The thinking behind AI security review.
Threat models, governance evidence, and the decisions that hold up under scrutiny. Written for security architects and the committees they report to.
New posts in your inbox,
when they publish.
Threat modeling, governance evidence, and what AI Committees actually need — written for security architects and AI governance leads. No cadence promises.
Indirect prompt injection through retrieved documents
Indirect injection via retrieved documents is harder to detect than direct — the attacker is in the knowledge base, not the conversation.
The technical documentation the EU AI Act expects
Annex IV defines what technical documentation high-risk AI needs before market placement. What it requires, what it means, and the common gaps.
Agent memory as an attack surface
Agents with persistent memory carry forward context that can be poisoned. A past interaction plants instructions that execute in future sessions.
Sensitive information disclosure in LLM applications
LLMs leak data through three channels: training memorisation, system prompt leakage, and retrieval boundary failures. Each needs distinct controls.
AI security review vs penetration testing — different questions
A pentest asks if a system can be exploited. A security review asks if it should ship and under what conditions. Both needed.
Conditional approval for AI systems — making conditions stick
Conditional approval is the most common AI disposition. Most are written so the conditions can't be enforced. How to make them stick.
Model-change notification — the vendor clause procurement teams forget
Vendors swap models without notice, invalidating your security review. The contractual clause and review trigger that keeps assessments current.
The MCP authentication boundary, reviewed
MCP authenticates the agent client, not the end user. Without explicit per-user auth layering, user-level authorisation cannot be enforced.
ISO 42001 Annex A Controls Explained (Plain Language)
Each ISO 42001 Annex A control domain explained in plain language, with the evidence that demonstrates conformance.
Access control for RAG — keeping retrieval inside the line
RAG access control must operate at retrieval time, not query time — or users extract documents they would never be permitted to read directly.
High-risk AI obligations under the EU AI Act
Six obligations apply to high-risk AI: risk management, documentation, data governance, transparency, oversight, accuracy. Each mapped to evidence.
Tool-use permissions for agentic AI — least privilege for agents
Most agentic AI tool manifests are over-provisioned. Audit the manifest for each deployment scope and remove capabilities the task does not require.
Free resources
Practical templates for every framework covered here.
AI Security Review Template
Full review pack with threat model, controls, and evidence grading.
OWASP Agentic Top 10 Controls
Each risk mapped to required controls and lifecycle gates.
AI Risk Disposition Memo
Clearance decision template with rationale and sign-off log.
AI Go-Live Security Checklist
Production gate checklist for security architects and CISOs.