056],{"type":107},{"type":20,"attrs":1058,"content":1059},{"textAlign":22},[1060],{"text":505,"type":26},{"type":20,"attrs":1062,"content":1063},{"textAlign":22},[1064],{"text":510,"type":26},{"type":20,"attrs":1066,"content":1067},{"textAlign":22},[1068],{"text":515,"type":26},{"type":20,"attrs":1070,"content":1071},{"textAlign":22},[1072],{"text":520,"type":26},{"type":95,"attrs":1074,"content":1075},{"level":97,"textAlign":22},[1076],{"text":525,"type":26,"marks":1077},[1078],{"type":107},{"type":20,"attrs":1080,"content":1081},{"textAlign":22},[1082],{"text":532,"type":26},{"type":20,"attrs":1084,"content":1085},{"textAlign":22},[1086],{"text":537,"type":26},{"type":20,"attrs":1088,"content":1089},{"textAlign":22},[1090],{"text":542,"type":26},{"type":20,"attrs":1092,"content":1093},{"textAlign":22},[1094],{"text":547,"type":26},{"type":20,"attrs":1096,"content":1097},{"textAlign":22},[1098],{"type":387,"attrs":1099},{"id":553,"alt":202,"src":554,"title":202,"source":202,"copyright":202,"meta_data":1100},{},{"type":95,"attrs":1102,"content":1103},{"level":97,"textAlign":22},[1104],{"text":560,"type":26,"marks":1105},[1106],{"type":107},{"type":20,"attrs":1108,"content":1109},{"textAlign":22},[1110],{"text":567,"type":26},{"type":20,"attrs":1112,"content":1113},{"textAlign":22},[1114],{"text":572,"type":26},{"type":20,"attrs":1116,"content":1117},{"textAlign":22},[1118],{"text":577,"type":26},{"type":95,"attrs":1120,"content":1121},{"level":97,"textAlign":22},[1122],{"text":582,"type":26,"marks":1123},[1124],{"type":107},{"type":20,"attrs":1126,"content":1127},{"textAlign":22},[1128],{"text":589,"type":26},{"type":20,"attrs":1130,"content":1131},{"textAlign":22},[1132],{"text":594,"type":26},{"type":20,"attrs":1134,"content":1135},{"textAlign":22},[1136],{"text":599,"type":26},{"type":20,"attrs":1138,"content":1139},{"textAlign":22},[1140],{"text":604,"type":26},{"type":95,"attrs":1142,"content":1143},{"level":97,"textAlign":22},[1144],{"text":609,"type":26,"marks":1145},[1146],{"type":107},{"type":20,"attrs":1148,"content":1149},{"textAlign":22},[1150],{"text":616,"type":26},{"type":20,"attrs":1152,"content":1153},{"textAlign":22},[1154],{"text":621,"type":26},{"id":623,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":624,"copyright":202,"fieldtype":204,"meta_data":1156,"is_external_url":15},{},{"type":17,"content":1158},[1159],{"type":209,"content":1160},[1161,1167,1173],{"type":212,"content":1162},[1163],{"type":20,"attrs":1164,"content":1165},{"textAlign":22},[1166],{"text":636,"type":26},{"type":212,"content":1168},[1169],{"type":20,"attrs":1170,"content":1171},{"textAlign":22},[1172],{"text":643,"type":26},{"type":212,"content":1174},[1175],{"type":20,"attrs":1176,"content":1177},{"textAlign":22},[1178],{"text":650,"type":26},{"id":623,"alt":202,"name":202,"focus":202,"title":202,"source":202,"filename":624,"copyright":202,"fieldtype":204,"meta_data":1180,"is_external_url":15},{},[],[],[],[],{"cache-control":46,"connection":47,"content-encoding":1186,"content-type":49,"date":1187,"etag":1188,"referrer-policy":52,"sb-be-version":53,"server":54,"transfer-encoding":1189,"vary":1190,"via":1191,"x-amz-cf-id":1192,"x-amz-cf-pop":58,"x-cache":59,"x-content-type-options":60,"x-frame-options":61,"x-permitted-cross-domain-policies":62,"x-request-id":1193,"x-runtime":1194,"x-xss-protection":65},"gzip","Thu, 13 Aug 2026 21:02:23 GMT","W\u002F\"fb4b7c6795a1eadd066ce488ecb27895\"","chunked","Origin,Accept-Encoding","1.1 bf30f50cfbcc4e619604398d6a02d0c6.cloudfront.net (CloudFront)","0XFLmpNlwvlmFdFdjRTxg9lvLTjmJ4DSp6WkrSopV_mfpws-ymz2mw==","751057b4-2cd4-405d-af5f-45750333694e","0.034425",1786654943631]