Artificial intelligence moves fast enough to be hard to keep up with: every few weeks a more capable model ships, and the conversation almost always narrows to a single question, which model is best. Underneath it runs a second, quieter assumption: that a company only really counts if it owns a model of its own.
In cybersecurity that debate has taken on a sharper, more ideological edge. A recurring criticism holds that any security product built on technology that already exists, whether frontier and open-weight models or third-party tools and frameworks, is somehow less legitimate than one built around a model trained entirely in house. The implication is that real innovation lives inside the model weights, and that everything around them is just plumbing.
We think that premise deserves to be challenged directly.
Ask the harder questions. How many companies can honestly claim to have trained a proprietary model that beats the best available models, even in a single narrow domain? And of those that claim it, which ones can point to reproducible benchmarks that prove the advantage, rather than a marketing chart? Building a deliberately limited but fully original model, just to be able to say the model is yours, is not a strategy. It is a constraint dressed up as a virtue.
The goal was never to own every layer of the stack; it was to get excellent results in the real world. And there, the model is only one component. What actually decides whether an AI system is useful, reliable and safe is the environment built around it. That environment has a name.
What an AI Harness actually is
An AI harness is everything a model needs to do real work that is not the model itself: the tools it can call, the data and context it can reach, the memory that carries state across steps, the orchestration that decides what happens next, the interfaces that let humans supervise it, and the guardrails that keep it inside safe boundaries.
A language model, on its own, is a reasoning engine with no hands, no memory beyond its context window, and no awareness of the world it is supposed to act in. It can describe how to test a web application; it cannot open a shell, run the scan, read the response, correlate it with the previous finding, and decide what to try next. The moment you want any of that, you are no longer building a model. You are building a harness.
This distinction matters because it relocates where the engineering effort, and the value, actually sits. A raw model is a general-purpose capability. A harness turns that capability into a system that can operate in a specific domain, under specific constraints, with results you can trust. The harness is the difference between a model that can talk about security and a system that can do security.
Why the harness matters more in cybersecurity than almost anywhere else
Most AI applications ask a model to produce an artifact: a summary, a draft, a snippet of code. The task is essentially one-shot, and the environment is static.
A security assessment is the opposite. It is stateful, adversarial and consequential.
It is stateful because every action changes what you know and what you can do next. A discovered service reshapes the attack surface. A confirmed vulnerability changes the plan. Evidence gathered in step three determines whether step seven is even worth attempting. A model that forgets, or that never sees the accumulated state, cannot reason like a professional.
It is adversarial because the target does not cooperate. Defenses respond, inputs get sanitized, rate limits kick in, and the same technique that worked yesterday fails today. The system has to observe, adapt and try again, not follow a script.
And it is consequential because these actions run against real infrastructure. An agent that executes commands on a live host needs isolation, oversight and the ability to be stopped. There is no undo button on a production network.
None of those properties come from the model. They come from the harness: from the tooling that lets the agent act, the memory that lets it accumulate understanding, the orchestration that keeps it on task, and the controls that keep it accountable. In cybersecurity, the harness is not an accessory to the intelligence. It is where most of the intelligence lives.
Model-centric innovation versus system-centric innovation
There are two ways to make an AI system better.
The first is model-centric: train a bigger or more specialized model and hope the raw capability carries the product. This is the path the "is it proprietary?" debate assumes is the only real one. It is enormously expensive, it ages quickly as the frontier moves, and for all but a handful of organizations it produces a model that is worse than what is already available for free or for rent.
The second is system-centric: take the best models on the market, whichever they are this quarter, and build an environment that makes them dramatically more effective at a real job. Better tools, better context, better orchestration, better guardrails. This path compounds. Every improvement to the harness makes every model you plug into it more capable, and when a stronger model appears you inherit its gains for free.
We made the second choice deliberately, and we have written before about why architecture beats model size in Smarter, Not Bigger. The results are not theoretical: in head-to-head evaluations against other AI-powered offensive platforms, our system consistently ranks among the strongest, and in several documented cases it outperforms far better-known solutions, as in BackBox AI vs Aikido and XBOW on Photoview and BackBox AI vs Neo on MedPortal. Those results are evidence for a simple claim: the harness is where the advantage is won.
Our harness, in three layers
BackBox AI is built as three components that together form a complete harness around whatever model is doing the reasoning. Each maps onto a part of what a harness has to provide.
The tools: turning language into action
The first thing a model needs is a way to affect the world. Ours reaches its tools through the Model Context Protocol (MCP), the emerging open standard for connecting agents to capabilities. That choice is itself a system-centric decision: a standardized interface means the tools and the model are independent of each other, so either can be upgraded without rewriting the other.
Through that interface the agent can do the real work of an assessment on a real machine: run commands, drive a browser, fetch and read pages and documents, search the web, analyze images, map activity to MITRE ATT&CK techniques, and record structured findings as it goes. This is what separates a genuine harness from a chatbot with a few plugins. The agent is not describing a scan. It is running it, reading the output, and deciding what comes next.
Two properties of this layer matter as much as the tools themselves. Each session runs in its own isolated, ephemeral environment, so one user's work can never bleed into another's. And sensitive actions can be held for explicit human approval before they execute, which turns "the AI ran a command" into "the AI proposed a command and a person allowed it."
The reasoning core: context, memory and orchestration
Tools without judgment are dangerous, and judgment without memory is useless. The orchestration core is where a model becomes an operator.
It runs the agent loop that decides, at every step, what to do next, and it does so through composable profiles: focused personas, each scoped to a specific mission and to exactly the tools that mission needs. A red team persona, a malware analyst, a threat hunter and a defender are not the same agent with different instructions; they are different, least-privilege configurations of the harness. Scoping capability to role is a governance decision, and it is enforced by the system rather than requested in a prompt.
Memory is handled on two levels. The durable state of an engagement, its findings, tasks, knowledge and reports, is written to a workspace that persists across turns and even across sessions, so the system accumulates understanding the way a human analyst does. And how much of that history travels to the model on any given turn is a deliberate, configurable choice, because sending everything on every step is neither necessary nor affordable. Deciding how much context to send on each turn is one of the main levers on both answer quality and the system's overall efficiency.
Crucially, this core is model-independent by design. It can drive commercial frontier models when they are the best tool for the job, and it can run entirely on open-weight models inside private infrastructure when privacy, sovereignty or compliance require it, a point we explore in Technological Sovereignty in the Age of AI. The model is a component you can replace. The harness is the part that lasts.
The cockpit: human judgment in the loop
Autonomy without oversight is not a feature in security; it is a liability. The third layer is the operational environment where a person stays in control.
Work begins in a guided composer that turns a rough intention into a well-formed, scoped task: objective, targets, boundaries and the right profile for the job. From there, every action the agent takes is rendered as it happens, so the operator can see the commands, the outputs and the reasoning rather than trusting a black box. The durable workspace, the tasks, the graphs, the knowledge, the reports and the findings, is inspectable at any moment. And the levers stay in human hands: approve or reject a command, cap what a conversation is allowed to spend, schedule a task to run unattended, or switch the model behind the whole thing.
This is what human-in-the-loop actually means when it is engineered rather than claimed. The agent does the volume of work; the professional keeps the judgment, the accountability and the stop button.
How a single task travels the harness
The layers only matter because of how they work together. Consider one request: assess a web application.
The operator frames it in the composer, choosing the objective, the scope and the profile. The reasoning core assembles the right persona, gives it exactly the tools that persona is allowed, and provisions or connects the isolated environment it will run in. The agent begins to act through the tool layer: it enumerates the surface, probes endpoints, reads what comes back, and records each finding as durable state. When it reaches a command that could be disruptive, it pauses for approval. Every step streams back to the cockpit, where the operator watches, steers, and confirms. When the work is done, the same system aggregates the accumulated findings into a client-ready report.
At no point in that flow does the specific model's identity matter to the outcome. What matters is that the harness gave a capable model the tools to act, the context to reason, the environment to operate in, and the controls to stay safe. Swap the model for a stronger one tomorrow and the same flow simply gets better.
Performance, privacy and the economics of a good harness
A well-built harness is not only more capable. It is more efficient, more private and more controllable, and those are business properties, not just technical ones.
Efficiency follows directly from that handling of context. By giving the model only what it needs on each step, the system delivers professional-grade results without professional-grade token bills, which is what makes AI-assisted security accessible rather than a luxury. Cost is then metered as it is consumed, with per-conversation caps and rate limits, so spend stays predictable by design rather than surfacing on an invoice.
Privacy and sovereignty are a direct consequence of model independence. The most sensitive engagements can stay entirely inside infrastructure you control, with no data leaving your boundary. That is how one product answers opposite needs: a team that wants the most advanced models available, and a team that, for regulatory or confidentiality reasons, cannot let its data leave the building.
Control comes from the guardrails being part of the architecture: least-privilege profiles, human approval on sensitive actions, isolation between sessions, spend limits, and a full audit trail. These are not settings bolted on at the end. They are the shape of the system.
The future of agentic cybersecurity
The industry will keep arguing about which model is best, and the answer will keep changing, because a better model is always a few months away. Betting your product on being the one who owns that model is a race most companies cannot win and no company can win permanently.
There is a more durable bet, and it lies in everything that surrounds the model.
In AI-powered cybersecurity, the advantage no longer comes from the model you own, but from the environment you build around the best available models to make them reliable, controllable and safe.
Raffaele Forte, CEO of BackBox Labs
That environment is the harness, and it is what turns a general-purpose model into an operating system for cybersecurity: something you can trust to act, supervise while it does, and improve every time the models underneath it improve. The intelligence of the future will not belong to whoever trains the largest model. It will belong to whoever builds the best system around it.
If you want to see what that looks like in practice, get in touch.