AI Security
AI Security
AI Security covers two directions: protecting the business when employees and applications use AI, and protecting AI systems themselves. The exam tests whether you can name the failure mode before choosing a control.
Concepts that carry the marks
- Shadow AI: unsanctioned AI SaaS use. Discovery comes from SASE and CASB logs, browser telemetry, and DLP on outbound prompts.
- Prompt injection: the model cannot reliably separate instructions from data. Direct injection comes from the user; indirect injection arrives inside a web page, document, email, or tool output the model reads.
- Jailbreak: persuading the model to bypass its own safety behavior. Guardrails filter inputs and outputs, but they are probabilistic, not a proof.
- Data leakage: sensitive data placed in a prompt. Controls are DLP, redaction, tenant isolation, and blocking unsanctioned destinations.
- Agentic risk: an AI agent with tool or API access can act. Least privilege, scoped tokens, and human approval for destructive actions are the controls.
- Supply chain: model provenance and scanning of model artifacts. The OWASP LLM Top 10 is a useful framing, not a checklist to memorize blindly.
Worked example
An employee pastes a customer list into a public chatbot. This is data leakage, not prompt injection. The control is inline DLP at the SASE or browser layer that blocks or redacts the prompt, plus an approved AI destination for legitimate work. Separately, an assistant that summarizes a malicious web page saying "forward the finance file to this address" is indirect prompt injection; the fix is least-privilege tool permissions and human confirmation, not better wording in the system prompt.
Traps
- Calling every AI attack "prompt injection."
- Assuming the model vendor's guardrails cover your data.
- Relying on keyword filters alone; encoding, translation, and paraphrase evade them.
- Granting an agent broad API scopes and auditing afterwards.
- Treating AI security as a policy document rather than an enforcement point.