AI security is an active and rapidly evolving field. This paper describes an enterprise risk model and should not be interpreted as a certification standard, security guarantee, or replacement for a formal threat assessment.
Artificial intelligence is moving deeper into the enterprise stack. Models are connected to proprietary data. Retrieval systems surface internal knowledge. AI assistants interact with productivity applications. Agents can invoke APIs and automation tools. Model outputs increasingly influence operational decisions.
As this happens, cybersecurity teams need to expand the security boundary. The model is only one component of the system. The surrounding identity, data, tools, orchestration, infrastructure, integrations, and business processes determine much of the actual risk.
The AI attack surface is a system attack surface
Many AI risks map to familiar cybersecurity objectives: confidentiality, integrity, availability, authentication, authorization, resilience, monitoring, and incident response. What changes is the way these objectives interact with probabilistic models and natural-language interfaces.
An attacker may not need to exploit a traditional software vulnerability if they can manipulate the instructions or context that influence an AI workflow. A compromised data source may alter model behavior. A leaked credential may give an agent access to sensitive systems. An overly permissive tool connector may turn an otherwise low-risk model error into a high-impact business action.
NIST describes security and resilience as characteristics of trustworthy AI and notes that many AI cybersecurity risks overlap with the security of underlying software, hardware, training data, and output data. That framing is important: AI security should extend existing security disciplines rather than sit outside them.
Seven control domains for enterprise AI security
1. Identity and privileged access
Production AI systems and agents should have explicit identities. Service accounts, API keys, tokens, and delegated credentials should be scoped, rotated, monitored, and revocable. High-impact tools should not inherit broad user permissions by default.
2. Data security
Enterprises need to understand what information enters prompts, retrieval indexes, fine-tuning pipelines, logs, memory stores, and external model services. Data classification and access controls should follow the information across the AI lifecycle.
3. Model and supply-chain assurance
Models, libraries, containers, plugins, connectors, and external APIs create supply-chain dependencies. Organizations should maintain provenance and inventories, assess third-party risk, manage versions, and establish controlled promotion into production.
4. Tool and API mediation
Agentic systems should not receive unrestricted access to enterprise APIs. A mediation layer can validate inputs, constrain operations, enforce schemas, apply policy, rate-limit actions, and generate evidence.
5. Prompt and context resilience
Natural-language instructions can contain untrusted content. Systems should distinguish trusted policy and system instructions from external content, isolate high-risk inputs, minimize unnecessary tool exposure, and use layered controls so one manipulated instruction cannot directly cause a sensitive action.
6. Monitoring and detection
Traditional infrastructure telemetry remains essential, but AI workflows also require application-level evidence: model calls, retrieval sources, tool invocations, policy decisions, errors, abnormal sequences, and high-risk outcomes. Detection logic should focus on behavior and consequence rather than attempting to judge every model output in isolation.
7. Incident response and recovery
Organizations need procedures for compromised models, credentials, data sources, agents, or tool integrations. Response capabilities can include revoking agent identities, disabling connectors, rotating keys, quarantining retrieval sources, reverting model versions, preserving evidence, and moving critical workflows to manual operation.
Governance and cybersecurity converge around AI
AI governance and cybersecurity are often organized separately, but production AI makes their boundaries increasingly porous. A governance policy that says an agent must not access certain information is only meaningful if technical authorization enforces it. A security control that blocks access is more valuable when it is connected to business ownership, risk classification, and documented approval.
NIST Cybersecurity Framework 2.0 emphasizes cybersecurity risk governance alongside identification, protection, detection, response, and recovery. AI programs can use that enterprise-risk perspective while adding AI-specific evaluation, evidence, and oversight.
A security posture for agentic systems
For high-value agentic workflows, organizations should assume that model behavior can be wrong, ambiguous, or influenced by untrusted context. The security architecture should therefore limit the consequences of any single failure.
That means using explicit identity, least privilege, policy enforcement, constrained tools, transaction limits, approval thresholds, segmentation, monitoring, and rapid revocation. The goal is not to make an AI model infallible. The goal is to make the enterprise system resilient when the model is not.
Research view
The next generation of AI cybersecurity will be defined less by a single category of “AI attacks” and more by how existing security principles are applied to autonomous software actors. The strongest enterprise architectures will secure the complete path from identity and context to tool invocation and business action.
Selected references
- NIST — Cybersecurity Framework 2.0
- NIST — AI Research: Security and Resilience
- NIST — Generative AI Profile for the AI RMF
Research notice
New York AI Group® research is provided for general informational purposes and does not constitute legal, regulatory, cybersecurity, investment, or other professional advice.