Where AI systems actually leak, get manipulated, or get bypassed — and the controls that hold up once a system is in production, not just in a demo.
Most AI security writing is either academic red-teaming research or generic cybersecurity advice with "AI" inserted. This guide sits between the two: it is written for business and operations leaders who need to know what actually breaks in a production AI system, without needing a security engineering background to act on it.
The articles in this cluster cover how data leaks out of retrieval and fine-tuned models, why the model itself has to be treated as an untrusted component once it reads third-party content, and where shadow AI usage becomes a genuine exfiltration risk rather than just a policy gap.
This is a companion to, not a replacement for, the governance guide: governance decides who is accountable when something goes wrong; security decides how few things go wrong in the first place.
How is AI security different from conventional application security?
AI systems accept untrusted natural-language input as instructions, not just data, and that input can come from documents, emails, or scraped pages an agent reads. Prompt injection, retrieval poisoning, and model inversion have no equivalent in traditional threat models, so the controls have to be built new, not inherited.
Where does data actually leak out of an AI system?
Two separate mechanisms: retrieval leaks by serving the wrong document to the wrong person, and fine-tuning leaks by memorising facts directly into the model's weights, where they cannot be selectively deleted afterward. Each needs a different fix, and access control has to move from the document to the query.
What does "treat the model as untrusted" mean in practice?
Every tool result, retrieved document, or scraped page an agent processes is capable of carrying instructions. The model should never be the trust boundary. Structural separation of instructions from data, egress allowlisting, and least-privilege scopes on every tool call are what actually hold up in production.
Is shadow AI a security problem or a policy problem?
Both, but treating it as only a policy problem fails. Employees already send confidential data to consumer AI tools with no contract, no audit trail, and no control over what happens to it next. Banning it removes visibility, not the behaviour. The fix is a governed alternative that is more capable than what it replaces.
94% of security leaders say AI is the biggest driver of change in cybersecurity this year, and it is reshaping both sides of the fight at once. What the 2026 data actually shows, what defenders can deploy today, and the skills gap standing between here and a defensible position.
Read article →
17,600 recorded actions, a self-respawning fleet across eleven Kubernetes nodes, and zero human operators. OpenAI and Hugging Face's own technical disclosures reconstruct the July 2026 incident in detail. Here's the evidence, and the concrete controls that would have stopped it.
Read article →
Human-in-the-loop assumes someone sees the bad action in time. The 2026 evidence, including Anthropic's own research, says that assumption fails. What containment looks like when detection isn't the plan.
Read article →
Not the sci-fi fear. The mundane one: an agent that trusts the wrong instruction, a credential nobody's watching, a tool description that lies to the model reading it. Four real 2025 incidents, and what the security model has to look like once an agent gets write access.
Read article →
Fixing fragmented data is only half the job. Once that data is combined and fine-tuned into a model, the access controls that used to protect it disappear. Here's how to put them back.
Read article →
More than 90% of employees are already using personal AI tools for work tasks. The governance risk is not the AI. It is your data leaving your systems without any controls in place.
Read article →
Most organisations have experimented with retrieval‑augmented generation (RAG), but very few have a production‑grade RAG that can withstand regulatory...
Read article →The AI Trust, Risk & Governance Dashboard and the Fine-Tune vs. Retrieval-Only Classifier both surface the access-control and data-exposure questions most teams only ask after something has already leaked.
Shadow AI keeps me up more than the exotic threats do, because it's not a hypothetical, it's a colleague pasting a client contract into a free chatbot on their lunch break because the sanctioned tool is slower. Banning it never once made that behaviour stop, it just made it invisible to the people responsible for the fallout. The fix isn't a stricter policy, it's a governed tool people actually prefer using. Build the thing people want to use instead of the workaround.
