Today, we’re announcing the AI enablement standard RFP, a new addition to Plutonium for security leaders. You can send it as is or customize it, and every requirement comes with a test the vendor has to pass live.
You sit through the demos. Every vendor says AI-native. Most say intent-aware. Few say how you would test either.
Meanwhile, your teams are already building with AI. Security wants to say yes. What is missing is a straight way to choose the tool that makes yes safe.
Why we built it
AI changed what an endpoint does. A coding agent opens a terminal, calls an MCP server and deploys a change. Someone in finance asks for a script that touches a payment API, and by the afternoon it runs. Security has to answer for all of it.
You are not imagining it. Latio’s 2026 AI Security Market Report points out that vendors from identity, network, cloud and application security all offer competing capabilities, and it sorts the market by use case.
SACR’s Beyond the Action adds another warning: some vendors say “intent” without showing how it works. SACR expects the controls to spread across endpoint, identity, data, browser and MCP tooling rather than settle into one category, so a category label is a poor way to compare vendors.
Under the noise, we keep hearing the same pain points from buyers:
-
- Shadow AI keeps spreading: employees run tools nobody approved, and security finds out late.
-
- The exposure sits across layers: the tools, the MCP servers, skills and packages they call on, and the apps and agents people build.
-
- A ban stops a tool for everyone, when only one action needs stopping.
So we wrote the standard, and we put it where security practitioners and leaders already look: Plutonium. The RFP carries that thinking to the whole market. Use it on any vendor, including us.
How to use it
Discover, Assess, Map, Runtime Protection, Control, Operate. The requirements follow that path: what is running, how risky it is, what an agent can reach, and what you can stop. The last stretch covers how the tool deploys and how it fits the way your team already works.
Each requirement comes with pass criteria. The vendor shows it live, in your proof of concept. A claim on a slide does not count.
Take one requirement. You define an MCP server at a non-default path on a test endpoint. The vendor has to find it, name its origin and say how it detected it.
Open AI enablement standard RFP. Then pick your route.
Want speed? Download the recommended RFP. It holds the must-have capabilities for today’s AI challenges and is ready to send.
Want it your way? Start customizing. Begin from that baseline, add the optional requirements your enterprise needs, and remove what does not apply.
Either way, you leave with a document you can send to any vendor. Share it with your team first if you want a second pair of eyes.
Bring your RFP. We’ll bring the demo.
One last thing. If you are a security leader facing these challenges and want to solve them across your enterprise environment, don’t wait: book a demo with Pluto and we will talk it through.
