Oracle 宣布 AI 安全网电由OpenAI 网络模型

网络安全

Oracle 宣布 AI 安全网电由OpenAI 网络模型

在 Google 上的首选来源中添加 Unite.AI

Oracle 宣布 Oracle AI Security Mesh于2026年10月27日在拉斯维加斯的Oracle AI World，一个由OpenAI的前沿网络模型驱动的管理平台，Oracle 称的设计旨在帮助各组织更快地发现和固定安全漏洞。

这项提议是对OCI身份保证的补充，后者使用生物鉴别技术来验证人类身份，而OCI Zero Trust Packet Routing则执行网络访问政策以保护关键系统和数据。

“随着AI agents承担更多的责任，企业需要能够跟上这些系统运行速度的安全，”称 Phil Newman,Oracle的安全和身份高级副总裁。 Newman 称的综合能力旨在帮助各组织更快地识别和解决安全风险，同时保持对谁可以授权敏感行动和AI工作量可进入哪些系统的控制。

该平台覆盖了在前提上运行的应用程序和基础设施，在OCI，或者在其他云中运行。 它将OpenAI的前沿网络模型与Oracle的测试工具和上下文对齐，客户提供他们自己的系统。 模型通过应用行为推理，并调查如何利用潜在的弱点，帮助安全小组优先处理最关键的风险，Oracle 称。

测试和补救方法

对于每个发现，平台都提供复制步骤和测试结果等辅助证据，并帮助各小组评价拟议修正。 测试是在客户批准的范围内进行的，平台检查提议的修复如何影响预期的应用行为。 未经客户批准，不得进行补救变更。 每个agent运行在具有明确任务范围和正时权限的鲜明身份下，而独立监视器可以探测和阻止在核定边界外的活动。

Oracle的产品页描述了自动映射客户系统及其之间使用上下文和访问客户提供的连接的发现框架，帮助测试agents发现手动设置较少的弱点。 专用的agents追踪系统之间的弱点如何连接，并测试可能的攻击路径，而单独的agent则检查是否可以复制发现。 发现仍然存在于每个业务的私人知识库中，因此每次评估都以agents已经学到的知识为基础，而该平台优先处理最严重的已证实的弱点。 团队在重新测试前审查建议的修补和agent辅助代码修改。

在2026年10月27日发表的博客文章中，Oracle的AI产品营销经理乔丹·阿科斯塔(Jordan Acosta)描述了一个将边境AI的网络安全模型，包括OpenAI的网络模型，与Oracle的安全专业知识相结合的管理平台。 他阐述了工作流程：Oracle绘制客户系统地图，并提出测试计划供批准；专门的AI agents调查弱点，并测试人们如何利用它们；单独的agent重复测试，以确认问题是否真实；编码agents可以帮助编写代码修正，供团队批准；在应用修改后，平台验证缺口已经关闭，正常活动仍然有效。

Acosta说明了订购应用程序有何种风险，缺少访问检查，客户签字查看订单也可以取回他人的订单，将日常业务互动变成获取私人信息的途径。 他写道，要使AI模型对企业安全测试有效，需要绘图系统，连接工具，协调调查，验证结果，以及控制测试如何运行，Oracle将这些能力集成到一个基于方法，工具和保障措施的管理平台上，通过大规模测试自己的系统来完善，因此客户不必自行建设和运行测试基础设施。

人类批准生物计量核查

在采取诸如发放付款或更改访问许可等敏感行动之前，OCI身份保证可以使用生物鉴别技术确认批准人的身份和存在。 在AI agent工作流程中，Oracle 称帮助确定批准来自被核实的人。 该能力被构建为OCI身份和访问管理，并贯穿所有Oracle云服务，包括OCI和Oracle应用。

Oracle 称的生物鉴别能力还保护雇员的生命周期，使其不通过不断进入企业系统而受雇。 OCI身份保证将身份证件检查与生物鉴别核查相结合，以帮助发现冒牌货，包括那些参与北朝鲜信息技术工人计划的人，随后的生物鉴别检查通过确认获得企业资源的人与注册用户相符，有助于发现冒牌货和账户交易。

零信任包运行和使用例

OCI Zero Trust Packet Routing于2024年首播，Oracle 称是第一个在其平台上实施新兴开放标准的云提供商。 它直接建在OCI的网络织物中，在应用程序和agents本身下执行访问政策。 各组织通过可人读的政策表达其安全意图，这些政策界定哪些资源可以交流，哪些途径可以接触到敏感数据。 数据包路线政策和现有的网络控制必须允许向受保护资源传输，随着网络配置的改变，保护措施仍然有效，Oracle 称有助于防止错配置暴露敏感资源。

对于AI工作量，Oracle 称，该能力可作为一个独立的基础设施保障，可以控制受损的工作量，阻止未经授权的横向移动，并限制数据过滤路径。 Oracle的实施基于通过行业举措制定的开放式规格，并且开源的参考实施可以鼓励更广泛的采用和互操作性。

OpenAI，称边境AI的网络负责人Johannes Landgraf正在创造新的机会，帮助各组织识别和应对日益复杂的安全威胁。 “通过将OpenAI的先进模型与Oracle的企业安全能力结合起来，我们可以帮助安全小组调查复杂的问题，确定关键风险的优先次序，并加快补救，同时维持它们所需要的控制，”Landgraf 称。

Oracle的产品页面也列出了四个部门的目标使用案例。 团队建立和运行 SaaS 应用程序可在发布前测试一个客户是否可以访问另一个客户的数据。 医疗队可以检查连接的门户和应用程序是否将病人的病历暴露给不应接触的人。 金融服务小组可以测试潜在的攻击路径，以进行会计和交易数据，制造商可以检查供应商门户、库存系统以及企业资源规划系统应用程序之间的联系，以发现可能影响生产或实现的漏洞。

Oracle正指示对平台感兴趣的组织与其联系以启动。

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Cybersecurity

Oracle Announces AI Security Mesh Powered by OpenAI Cyber Models

Add Unite.AI to your preferred sources on Google

Oracle announced Oracle AI Security Mesh on October 27, 2026, at Oracle AI World in Las Vegas, a managed platform powered by OpenAI’s frontier cyber models that Oracle said is designed to help organizations find and fix security vulnerabilities faster.

The offering complements OCI Identity Assurance, which uses biometrics to verify human identities, and OCI Zero Trust Packet Routing, which enforces network access policies to protect critical systems and data.

“As AI agents take on more responsibility, enterprises need security that can keep pace with how these systems operate,” said Phil Newman, Oracle’s senior vice president of Security and Identity. Newman said the combined capabilities are intended to help organizations identify and resolve security risks faster while maintaining control over who can authorize sensitive actions and which systems AI workloads can access.

The platform covers applications and infrastructure running on-premises, in OCI, or in other clouds. It pairs OpenAI’s frontier cyber models with Oracle’s testing tools and context that customers supply about their own systems. The models reason through application behavior and investigate how potential weaknesses could be exploited, helping security teams prioritize the most critical risks, Oracle said.

How Testing and Remediation Works

For each finding, the platform supplies supporting evidence such as reproduction steps and test results, and it helps teams evaluate proposed fixes. Testing happens within a scope the customer has approved, and the platform checks how proposed fixes affect expected application behavior. No remediation change is applied until the customer approves it. Every agent runs under a distinct identity with a defined task scope and just-in-time permissions, while independent monitors can detect and stop activity outside approved boundaries.

Oracle’s product page describes discovery frameworks that automatically map a customer’s systems and the connections between them using the context and access the customer provides, helping testing agents find weaknesses with less manual setup. Specialized agents trace how weaknesses connect across systems and test possible attack paths, while a separate agent checks whether findings can be reproduced. Discoveries remain in a private knowledge base for each business, so every assessment builds on what the agents have already learned, and the platform prioritizes the most serious confirmed weaknesses. Teams review recommended fixes and agent-assisted code changes before they are retested.

In a blog post published October 27, 2026, Jordan Acosta, a product marketing manager for AI at Oracle, described a managed platform that combines frontier AI models for cybersecurity, including OpenAI Cyber models, with Oracle’s security expertise. He laid out the workflow: Oracle maps a customer’s systems and proposes a test plan for approval; specialized AI agents investigate weaknesses and test how someone could exploit them; a separate agent repeats the test to confirm the problem is real; coding agents can help prepare code fixes for the team’s approval; and after changes are applied, the platform verifies that the gap is closed and that normal activity still works.

Acosta illustrated the kind of exposure at stake with an ordering application missing an access check, where a customer signing in to view an order could also retrieve someone else’s, turning a routine business interaction into a path to private information. Making an AI model effective for enterprise security testing requires mapping systems, connecting tools, coordinating investigations, validating findings, and controlling how tests run, he wrote, and Oracle assembled those capabilities into a managed platform built on methods, tooling, and safeguards refined through testing its own systems at scale, so customers do not have to build and operate that testing infrastructure themselves.

Biometric Verification for Human Approvals

Before a sensitive action such as releasing a payment or changing access permissions, OCI Identity Assurance can use biometrics to confirm the identity and presence of the person approving it. In AI agent workflows, Oracle said, that helps establish that approvals come from verified people. The capability is built into OCI Identity and Access Management and works across all Oracle Cloud services, including OCI and Oracle applications.

Oracle said the biometric capabilities also protect the employee lifecycle, from hiring through ongoing access to enterprise systems. OCI Identity Assurance combines identity document checks with biometric verification to help detect impostors, including those involved in North Korean IT worker schemes, and subsequent biometric checks help uncover impersonation and account handoffs by confirming that the person accessing enterprise resources matches the enrolled user.

Zero Trust Packet Routing and Use Cases

OCI Zero Trust Packet Routing debuted in 2024, and Oracle said it was the first cloud provider to implement the emerging open standard in its platform. Built directly into OCI’s network fabric, it enforces access policies beneath applications and agents themselves. Organizations express their security intent through human-readable policies that define which resources can communicate and which pathways can reach sensitive data. Traffic to a protected resource must be permitted by both the packet-routing policies and existing network controls, and the protections remain in force as network configurations change, which Oracle said helps prevent misconfigurations from exposing sensitive resources.

For AI workloads, Oracle said, the capability serves as an independent infrastructure safeguard that can contain compromised workloads, block unauthorized lateral movement, and restrict data exfiltration paths. Oracle’s implementation is based on an open specification developed through an industry initiative, and an open-source reference implementation is available to encourage broader adoption and interoperability.

Johannes Landgraf, head of cyber at OpenAI, said frontier AI is creating new opportunities to help organizations identify and respond to increasingly sophisticated security threats. “By combining OpenAI’s advanced models with Oracle’s enterprise security capabilities, we can help security teams investigate complex issues, prioritize critical risks, and accelerate remediation while maintaining the controls they require,” Landgraf said.

Oracle’s product page also lists target use cases across four sectors. Teams building and running SaaS applications can test before a release whether one customer could access another’s data. Healthcare teams can check whether connected portals and applications expose patient records to people who should not have access. Financial services teams can test potential attack paths to account and transaction data, and manufacturers can examine connections between supplier portals, inventory systems, and ERP applications for gaps that could affect production or fulfillment.

Oracle is directing organizations interested in the platform to contact it to get started.

Auto-fetched and translated by AI Atlas. All rights belong to the original author.