How Axonius built secure multi-tenant AI agents on Bedrock AgentCore
Learn how Axonius, a cybersecurity SaaS provider, used Amazon Bedrock AgentCore to deploy fully isolated, multi-tenant AI agents across hundreds of customer environments, without building custom compute isolation, authentication, or observability infrastructure from scratch.
Independent Software Vendors (ISVs) often provide their services through the Software as a Service (SaaS) model. When planning to add agentic workloads, ISVs face three primary architectural patterns: silo, bridge, and pool. This article explores how Axonius, a security and IT asset intelligence platform, chose its architecture for deploying AI agents on Amazon Bedrock AgentCore.
Axonius, which manages hundreds of isolated customer environments on AWS, sought to add AI agents that interpret large enterprise environments and identify gaps and risks. By integrating AI agents, Axonius aimed to reduce the manual burden on security teams and junior analysts while maintaining tenant isolation, secure identity management, cost tracking, and seamless integration with existing workflows.
Axonius opted to keep its current tenant management methodology, which uses a silo deployment model, where each customer workload resides in a dedicated Amazon Virtual Private Cloud (Amazon VPC). The team needed to address several critical requirements, including tenant isolation, identity integration, cost tracking, secure integration with APIs, lifecycle management, and observability.
The first architectural option considered was the pool model, where tenants share resources and one agent serves multiple tenants. This approach offers operational simplicity and rapid customer onboarding but relies on application-level controls for tenant isolation. The second option was the bridge model, which combines shared runtime with gateway-enforced tool isolation, allowing some components to be in silo mode while others are in pool mode.
The final option was the silo model, where each tenant has dedicated resources, providing the highest level of isolation and control.
After evaluating the options, Axonius chose the silo model for deploying its AI agents. This decision allowed the company to maintain its silo deployment methodology while addressing the key requirements for secure, multi-tenant AI agent deployments on AWS.
Written by urgent.news from AWS Machine Learning's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
