The plan
A practical plan for securing AI use
Start with an inventory, cut access, add human checks and logging, then set ownership. These controls hold even when a weakness such as prompt injection cannot be fully fixed.
Last reviewed against NCSC, Department for Science, Innovation and Technology and OWASP GenAI Security Project. Sources
This quarter
The core controls
Work through these in order:
-
1
Make the inventory first, because every other control depends on it [3]. -
2
Reduce each tool's access to the data and actions it needs [9]. -
3
Add a person or fixed rule in front of high-risk actions [9]. -
4
Turn on logging so you can see what tools did [1].
Cheap first, then deeper
Inventory and ownership cost little and expose the most. Technical controls take more work, so apply them first to tools that read outside content or hold sensitive data [1].
Plan ahead
Beyond this quarter
Prepare for change. The NCSC advises raising security baselines and keeping fundamentals sound, which protect against AI-assisted and other threats alike [3]. It also says to prepare for a wave of patches addressing long-standing technical debt [3].
Accept a residual risk
NCSC advice is that prompt injection stays a residual risk managed through design, build and operation, not a flaw a product removes [11].
Related reading
Go deeper
Read about AI agent security, the supplier questions and the shadow AI guide.
What to do
Seven steps, in order
-
Step 1
List every AI tool and what it can reach[3]
Record each chatbot, assistant and agent, including those staff chose themselves. For each, note the data it sees, the content it reads and the actions it can take.
Who: IT and security leads
-
Step 2
Cut each tool's privileges to the minimum[9]
Keep sensitive functions in ordinary application code rather than giving the model direct access, and lower privileges when a tool reads content you do not control.
Who: Development and security teams
-
Step 3
Put a person in front of high-risk actions[9]
Require human approval before an AI tool sends, pays, deletes or changes anything that matters, and let fixed rules, not the model, enforce limits.
Who: Product owners and system owners
-
Step 4
Log inputs, outputs and tool use[1]
Keep records of what goes into and comes out of AI tools and which tools or APIs they call. Failed calls can show someone refining an attack.
Who: Security operations
-
Step 5
Name an owner and brief the board[2]
Decide who is accountable for AI security, what the worst-case failure looks like and who responds. Take it to board level.
Who: Directors and security leads
-
Step 6
Ask suppliers hard questions[1]
Treat any supplier claiming to stop prompt injection with caution and ask instead how they reduce its likelihood and impact, and how they secure their own supply chain.
Who: Procurement and security leads
-
Step 7
Understand shadow AI before banning it[3]
Find out why staff use unapproved AI tools, then offer an approved option that meets the need, so the risk is managed rather than hidden.
Who: IT leads and department heads
Keep reading
Read next
Controls
AI security controls UK organisations can apply now: inventory, least privilege, approval, logging and ownership, from NCSC and OWASP guidance.
Read the guide
Code of practice
The UK government's voluntary AI cyber security code of practice: who it covers, the 13 principles and how a UK organisation can use it as a checklist.
Read the guide
Prompt injection
Prompt injection controls for UK teams: why a full fix may never exist, and the NCSC and OWASP measures that reduce likelihood and impact.
Read the guideHow CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
AI security starts with knowing which tools are in use, who owns them and what they can reach. CyPro can help set the governance, accountability and controls around that.