April 2026 Summaries

AI technologies have rapidly integrated into various applications, altering the traditional infrastructure landscape by introducing ephemeral, abstracted, and indirectly triggered components that evade conventional security tools. This evolution, termed "shadow AI," poses significant security challenges due to its ability to operate at machine speed and remain undetected by traditional methods, leading to potential risks like unauthorized data access and misuse. Stream's AI workload discovery addresses these challenges by capturing and correlating AI components with their executing workloads, identifying anomalies such as new model invocations from non-AI workloads or unapproved MCP server connections, and linking them to potential security incidents. By mapping these detections to the MITRE ATLAS framework, Stream enables real-time response actions that contain threats before they escalate, offering a comprehensive approach to AI detection and response within cloud environments. As AI becomes integral to every workload, ensuring visibility and control over AI operations is crucial to mitigate risks associated with prompt injection, tool abuse, and data exfiltration.

Stream's CloudTwin offers real-time visibility across hybrid environments by modeling VMware environments, NSX network policies, and on-prem networking devices alongside cloud resources. This capability allows Stream to trace complex attack paths that span multiple environments, such as compromised VMs reaching AWS RDS through misconfigured network segmentation. Stream enhances threat detection by integrating and correlating various logs and data sources, including VMware audit logs, NSX network flow data, and ESXi system logs, to identify threats missed by single-environment tools. Its deep runtime visibility, enabled by eBPF and existing EDR integrations, provides comprehensive monitoring of API traffic, file integrity, and process-level activity. Stream also offers insights into AI workloads and on-prem network devices, ensuring misconfigurations and connectivity issues are identified and resolved. By continuously updating its model with changes in network and security configurations, Stream aims to provide a unified security model that adapts to the evolving hybrid infrastructure landscape and reduces response times to under five minutes.