you are deploying AI applications or agents and need runtime protection, model scanning and posture management for them.
your engineers use AI to write code and you need a record of what it was asked and what it produced.
Prisma AIRS is an AI security platform: it addresses the risks of AI systems an organisation deploys — scanning models and supply chain, protecting applications and agents at runtime against prompt injection and unsafe output, and managing posture across that estate. If you are shipping AI into production, these are real threats with real incidents behind them.
The distinction is the same one that separates a firewall from version control. One decides, continuously, whether something dangerous is happening right now. The other keeps a record so a question can be answered later. Both are legitimate; neither produces the other's output as a side effect.
An AI security platform watching your deployed agents has no relationship with the Claude Code session a developer ran on a laptop last Tuesday. That session did not touch your infrastructure. Its artefacts are JSONL files in a home directory, governed by a retention default rather than by your policy, and deleted after thirty days unless someone changed a setting nobody was shown.
The AI you deploy is inside your perimeter. The AI that writes your code is on a laptop, talking to someone else's API, keeping its record in a directory your security stack has never heard of.
There is one honest overlap, and it is the reason both come up in the same conversation. If an AI-written change introduces a vulnerability, the security platform may catch the behaviour at runtime — and the next question will be how that code came to exist. That second question is answered by a record of the conversation that produced it, or it is not answered at all.
That is the sequence worth planning for: detection tells you something is wrong, provenance tells you how it got there, and only the second one has to have been set up in advance.
We are not a security control. We do not scan, block, or detect prompt injection, and a team that adopts us believing otherwise has misread the product. We redact obvious secrets on the way in and keep everything local by default, which is a data-handling posture rather than a security capability.
If your worry is your deployed AI being attacked, buy the security platform. If your worry is that nobody can reconstruct how a large share of your codebase was written, that is a different budget line and a different product — and it is the one with a deletion timer running against it.