Axonius secures multi-tenant AI agents on AWS Bedrock AgentCore with silo isolation

Axonius, the asset intelligence platform that reconciles data from over 1,400 systems, has integrated AI agents into its SaaS offering using Amazon Bedrock AgentCore. The company runs hundreds of isolated customer environments on AWS, each in a dedicated VPC with its own ALB, NLB, databases, and compute. To add agentic workloads without breaking their existing architecture, Axonius chose the silo model: one dedicated agent per tenant, deployed into AgentCore runtime. This contrasts with pool (shared agent with per-session IDs) and bridge (hybrid) patterns, but silo aligns with Axonius's strict tenant isolation needs for sensitive customer data.

Axonius's first agent interprets enterprise environments to identify gaps and risks, analyzing millions of data points from dozens of concurrent integration sources. It lets junior analysts run complex analyses without tying up senior staff. Key implementation requirements included integrating the agent's identity flow with their existing EC2-based auth module, tracking model invocation costs per tenant, secure access to tenant APIs, lifecycle management via current CD workflows, and observability across a large fleet of agents. By leveraging AgentCore with a dedicated agent per tenant VPC, Axonius maintains security, enables precise cost tracking, and scales agentic features while preserving its established SaaS methodology.