Three figures from Netskope’s own research summarize why AI traffic requires its own security boundary. Sixty percent of AI usage in enterprises is shadow AI. An average organization records 223 data leakage violations involving generative AI per month. And 54 percent are now running their own locally hosted genAI infrastructure. Adoption is moving fast; governance is lagging behind. That is precisely the gap attackers exploit.
Our knowledge center has thoroughly analyzed Netskope One AI Security over the past period. Not based on product sheets, but by working through the architecture and documentation with two questions in mind: what exactly does this product consist of, and how can a Dutch organization apply it within a Zero Trust and compliance framework? This article shares our findings: the strengths, the sharp edges, and the advice we derive from them.
One thing upfront, because it colors our perspective. AI security is no longer a separate track for us. We now include it as a standard component in every architecture model we develop, alongside the Zero Trust and sovereignty principles we build upon. We therefore do not assess a product based on its feature list, but on whether it can be incorporated into a defense architecture that remains resilient when things go wrong.
What the Product Is Trying to Be
Netskope One AI Security is not a standalone product, but a bundled product line on the Netskope One platform layer. It is the context-aware policy layer across the web, SaaS, private applications, and AI. Its ambition is broad: securing users, applications, data, and autonomous agents from a single platform and across the four AI fronts. These are public generative AI SaaS, privately hosted language models, AI-powered applications, and autonomous agents.
The core consists of a handful of cooperating components. The AI Command Center provides overarching risk visibility and governance. The AI Gateway centralizes, authenticates, and inspects app-to-LLM API traffic to private models. AI Guardrails moderates prompts and responses in real time against prompt injection, jailbreaks, and data leakage. AI Red Teaming hardens models and agents before production through automated adversarial simulations. The Agentic Broker monitors non-human MCP traffic. And Netskope One DLP and DSPM provide data protection: discover, classify, and mask.
Supporting services surround these components, such as the Cloud Confidence Index, which scores applications against more than thirty criteria for enterprise readiness, and AI Labs, which uses UEBA to distinguish normal behavior from malicious behavior.
What Convinced Us
The strongest point is the breadth of coverage within a single policy model/engine. From an employee opening ChatGPT to an agent independently querying a database: everything falls under the same policy. This shortens approval cycles and eliminates blind spots. One customer puts it concretely: employees are allowed to use ChatGPT, but uploading their own confidential data is blocked. Coaching instead of prohibition, with control applied in the right place.
More importantly, we believe the way the product covers non-human traffic is significant. Traditional security proxies are built for traffic from humans to applications. Autonomous interactions between an application and a language model routinely bypass them. The AI Gateway and Agentic Broker explicitly close that gap: only authenticated agents are allowed to communicate with a model, each with a unique token, and every interaction is evaluated rather than trusted after the initial authentication. That is least privilege applied to machines rather than people, and precisely where most organizations still have no answer.
The gateway also sits in front of OpenAI, Google Gemini, and Anthropic Claude through a single API entry point, so you do not have to reinvent policy for each model.
The data side delivers on that promise. DSPM automatically classifies sensitive data and can use a no-code policy engine to trigger de-identification: substitution, redaction, or hashing. It orchestrates native masking in Snowflake and Databricks and also controls third-party tools through standard integrations. Exact Data Matching provides precision instead of coarse-grained patterns. For organizations that take data protection seriously, this is not merely a checkbox, but a fine-grained tool.
What we value as security professionals is that content inspection maps its detections to MITRE ATLAS and the OWASP Top 10 for LLMs. This aligns with the “language” teams already use and shortens investigation time during an incident.
Where You Need to Pay Attention
An honest analysis also identifies where things become less straightforward, and with this product that primarily comes down to three areas.
The first is architectural dependency. The AI product line only delivers its full value when you also use the broader Netskope One stack with DLP and DSPM, because the gateway sources its policy detections directly from Netskope One DLP and Threat Protection. If your SSE layer is provided by another vendor, you are not talking about an extension but a migration.
The second is operational complexity. The AI Gateway is an infrastructure component, not a SaaS service that you simply switch on and forget. You deploy VM images, manage certificates, account for license-based limits on the number of API calls, and troubleshoot using debug bundles. This represents real operational work and assumes a mature management organization.
The third, and for some of our customers the most significant, is sovereignty. The documentation relies on data identification as a compliance instrument, but does not provide a definitive answer regarding the geographic processing location of NewEdge and the control planes. For the financial sector and government, where there are strict requirements around data residency, this is not a detail but a decisive consideration. Our advice is to raise this question with Netskope before any proof of concept, not afterward.
Through a Zero Trust Lens
Because we evaluate every platform against NIST SP 800-207, we mapped the components to the Zero Trust pillars. What immediately stands out is how neatly everything falls into place.
The Netskope Zero Trust Engine functions as the Trust Algorithm that scores context, while the AI Gateway and Agentic Broker act as Policy Enforcement Points that enforce the decision on traffic. AI Labs feeds this algorithm with behavioral signals that deviate from the norm, such as those associated with compromised accounts and data exfiltration. And AI Red Teaming implements the assume-breach principle by allowing the attacker to target the model before it reaches production.
The policy decision itself does rely on the broader Netskope One layer, bringing us back to the dependency described above.
Our Advice: When to Use It, When Not To
For a Dutch organization, the relevant question is not which product checks the most boxes, but where your SSE investment already sits.
If you are already running on the Netskope Security Cloud, Netskope One AI Security is a logical extension with low integration costs that delivers immediate value in shadow-AI detection and data control.
If your SSE layer is provided by another vendor, that integration advantage carries less weight, and you should evaluate the AI modules vendor-neutrally against alternatives with a comparable lifecycle approach.
For orientation, we also looked at the broader market. What distinguishes Netskope is its explicit focus on non-human, agentic workloads through the AI Gateway and Agentic Broker, combined with pre-deployment hardening through red teaming.
In all cases, we recommend a phased approach.
Start with visibility: use the Cloud Confidence Index and discovery to map what AI usage actually exists, including that sixty percent of shadow AI, before enforcing a policy.
Then deploy DSPM classification as data context for your policies and connect identification to your most sensitive data sources.
Only once that foundation is in place should you move toward the AI Gateway as a Policy Enforcement Point for private models and structured red teaming of your agents.
First understand and protect; then establish governance at the agent level.
Finally: The Compliance Layer
For organizations operating in regulated sectors, this product touches three frameworks that matter in the Netherlands.
Under DORA, data protection through DLP and DSPM supports ICT risk management, the gateway’s searchable audit log contributes to detection and incident recording, and AI Red Teaming aligns with testing requirements.
An important distinction here is that an automated adversarial simulation at model level does not replace a formal entity-level TLPT, which specifically assesses the full scenario of a targeted attack.
Under the Cybersecurity Act (Cbw), the Dutch implementation of NIS2, the product relates to access control, strong authentication, and the incident reporting chain.
And for government organizations operating under BIO2, the AI-specific controls, from vulnerability management to network segmentation, directly relate to what this platform provides.
One caveat we make as standard practice: include Netskope itself in your third-party risk register. A vendor managing your AI traffic has become part of your attack surface.
The biggest lesson goes beyond this particular product. AI traffic is a new traffic flow with its own boundary, and a generic firewall or proxy can see neither the prompt injection nor the data exfiltration taking place over that channel.
That is also why we now include AI security as a standard component in our architecture models. Organizations that close this gap now will not be left trying to catch up later.
We are curious to hear how other security teams approach this. Are you already treating agent traffic as a separate traffic flow with its own Policy Enforcement Point, or is it still hidden within the broader proxy? Let us know in the comments or send us a message.
This article is based on research conducted by the knowledge center of Heimdallr Professional Services, a specialist in Zero Trust, Digital Sovereignty, and AI Security, and a Premier Partner of Netskope. The findings are documentary and architectural in nature and are based on the information and knowledge available as of June 2026.
