Blog

The thinking behind AI security review.

Threat models, governance evidence, and the decisions that hold up under scrutiny. Written for security architects and the committees they report to.

Newsletter

New posts in your inbox,
when they publish.

Threat modeling, governance evidence, and what AI Committees actually need — written for security architects and AI governance leads. No cadence promises.

No spam. Unsubscribe anytime.

Reference11 min

AI risk assessment under ISO 42001

ISO 42001 requires a documented AI risk assessment as the foundation of the AI management system. This piece defines what that assessment must cover, how it differs from a generic IT risk assessment, and what a complete record looks like.

Regulation10 min

AI subprocessor risk in your vendor chain

When a vendor's AI feature is powered by a third-party model provider, the model provider is an AI subprocessor. The data that passes through the model may be subject to additional retention, training, or transfer rules that the original DPA did not contemplate.

Technical9 min

Transport security for MCP servers

MCP runs over HTTP (SSE) or stdio. Both transports have distinct security requirements. This piece covers TLS, mutual authentication, and the review questions for MCP server transport configuration.

Technical12 min

Indirect prompt injection through retrieved documents

When retrieved documents contain instructions the model executes, the attack surface is anything that ends up in the knowledge base. Indirect prompt injection via documents is harder to detect than direct injection because the attacker is not in the conversation.

Technical11 min

Agent memory as an attack surface

Agents that persist memory across sessions carry forward context that can be poisoned. An attacker who controls a past interaction can plant instructions that execute in a future session. This piece maps the memory attack surface and the controls that bound it.

Regulation12 min

The technical documentation the EU AI Act expects

The EU AI Act requires technical documentation before a high-risk AI system is placed on the market. This piece breaks down what Annex IV requires, what it means in practice, and the gaps that appear most often in documentation we have reviewed.

Technical11 min

Sensitive information disclosure in LLM applications

LLM applications disclose sensitive information through three distinct channels: training data memorisation, system prompt leakage, and retrieval boundary failures. Each has different controls and different evidence requirements.

Foundations10 min

AI security review vs penetration testing — different questions

A penetration test asks: can this system be exploited? An AI security review asks: should this system go to production, and under what conditions? The questions are related but not the same. Running only a pentest leaves most AI risk unaddressed.

Regulation11 min

Running a DPIA for an AI system

A Data Protection Impact Assessment for an AI system has requirements that standard DPIA templates do not address: model training data, inference data flows, automated decision-making obligations, and re-assessment triggers. This piece fills the gaps.

Governance10 min

Conditional approval for AI systems — making conditions stick

Conditional approval is the most common disposition for AI systems that are not ready for unrestricted production. The conditions are the whole point — and most conditional approvals are written in a way that makes the conditions unenforceable.

Governance9 min

Model-change notification — the vendor clause procurement teams forget

Vendors change the underlying model in their AI products without notifying customers. The security review that justified the original deployment may no longer be valid. This piece defines the contractual clause and the review trigger that keeps the assessment current.

Technical10 min

The MCP authentication boundary, reviewed

MCP servers authenticate the client (the agent) not the end user. When a user-facing agent invokes an MCP server, the server has no way to enforce per-user authorisation unless authentication is layered in explicitly. This piece maps the gap and the controls.