AI security: the roadmap
AI governance you can't measure is just an intention. This guide brings our Thursday series into one document: seven steps, their evidence, their indicators and the page to bring to the board.
The seven steps in the guide
- 1
Inventory the uses
A register of every AI system and tool, including those adopted without approval.
- 2
Name who answers
One owner per use, a person rather than a department, and a body that arbitrates.
- 3
Treat model-specific risks
Prompt injection, data leakage, unchecked outputs: starting with the systems that touch sensitive data.
- 4
Assess your vendors' AI
Know which vendors use AI on your data, and with what contractual guarantees.
- 5
Resist offensive AI
Out-of-band verification for any payment, change of bank details or urgent request from an executive.
- 6
Choose your framework
The NIST AI RMF to do the work, ISO 42001 the day someone demands proof.
- 7
Keep agents in check
Own identity, least privilege, human approval for anything irreversible, logs and a kill switch.
The guide as a PDF
The roadmap to print and share in committee, with links to each episode of the series.
In the guide
- The seven steps, each with its action, evidence and indicator.
- The indicators to keep, the ones to drop, and the three measurement traps.
- The quarterly board page, in four blocks to fill in.
- A one-page checklist and the three-question test.
8 pages · PDF
30 minutes to know what to fix first.
A member of our team walks you through FortaRisks on threats relevant to your sector, and you leave with your priorities.