AI Security
The AI Security domain tests whether you can let people use generative AI and internal models without losing control of data, and whether you can defend AI systems themselves. Expect questions on discovering unsanctioned AI apps, inline guardrails, prompt and response inspection, model and dataset supply-chain risk, and agentic features that can take actions.
Core rules
- Treat AI as a data-flow problem first: who sends what prompt, to which model, with what data classification, and what comes back.
- Use OWASP LLM risk vocabulary: prompt injection, sensitive information disclosure, supply chain, excessive agency, and unbounded consumption.
- Direct prompt injection arrives in user input; indirect injection arrives through retrieved documents, web pages, tool output, or attachments. Both paths need inspection.
- Guardrails cover the request and the response: block secrets and regulated data outbound, and block malicious links, code, or instructions returning to the user.
- Agentic AI adds tools and permissions. Scope tokens and tools to least privilege and require approval for write actions.
Worked example
A marketing user pastes a customer list into a consumer chatbot. The correct chain is: AI/CASB discovery marks the app unsanctioned; an inline policy blocks the file upload by data pattern and app category; a DLP profile flags customer identifiers; the response path is still inspected for injected instructions or malicious links. The reasoning is that blocking only the prompt leaves the return channel and the sanctioned-app path unprotected.
Traps
Assuming AI traffic is invisible because it is TLS; decryption and app identification still apply. Confusing model scanning, which addresses supply chain, with runtime prompt protection. Treating prompt injection as user-input only. Forgetting that a sanctioned AI app can leak data through its own connectors and sharing features.