Blog

The thinking behind AI security review.

Threat models, governance evidence, and the decisions that hold up under scrutiny. Written for security architects and the committees they report to.

Newsletter

New posts in your inbox,
when they publish.

Threat modeling, governance evidence, and what AI Committees actually need — written for security architects and AI governance leads. No cadence promises.

No spam. Unsubscribe anytime.

Technical12 min

Indirect prompt injection through retrieved documents

Indirect injection via retrieved documents is harder to detect than direct — the attacker is in the knowledge base, not the conversation.

Regulation12 min

The technical documentation the EU AI Act expects

Annex IV defines what technical documentation high-risk AI needs before market placement. What it requires, what it means, and the common gaps.

Technical11 min

Agent memory as an attack surface

Agents with persistent memory carry forward context that can be poisoned. A past interaction plants instructions that execute in future sessions.

Technical11 min

Sensitive information disclosure in LLM applications

LLMs leak data through three channels: training memorisation, system prompt leakage, and retrieval boundary failures. Each needs distinct controls.

Foundations10 min

AI security review vs penetration testing — different questions

A pentest asks if a system can be exploited. A security review asks if it should ship and under what conditions. Both needed.

Governance10 min

Conditional approval for AI systems — making conditions stick

Conditional approval is the most common AI disposition. Most are written so the conditions can't be enforced. How to make them stick.

Governance9 min

Model-change notification — the vendor clause procurement teams forget

Vendors swap models without notice, invalidating your security review. The contractual clause and review trigger that keeps assessments current.

Technical10 min

The MCP authentication boundary, reviewed

MCP authenticates the agent client, not the end user. Without explicit per-user auth layering, user-level authorisation cannot be enforced.

Reference13 min

ISO 42001 Annex A Controls Explained (Plain Language)

Each ISO 42001 Annex A control domain explained in plain language, with the evidence that demonstrates conformance.

Technical11 min

Access control for RAG — keeping retrieval inside the line

RAG access control must operate at retrieval time, not query time — or users extract documents they would never be permitted to read directly.

Regulation12 min

High-risk AI obligations under the EU AI Act

Six obligations apply to high-risk AI: risk management, documentation, data governance, transparency, oversight, accuracy. Each mapped to evidence.

Technical11 min

Tool-use permissions for agentic AI — least privilege for agents

Most agentic AI tool manifests are over-provisioned. Audit the manifest for each deployment scope and remove capabilities the task does not require.