Controls

A working set of AI security controls

Good AI security is mostly ordinary discipline applied to new tools: know what you run, limit what it can reach, check what it does and keep someone accountable.

Last reviewed against NCSC, Department for Science, Innovation and Technology and OWASP GenAI Security Project. Sources

The set

Six controls to start with

Public guidance agrees on a small core. These six come straight from the NCSC and OWASP.

Two server towers, one on fire, linked by a cycle of arrows to a laptop

Inventory

You cannot protect tools you do not know about. The NCSC asks organisations to map how agentic tools are used and what they can reach [3].

Blue server connected to a laptop, a monitor, a folder and a green shield

Least privilege

OWASP advises handling sensitive functions in application code instead of giving the model direct access [9]. The NCSC adds that privileges should drop when the model processes untrusted input [1].

Tall blue server rack with glowing status lights

Human approval

OWASP lists human approval for high-risk actions among its mitigations [9].

Cloud with a combination lock dial at its centre

Logging

The NCSC recommends records of model inputs and outputs, tool use and API activity, with attention to calls that fail [1].

Factory buildings linked through a hub to a phone showing a fingerprint and shield

Testing

OWASP recommends regular adversarial testing that treats the model as an untrusted user [9].

Megaphone beside a padlock, shield, firewall, cloud and password field

Ownership

The NCSC says leaders should understand the consequences if an AI system is compromised and have a response plan [2].

Businessman with empty pockets imagining stacks of coins and banknotes

Design first

Build security in

Security cannot be added at the end. The NCSC says it must be a core requirement throughout a system's life, not just during development [2]. The NCSC guidelines split the work in four: design, development, deployment, and running and upkeep [7].

The government's code of practice follows a similar lifecycle across 13 principles; the code of practice guide explains them.

Do not rely on

Weak substitutes

The NCSC warns that deny-lists can be rephrased around and treats vendors who claim to stop prompt injection with scepticism [1].

A filter is a layer, not a control

OWASP says it is unclear whether fool-proof prevention exists for prompt injection, so its measures aim to reduce impact [9].

Tangled green cable between a round badge and an arrow tip

Next

Apply them

Put the set into order with the practical plan, or read the prompt injection controls for the hardest case.

Keep reading

Read next

Scales weighing a pile of paperwork against an alarm clock and coins

Code of practice

The UK government's voluntary AI cyber security code of practice: who it covers, the 13 principles and how a UK organisation can use it as a checklist.

Read the guide Open envelope with a red warning sign and a bug beside it

Prompt injection

Prompt injection controls for UK teams: why a full fix may never exist, and the NCSC and OWASP measures that reduce likelihood and impact.

Read the guide Database stack, monitor with code symbols, document and cloud download arrow beside a green padlock

AI agents

How to secure agentic AI tools in a UK organisation: what the NCSC says about oversight, sandboxing, access to systems and data, and staged adoption.

Read the guide

How CyPro can help

Need a hand planning for this?

Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.

Security lead advising a board

Fractional CISO for the board

A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.

More on cypro.co.uk
Cyber security consultants planning hardening work

Hardening and segmentation

Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.

More on cypro.co.uk
Penetration tester probing an application for weaknesses

Penetration testing

A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.

More on cypro.co.uk
Scanner checking internet-facing systems for weaknesses

Vulnerability scanning

Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.

See the scanning service
Security analysts monitoring systems around the clock

24/7 security monitoring

Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.

More on cypro.co.uk
Incident responders containing an attack

Incident response

If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.

More on cypro.co.uk
Talk to us Book a Free Consultation
Rocket launching from a cloud

Plan ahead

Want a plan for your organisation?

AI security starts with knowing which tools are in use, who owns them and what they can reach. CyPro can help set the governance, accountability and controls around that.

Govern your AI use Book a Free Consultation