Your new attack surface speaks English.
Every LLM you deploy is a new kind of attack surface: one that can be manipulated with words, exfiltrate data through answers, and take actions on systems if you've given it tools. Prompt injection, data leakage, and over-permissioned agents aren't theoretical — they're the standard findings. I secure AI deployments the way they actually get attacked: defense in the architecture, red-teaming before launch, and controls your CISO can sign.
Traditional security assumed the attacker writes code. LLM systems changed that: now a hostile instruction can arrive inside a résumé, a support ticket, a webpage your agent browses, or a document your RAG system retrieves — and the model, doing exactly its job, follows it. That's indirect prompt injection, and it remains an unsolved problem you architect around rather than patch away.
Effective AI security is layered, and most of the layers aren't about the model. Scope what the system can access, cap what it can do, sanitize what it reads, validate what it outputs, and log everything with enough fidelity to reconstruct an incident. Then attack it — systematically, before launch, with the same techniques real adversaries use — and keep attacking it on a schedule, because your system and the attack literature both keep changing.
The standard findings
- Injection paths — untrusted content flowing into prompts unsanitized: documents, emails, web pages, and user fields nobody threat-modeled.
- Data leakage — retrieval that ignores permissions, answers that reveal other tenants' data, and logs that store what policy says you don't keep.
- Over-permissioned agents — tools granted with admin keys "for the demo" that never got scoped down for production.
The model will always be persuadable — it's a language model. Security lives in what you let it see, do, and send.
Defense in depth, AI edition.
Questions, answered.
What is prompt injection and why should executives care?
It is the technique of hiding instructions in content an AI system reads — a document, an email, a webpage — so the system follows the attacker instead of you. If your AI can read untrusted content and touch company data or tools, injection is your problem. It is the SQL injection of this era, except there is no complete patch — only architecture.
Can prompt injection be fully prevented?
No, and anyone who says otherwise is selling something. It can be made expensive and contained: sanitize inputs, scope permissions so a hijacked model cannot do much, validate outputs, and monitor for anomalies. The goal is that a successful injection yields an incident report, not a breach.
What does an AI red-team engagement look like?
One to three weeks against your staging system: injection attempts through every content path, jailbreak and exfiltration testing, tool-abuse scenarios, and multi-tenant isolation checks. You get a findings report ranked by severity with concrete fixes — and a retest after remediation.
How does AI security map to SOC 2 and our existing compliance?
Cleanly, if designed in: AI-specific controls slot into your existing framework — access control, logging, change management, vendor risk — extended with model-specific items like injection testing and output filtering. I document the mapping so your auditors see a control set, not a novelty.
Red-team it before reality does.
If your AI system shipped without adversarial testing, it's being tested right now — you're just not the one reading the results. Let's fix that.