What new attack surface does AI add, and how do you cover it?
Prompt injection through any content a model reads, data leaking through prompts and logs, over-permissioned agents acting with credentials nobody audited, and a supply chain of models and tools nobody inventoried. The controls are mostly familiar: least privilege, input boundaries, logging, and an inventory. What is new is where they have to sit.
AI Security
The surface is genuinely new, the controls mostly are not
Nothing here requires abandoning what your security team already knows. Least privilege, input boundaries, logging, and an accurate inventory remain the answer. What changes is that they now have to cover actors that read natural language and act on it.
The four failures we find most
Content that instructs. A model cannot reliably distinguish the content it reads from instructions about what to do. If an agent reads email, a document, or a web page, that text can redirect it. The defence is limiting what the agent can do after reading anything untrusted, not writing a stricter prompt.
Retrieval inheriting permissions nobody checked. A knowledge assistant surfaces what its corpus contains. If the corpus was assembled from a file share with a decade of accidental sharing, the assistant is now an efficient way to find things people should not see.
Agents with credentials nobody audited. An agent given an API key for convenience has the permissions of that key, on its own schedule, without a person watching. Least privilege applies here and rarely has been.
No inventory. Most organizations cannot list the models and AI tools in use, because half were adopted by a team with a corporate card. You cannot secure an inventory you do not have.
What we leave behind
Boundaries that hold, an inventory that is maintained, logging that captures what matters for this class of failure, and runbooks for the incidents specific to it. We map to NIST AI RMF and ISO/IEC 42001 where you need the paperwork, but the deliverable is the control rather than the certificate.
What you get
- An inventory of every model, tool, and agent in use, including the ones nobody approved
- Prompt injection review: what content reaches a model, what it can do afterwards, and where the boundary sits
- Data-exposure review across the retrieval corpus and the permissions it inherits
- Agent permission boundaries: least privilege applied to non-human actors that can act
- Logging and monitoring designed for AI-specific failure rather than adapted from application logs
- Incident runbooks for the failures that are specific to this: leaked prompt, poisoned corpus, over-broad agent action
Questions we get
- What is prompt injection, in practical terms?
- Any content a model reads can contain instructions, and the model cannot reliably tell content from command. A document in your retrieval corpus, an email in an inbox an agent monitors, or a web page a tool fetches can all redirect what the model does next. The defence is not a better prompt. It is limiting what the model can do after reading untrusted content.
- Our data does not leave the tenant. Are we covered?
- Not necessarily. Microsoft 365 Copilot staying inside a tenant boundary addresses the vendor question, not the internal one. It surfaces whatever a user can already reach, and in most tenants that is far more than anyone intended. The permissions review is the work, and the tenant boundary does not remove it.
- How is this different from our existing security programme?
- The controls are familiar. Where they sit is not. Least privilege now applies to agents that act on their own schedule, input validation applies to natural language nobody can pattern-match, and your asset inventory has to include models and tools that a team adopted without a procurement process.
How it starts
Three-week assessment, then four to eight weeks of remediation. You keep everything produced, whether or not there is a next part.