Education Hub

AI for HPC Research Education Hub — Agentic AI Security Gap

A curated resource library for Federal research organizations, universities, and HPC research teams navigating the shift to agentic AI at scale. Education first. Practical direction always.

How access works

How to Access Resources

Some materials are available as direct links. Others are gated — meaning we ask for your contact information so we can:

Match materials to your specific context
Send the right format for your audience (executive brief, technical reference, or framework)
Follow up if your situation calls for more specific guidance

Request gated access

To request gated access: [email protected] — include your name, organization, and the topic(s) you are most interested in. We will respond as soon as possible — often within 24 hours.

[email protected] [email protected]

Security reference

What Is OWASP — and Why Does It Matter for Agentic AI?

OWASP stands for the Open Worldwide Application Security Project. It is a nonprofit, open community that develops practical guidance for improving software and application security. OWASP is best known for its Top 10 lists, which help organizations understand the most significant security risks affecting traditional applications, APIs, generative AI, and autonomous AI agents.

OWASP does not sell security software. It provides open guidance, risk frameworks, and practical security recommendations that organizations can use to evaluate their applications and AI environments.

Explore the OWASP GenAI Security Project

OWASP Top 10 for Web Applications

Risks such as broken access control, injection, authentication failures, security misconfiguration, and software-supply-chain failures.

OWASP Top 10 for LLM and Generative AI Applications

Risks including prompt injection, sensitive-information disclosure, data and model poisoning, insecure outputs, and excessive agency.

OWASP Top 10 for Agentic Applications

Risks created when AI agents can use tools, access data, invoke software, and take actions without waiting for human approval — including agent-goal hijacking, tool misuse, identity and privilege abuse, agentic supply-chain vulnerabilities, and unexpected code execution.

The Important Distinction

A traditional AI model primarily generates an answer.

An AI agent may be authorized to retrieve research data, execute code, call APIs, modify systems, or initiate workflows. Security risk therefore comes not only from what the agent says, but also from what the agent can access, which tools it can use, what actions it is permitted to take, whether sensitive data is appropriate for the workload, and how quickly an unintended action can be detected and stopped.

Compute & GPU-era reality

Compute & GPU-Era Reality

The SSD supply crisis of 2026 reflects a structural reallocation of global semiconductor capacity toward AI infrastructure. Understanding these shifts — and building flexible, open data architectures — is essential for IT leaders and storage architects who need to keep research and mission-critical workloads running.

Survival guide — Hammerspace

The SSD Supply Crisis of 2026: A Strategic Infrastructure Survival Guide

Prepared for IT Infrastructure Leaders and Storage Architects

The SSD supply crisis of 2026 reflects a structural reallocation of global semiconductor capacity toward AI infrastructure. To drive AI initiatives and other critical business initiatives, adopting a flexible "open" data architecture mitigates supply chain risk. This Survival Guide outlines the structural drivers behind the supply crisis and provides a practical checklist to reduce supply risk with Hammerspace.

Gated resource

Available through the Hammerspace resource library. Request access to receive the full guide.

Request via [email protected]

Data governance & policy

Data Governance Is the Missing Layer in AI Infrastructure

Most AI infrastructure conversations focus on compute, networking, and storage tiers. Data governance — the policies, classification, and enforcement layer that determines what data an AI agent can access, move, or act on — is consistently the gap that creates the most exposure. The slide below captures the core argument.

This slide is drawn from a presentation delivered to Federal research and HPC audiences. It is available as part of the Starter Pack or on request for use in internal briefings.

Presentation slide: The Missing Layer in AI Infrastructure Is Data Governance — explaining why policy enforcement at the data plane is essential for agentic AI security — This slide is drawn from a presentation delivered to Federal research and HPC audiences. It is available as part of the Starter Pack or on request for use in internal briefings.

Military contractor — Secuvy case study

Only 1 in 20,000 export-controlled files carried the correct sensitivity label.

38%

of files misclassified per ITAR, CUI & Sensitive PII guidance

1 in 20,000

export-controlled files carried the correct sensitivity label

CUI / ITAR / EAR

data classifications found out of compliance

A premier U.S. defense contractor running dozens of parallel programs — for NASA, Space Force, the DoD, and the intelligence community — had a governance policy that was unambiguous: CUI, ITAR, EAR, and NARA data must be identified, classified, tagged, and labeled. Secuvy automated discovery found that 38% of files were misclassified per ITAR, CUI & Sensitive PII guidance. In fact, only 1 in 20,000 export-controlled files carried the correct sensitivity label.

Gated resource

Full case study available through the Secuvy gated resource library.

Request via Secuvy.ai

BioPharma — Secuvy case study

From ungovernable sprawl to appropriate, AI-ready data — with $30M in risk quantified along the way.

$30M

in residual risk quantified — used to defend cyber-insurance premiums

~40%

lower cyber-insurance premiums achieved

60+ vendors

brought under governed control with <1 FTE

A commercial-stage dermatology biopharmaceutical company relies on third parties to run its clinical trials. When data returns, it sprawls instantly — accessed, copied, and reused by research, BI, and data-science teams. What sprawls is not only patient data but the company's crown-jewel IP: drug formulations, product-development data, target and mechanism research, and patient-population and biomarker insights. Clinical-trial data and IP are largely non-patterned — they don't match the fixed rules traditional tools depend on. Secuvy deployed agentlessly across the hybrid, global estate and classified millions of records in context, including relationship-driven questions like minors and consent expiry that pattern-based tools miss entirely.

Gated resource

Full case study available through the Secuvy gated resource library.

Request via Secuvy.ai

HPC architecture patterns

HPC Architecture Patterns

Reference materials for HPC and research computing teams evaluating AI-ready infrastructure — covering data platform architecture, storage orchestration, and the operational patterns that determine whether an AI deployment succeeds or stalls.

Technical overview · Hammerspace

Hammerspace AI Data Platform

HPC architects, research computing directors, infrastructure leads

Hammerspace decouples data from infrastructure — enabling parallel access across NFS, SMB, and S3 from any compute node, anywhere. This technical overview covers the Global Data Environment architecture, parallel file system orchestration, and how Hammerspace eliminates the data-movement bottleneck that stalls most enterprise AI deployments.

What it covers

Global Data Environment — single namespace across on-prem, cloud, and edge
Parallel NFS/SMB/S3 access from any compute node without data migration
Metadata-driven orchestration separates data management from physical storage
Designed for GPU-dense AI training workloads and HPC research pipelines

Technical overview

Download technical overview (PDF)

Vendor introduction

For a vendor introduction to Hammerspace, contact Mike directly.

[email protected]

Security frameworks & references

Security Frameworks & References

Practical solution briefs and reference materials for organizations evaluating data security posture management, AI data filtering, and enterprise data governance. All briefs are available through the Secuvy gated resource library.

Solution brief · July 2026 — Secuvy AI

When DSPM Isn't Enough

Traditional data security posture management tools rely on regex and pattern matching — approaches that score just 52.7% accuracy on real enterprise data. This brief explains why AI-native classification is required for organizations that need to govern sensitive data at scale.

"Regex-only classification scored just 52.7% — versus 95% for AI."
Independent regex vs. AI data-classification benchmark, 2026

Gated resource

Full solution brief available through the Secuvy gated resource library.

Request via Secuvy.ai

Solution brief · June 2026 — Hammerspace + Secuvy AI

Confident AI. Less Risk. Faster Returns.

Hammerspace and Secuvy turn enterprise data into the fuel for business-ready AI. Most AI programs don't fail at the model — they fail at the data. This brief outlines how a joint Hammerspace and Secuvy deployment ensures only appropriate, governed data enters your AI pipeline.

"Most AI programs don't fail at the model — they fail at the data."
Hammerspace + Secuvy AI Solution Brief, June 2026

Gated resource

Full solution brief available through the Secuvy gated resource library.

Request via Secuvy.ai

Solution brief · June 2026 — Secuvy AI

Data Filtering for Confident AI

Secuvy ensures only appropriate data ever enters your AI pipeline — filtered, governed, and optimized. This brief addresses the challenge that 58% of IT leaders cite as their top technical obstacle: classifying data for AI at enterprise scale.

"58% of IT leaders cite classifying data for AI as their top technical challenge."
Komprise, 2026 State of Unstructured Data Management (5th annual survey)

Gated resource

Full solution brief available through the Secuvy gated resource library.

Request via Secuvy.ai

Acronym & terminology guide

Acronym & Terminology Guide

Federal, defense, and research computing environments run on acronyms. This reference covers the compliance frameworks, data classification markings, security controls, and infrastructure terms that appear most frequently in agentic AI security conversations — from CMMC and CUI to HPC and DSPM.

Reference guide · CMMC & HPC

CMMC Reference Guide

Compliance officers, research computing directors, IT security leads

A side-by-side reference covering how CMMC requirements apply differently to research universities versus traditional defense contractors — including CUI handling, ITAR/EAR obligations, system boundary definitions, and the compliance gaps that most frequently surface during agentic AI deployments in academic and federal research environments.

What it covers

CMMC Level 1–3 applicability across university and contractor environments
CUI, ITAR, EAR — definitions, markings, and handling requirements
Key acronyms: DFARS, NIST SP 800-171, FCI, CDI, SSP, POA&M
Research computing–specific compliance considerations and common gaps

References

Reference guide

Download CMMC Reference Guide (PDF)

Get in touch

Questions about compliance posture for your research environment?

[email protected]

Starter pack

Request the Starter Pack

New to the Agentic AI Security Gap topic? Request our Starter Pack — a curated set of materials designed for both leadership and technical audiences:

A short reading list (high signal, low noise)
The five-layer Agentic AI Security Gap framework (Identity / Governance / Data Plane / Runtime / Infrastructure)
Recommended next steps for closing the gap in your environment
Key acronyms and terminology reference

Request the Starter Pack

Include your name, organization, and role. We will send the right version for your audience.

Vendor topic introductions

When You're Ready for a Conversation

If your research leads you toward a specific topic area and you want an introduction to a specialist:

Policy-based governance / sensitive data classification: [email protected]
HPC data architecture / Tier 0 / distributed storage alignment: [email protected]
Capacity-tier storage / LStore architecture: [email protected]
Recognized authoritative source for current LStore information and assistance: [email protected]
GPU / server / infrastructure procurement: [email protected]
OWASP Top 10 for LLM Applications — open security reference for agentic AI risks (no introduction needed; public resource): [email protected]

Introductions are made when they genuinely fit your situation. We remain a trusted advisor — not a reseller.

Ready to start learning?

Ready to Start Learning?

Request Gated Access Ask a Question / Get Guidance Visit Gluck Enterprises