Malik Haidar has spent his career in the trenches of multinational cybersecurity, navigating the shifting front lines where enterprise data meets emerging technology. As a veteran expert in analytics and intelligence, he has witnessed the evolution of threats from simple malware to the complex, agentic world of the Model Context Protocol (MCP). With the recent August 2026 rollout of Cloudflare’s new network-level detection capabilities, Malik is now focusing his expertise on the “Shadow MCP” phenomenon. His strategy moves beyond mere technical blocking, aiming to integrate deep business logic into the security stack to ensure that as companies embrace AI agents, they aren’t inadvertently exposing their most sensitive assets.
In this conversation, Malik explores the transition from abstract AI security to practical, protocol-level governance. He delves into the alarming vulnerabilities discovered in thousands of unmanaged servers, the technical breakthroughs of the latest July 2026 MCP specification, and the structured governance models—visibility, approval, and enforcement—that are now available to CISOs. By examining tools like WriteGuard and the nuances of agentic “on-ramps,” he provides a roadmap for securing the next generation of enterprise connectivity.
How does the rise of unsupervised MCP deployments, often referred to as “Shadow MCP,” fundamentally shift the risk profile for a modern enterprise compared to earlier challenges like Shadow IT?
The emergence of Shadow MCP is a direct reflection of how quickly employees want to move in this high-speed AI era. We see engineers and analysts finding interesting servers in public repositories or through product guides and immediately connecting them to their clients to see what they can do. Because these connections are often made outside of formal governance, they create a silent, unmonitored bridge between internal data and external tools. Unlike traditional Shadow IT, where you might just be worried about a rogue SaaS app, Shadow MCP involves agentic traffic that can act on behalf of the user, making it much harder to track using old-school URL filtering. It turns the enterprise network into a porous environment where unvetted agents can potentially exfiltrate data or execute commands without a single security alert being triggered.
Looking at the data from the recent DEF CON 34 presentation, what are the specific technical vulnerabilities that make these unmanaged MCP servers such a significant threat to corporate integrity?
The findings presented by David Fiser are a wake-up call for anyone underestimating the fragility of this ecosystem. When you analyze over 19,000 MCP servers and find that 82% of them exhibit path traversal exposure, you realize we are dealing with a massive structural weakness. It doesn’t stop there; 34% of those servers were vulnerable to command injection, which essentially hands the keys to the kingdom to any attacker who knows how to craft the right request. Perhaps the most frustrating detail is that only 8.5% of these analyzed servers utilized OAuth for authentication. This means the vast majority of these “helper” tools are wide open, lacking even the most basic modern security handshakes, and leaving the door unlocked for anyone to bypass existing controls.
With the introduction of the MCP 2026-07-28 specification, how has the ability to detect and classify agentic traffic at the network layer been technically transformed?
The July 2026 update to the protocol was a massive turning point because it shifted the entire architecture to a stateless, per-request model. By removing the initial handshake and placing versioning and operation details directly on every single request, the protocol became “identifiable on the wire” in a way it never was before. This allows us to use Gateway selectors like the experimental.is_mcp == true primitive to inspect TLS-inspected traffic for specific headers, such as MCP-Protocol-Version and Mcp-Name. We can now look for JSON-RPC method patterns in real-time rather than trying to maintain a session state that a clever attacker could easily manipulate. It gives security teams a deterministic method to flag and govern this traffic the moment it touches the network.
How should a CISO practically implement the three-part governance model of visibility, approval, and enforcement to reign in Shadow MCP without stifling innovation?
You have to start with visibility—you can’t govern what you can’t see. We use a dedicated dashboard to track total request volumes and identify the specific users who are hitting servers outside of our approved portals, which is the “smoking gun” of Shadow MCP. Once we have that data, we work to move those approved servers behind managed portals where they can be subjected to our access policies and data loss prevention (DLP) checks. The final, and most critical, step is enforcement, where we implement policies that say if the traffic isn’t on a managed on-ramp, it doesn’t get through. By setting a rule where traffic must be on the portal or it gets blocked, we prevent the “portal bypass” problem where an engineer might start with an approved server but then try to connect to a risky upstream URL directly.
In the context of protecting internal systems, how does the WriteGuard control pattern change the way organizations handle agent-driven write operations?
WriteGuard is really the gold standard for granular control because it allows us to assign specific risk tiers to every individual tool an agent might use. It’s not just a binary “yes or no” for the whole server; we can let read operations pass through completely unchanged while putting heavy guardrails on anything that looks like a write. For allowed writes, the system adds agent attribution and detailed audit events so we know exactly who did what and why. If an agent attempts a critical action that falls into a high-risk tier, WriteGuard can block the handler before it ever executes. This level of intervention is crucial because, as we’ve seen, the introduction of AI agents changes the threshold of how much work—and how much damage—can be done in a single day compared to a human clicking and typing.
What is your forecast for the evolution of agentic connectivity and its impact on the future of the corporate network perimeter?
We are witnessing the technical maturation of agentic infrastructure, moving past the “wild west” phase where everyone was just excited to get things running. I expect that in the coming months, the ability to treat MCP traffic as a distinct, first-class protocol within the network stack will become a baseline requirement for any serious enterprise. We will see a shift where security is no longer an afterthought but is baked into the “on-ramp” of every AI interaction. Ultimately, the successful organizations will be those that treat these agents not as black boxes, but as transparent, auditable participants in their business processes. The goal is a world where an engineer can work with any tool they need, but the path they take is always one that we’ve already secured and verified.
