The thinking behind AI security review.
Threat models, governance evidence, and the decisions that hold up under scrutiny. Written for security architects and the committees they report to.
New posts in your inbox,
when they publish.
Threat modeling, governance evidence, and what AI Committees actually need — written for security architects and AI governance leads. No cadence promises.
EU AI Act obligations for deployers (not just providers)
Deployers -- not just providers -- carry significant EU AI Act obligations. What organizations using AI systems for their own purposes must do.
Vector Database Security — RAG Pipeline Checklist
Vector databases inherit standard data-store security requirements plus RAG-specific ones. The full security checklist for production pipelines.
Human-in-the-loop boundaries that actually hold
HITL is the most common agentic control and the most often specified in ways that don't hold. What a robust boundary requires — and the failure modes.
Model denial of service and cost-exhaustion attacks
LLM DoS doesn't require crashing the service — just making it expensive. Cost-exhaustion attacks are under-defended in most assessed AI systems.
Who runs the AI security review — roles and hand-offs
AI security reviews span architects, security engineers, governance leads, and DPOs. Map the hand-offs to avoid dropped gates.
The anatomy of an AI evidence pack
The complete artifact set a governance committee needs for a defensible AI decision. What goes in, and why order and labeling matter.
Why SOC 2 is not AI assurance
SOC 2 covers infrastructure and process. It says nothing about model behavior, training data, or edge cases. AI assurance needs different evidence.
Building an AI management system (AIMS) from scratch
An AI management system is governance infrastructure: policies, procedures, roles, records for defensible AI decisions at scale. How to build one.
Vetting third-party MCP servers before you connect them
Every third-party MCP server extends your agent's attack surface. The vetting process: source review, manifest audit, permission scope, and evidence.
RAG PII Leakage — 3 Retrieval Paths That Expose Data
RAG over internal corpora frequently exposes personal data never intended to be queryable. The most common data-protection finding in RAG security reviews.
EU AI Act vs GDPR — where they overlap for AI systems
GDPR and the EU AI Act overlap heavily for AI processing personal data. Where obligations are additive, and which review artifacts satisfy both.
Security review for multi-agent systems
When agents orchestrate agents, single-agent trust assumptions multiply. Covers inter-agent trust, capability delegation, and blast-radius containment.
Free resources
Practical templates for every framework covered here.
AI Security Review Template
Full evidence pack with threat model, controls, and evidence grading.
OWASP Agentic Top 10 Controls
Each risk mapped to required controls and lifecycle gates.
Decision Memo
Clearance decision template with rationale and sign-off log.
AI Go-Live Security Checklist
Production gate checklist for security architects and CISOs.