Guides
Every guide to AI security controls
Start with the main guides, then go deeper on the parts that apply to you.
Last reviewed against NCSC, Department for Science, Innovation and Technology and OWASP GenAI Security Project. Sources
Start here
The main guides
Risks
The AI security risks UK organisations face, from prompt injection to data exposure and over-broad access, with NCSC and OWASP evidence.
Read the guide
Plan
A practical AI security plan for UK organisations: inventory, least privilege, human approval, logging and ownership, drawn from NCSC advice.
Read the guide
Questions
Sourced answers on AI security: what it is, whether prompt injection can be fixed, shadow AI, the UK code of practice and what to do first.
Read the guide
About this site
Who publishes AI Security Controls, why CyPro Consulting Ltd created it and how its account of AI security guidance is kept accurate and sourced.
Read the guideIn depth
Your product or situation
Controls
AI security controls UK organisations can apply now: inventory, least privilege, approval, logging and ownership, from NCSC and OWASP guidance.
Read the guide
Code of practice
The UK government's voluntary AI cyber security code of practice: who it covers, the 13 principles and how a UK organisation can use it as a checklist.
Read the guide
Prompt injection
Prompt injection controls for UK teams: why a full fix may never exist, and the NCSC and OWASP measures that reduce likelihood and impact.
Read the guide
AI agents
How to secure agentic AI tools in a UK organisation: what the NCSC says about oversight, sandboxing, access to systems and data, and staged adoption.
Read the guide
Shadow AI
What shadow AI is and how UK organisations can manage it: the NCSC's advice to understand why staff use unapproved AI tools, with practical steps.
Read the guide
AI for defence
How UK organisations can use AI in cyber defence safely: what the NCSC says suppliers already do, and the checks needed before trusting the output.
Read the guide
Suppliers
Security questions UK buyers should put to AI suppliers: prompt injection claims, supply chain, data handling, access and logging, based on NCSC advice.
Read the guide
OWASP list
The OWASP Top 10 for LLM applications 2025: all ten risks listed, which matter most for UK organisations, and how to use the list in a review.
Read the guide
How CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
AI security starts with knowing which tools are in use, who owns them and what they can reach. CyPro can help set the governance, accountability and controls around that.