The latest articles on DEV Community by Abid Hussain Mohammed (@afokus). https://dev.to/afokus https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4131439%2F90383cc3-f4d4-4a8e-ad6e-8aad75a9b421.png https://dev.to/afokus en Abid Hussain Mohammed Fri, 18 Sep 2026 11:51:05 +0000 https://dev.to/afokus/on-prem-ai-security-tools-that-still-phone-home-1fdf https://dev.to/afokus/on-prem-ai-security-tools-that-still-phone-home-1fdf <h1> On-prem AI security tools that still phone home </h1> <p><strong>Originally published on AFOKUS Research:</strong><br><br> <a href="https://afokus.com/research/on-prem-ai-security-tools-that-phone-home/" rel="noopener noreferrer">https://afokus.com/research/on-prem-ai-security-tools-that-phone-home/</a></p> <p><em>Canonical source: the URL above. Republish with attribution; do not point canonical at the homepage.</em></p> <p>How on-prem AI security installers still egress for license, packs, findings, and support, and how to catch it before you buy.</p> <p>Published August 13, 2026 · Updated August 21, 2026<br><br> Tags: on-prem, zero-egress, procurement<br><br> By AFOKUS Research</p> <p>On-prem is a placement decision. It is not a data-path decision.</p> <p>A product can install on a host you own and still send prompts, findings, license checks, or crash dumps to a vendor network the moment a scan starts. Buyers who treat “on-prem” as “nothing leaves” discover that gap during a residency review, not during the demo.</p> <p>This note is for security and procurement teams who need an assessment to stay inside a boundary they control. You do not need to buy anything to use it.</p> <h2> What on-prem usually hides </h2> <p>Vendors use on-prem to mean the scanner binary runs on your hardware. That is true and incomplete.</p> <p>The incomplete part is the control plane. Many installers still reach out for:</p> <ul> <li>license validation and feature flags</li> <li>attack pack or model updates</li> <li>finding storage and dashboards</li> <li>support tunnels</li> <li>crash and usage telemetry</li> </ul> <p>Each path can carry target metadata. Prompts, tool schemas, hostnames, and screenshots are common.</p> <p>If any of those leave the boundary, the engagement is a hosted workflow with a local agent. The installer location does not change that.</p> <h2> Five egress paths to demand in writing </h2> <p>Ask for a packet-level data-flow diagram. A slide titled “air-gapped option” is not a diagram.</p> <p><strong>License and feature flags.</strong> Some products refuse to start, or drop modules, unless they can reach a vendor control plane. Offline license files exist. Many vendors do not ship them by default.</p> <p><strong>Attack packs and models.</strong> A local engine that downloads new probes mid-run is not offline. Media-based updates that you approve are the honest version of this.</p> <p><strong>Finding upload.</strong> If the only way to read a report is a SaaS portal, findings left your boundary before you did. Local PDF or JSON export with no vendor login is the test.</p> <p><strong>Support tunnels.</strong> Remote assist that mirrors logs or the desktop can move the most sensitive artifacts out first. Treat this as in-scope even when it is “optional.”</p> <p><strong>Crash and usage telemetry.</strong> Default-on telemetry often includes hostnames, versions, and prompt fragments. Default-off, inspectable, and disableable is the minimum.</p> <p>Any one of these can fail a zero-egress review. Several at once is common.</p> <h2> A lab test that does not need the vendor on the call </h2> <p>Run this on a host you control, against a non-production target.</p> <ol> <li>Install from media you received, not from a live download you cannot pin.</li> <li>Disconnect every network path, or allow only DNS you can observe and log.</li> <li>Start a short assessment run that should produce one finding.</li> <li>Export the report to local media.</li> <li>Re-run the same proof after a mock fix, still offline.</li> </ol> <p>If the product stops, waits on a license server, cannot export, or cannot re-prove the fix, treat the on-prem claim as incomplete.</p> <p>Watch the network while it is still connected once, before the unplug test. Unexpected destinations are as useful as a failed unplug.</p> <p>Record the destination, the moment it fired, and whether the product continued after you blocked it. A product that retries forever is still a phone-home product. A product that degrades a feature and says so in the log is easier to contract around.</p> <p>Keep names out of the lab notes unless the buyer already has them. Method notes travel better than a one-off screenshot. File the notes with the procurement record.</p> <h2> How this shows up in regulated buying </h2> <p>Residency and sovereignty rules care about where assessment artifacts live, not where the binary was copied from.</p> <p>A findings report is often more sensitive than the system under test. It is a curated index of credentials, paths, and proof. If that index is stored or processed in a vendor cloud, the assessment itself becomes a data-processing decision.</p> <p>This is not a claim about every regulator. It is a buying test. If you cannot show where prompts and findings went, you cannot defend the engagement to an auditor who asks.</p> <p>Finance and payments buyers usually hit this first because assessment output looks like production data once it contains credentials and paths. The same test applies to any team that promised a customer or a board that test data would not leave a region.</p> <p>Related live notes on afokus.com:</p> <ul> <li><a href="https://afokus.com/research/what-zero-egress-means-for-ai-pen-tests/" rel="noopener noreferrer">What zero-egress means for AI pen tests</a></li> <li><a href="https://afokus.com/research/zero-egress-ai-red-teaming-checklist/" rel="noopener noreferrer">Zero-egress AI red teaming checklist</a></li> <li><a href="https://afokus.com/research/questions-before-saas-ai-security-testing/" rel="noopener noreferrer">Questions before SaaS AI security testing</a></li> </ul> <h2> What a defensible on-prem claim looks like </h2> <p>A defensible claim is boring and testable.</p> <ul> <li>Updates arrive on media you approve, with versions you can pin.</li> <li>License works after install with the cable unplugged.</li> <li>Findings stay on disk you own, in a format an engineer can reopen later.</li> <li>Proof of fix reuses the same offline path that produced the finding.</li> <li>Telemetry is off unless you turn it on, and you can read what it would send.</li> </ul> <p>If a vendor cannot walk that list without exceptions, write the exceptions into the contract or pick a different tool.</p> <p>Exceptions are not automatically disqualifying. An update channel that runs only during a maintenance window you schedule is different from a silent upload of findings. Write the difference down. If the vendor will not write it down, that is the answer.</p> <h2> Closing </h2> <p>On-prem is useful. It is not a substitute for a data-path review.</p> <p>Use the unplug test before you sign. Use the five egress questions in every RFP. Keep the findings file on media you control.</p> <p>AFOKUS Red is built for assessments on infrastructure you control, including zero-egress conditions. Details: <a href="https://afokus.com/products/red/" rel="noopener noreferrer">https://afokus.com/products/red/</a></p> <p>If you want a current-state review against one framework and one environment, <a href="https://afokus.com/audit/" rel="noopener noreferrer">book a remote gap assessment</a>. AFOKUS provides a written gap review and readout. AFOKUS does not issue ISO, SOC 2, NCA, or SAMA certificates.</p> security ai cybersecurity