The thinking behind AI security review.
Threat models, governance evidence, and the decisions that hold up under scrutiny. Written for security architects and the committees they report to.
New posts in your inbox,
when they publish.
Threat modeling, governance evidence, and what AI Committees actually need — written for security architects and AI governance leads. No cadence promises.
A worked example: AI Risk Disposition for a Copilot Studio procurement agent
A full worked example: every disposition section filled in for a Copilot Studio procurement agent. Decision, controls, residual risk, sign-off.
Threat modeling an MCP server — the parts AppSec tools miss
MCP servers have four attack surfaces: transport, tool surface, context injection, auth boundary. AppSec tools model one. The full threat model.
EU AI Act Article 9 risk management — what evidence is required
Article 9 requires a risk management system for high-risk AI. Six requirements translated into evidence artifacts auditors will request.
OWASP Agentic Top 10 mapped to required controls
OWASP Agentic Top 10 threats mapped to controls, lifecycle gates, and evidence -- a working checklist for your AI Committee, not just a list.
What an AI Risk Disposition actually contains
AI Committees approve systems they can't defend later. The Decision Memo fixes this -- section by section, with real examples.
What an agentic AI audit trail must capture
Auditing an agentic system post-incident requires what the model decided and why — not just what happened. Most implementations miss the reasoning trace.
LLM red-teaming for a security review
Red-teaming an LLM is not pentesting it. Covers goal hijacking, jailbreaking, indirect injection, and exfiltration chains — with documentation guidance.
Five mistakes that make an AI security review undefensible
Five structural mistakes that make an AI security review indefensible. Found in nearly every review regardless of threat coverage.
The security terms an AI vendor contract needs
Standard contracts miss AI-specific terms: model-change notice, training restrictions, incident notification, re-assessment rights. The clause language.
Preparing for an ISO 42001 internal audit
What an ISO 42001 internal audit must cover, what evidence auditors want, and the gaps that appear most in first-time preparations.
MCP Server Security Review Checklist (2025)
Structured checklist for MCP server review: transport, authentication, tool manifest, context injection surface, dependencies, and evidence requirements.
Context-window risks in RAG and how to bound them
The context window is where queries and retrieved documents meet the model. Anything inside influences outputs. How to bound what gets in.
Free resources
Practical templates for every framework covered here.
AI Security Review Template
Full evidence pack with threat model, controls, and evidence grading.
OWASP Agentic Top 10 Controls
Each risk mapped to required controls and lifecycle gates.
Decision Memo
Clearance decision template with rationale and sign-off log.
AI Go-Live Security Checklist
Production gate checklist for security architects and CISOs.