AI security controls deployment
We deploy vendor AI security solutions that make the use of AI services visible and controllable, and filter out malicious instructions.
When you need it
When AI is already part of daily work
Employees often start using AI tools before the organization has any rules for them. These situations signal that technical controls are needed.
Shadow AI
A department subscribes to an AI tool with its own credit card, uploads its own data, and nobody else knows about it. This is the new form of shadow IT.
Sensitive data in a public service
When an employee pastes a draft contract or client data into a public AI service, that data leaves the organization. Under the GDPR this counts as a data transfer, and trade secret protection may be lost as well.
Malicious instructions in the input
A language model cannot reliably tell instructions apart from data, so it may also carry out a malicious instruction that arrives in the user's input. If the AI agent can send emails or read files, this opens a direct path to data exfiltration.
Rollout
From rules to reporting
The rules come first, because both the deployment and the reporting are built on them.
-
Setting the rules
Together with the client, we define which AI services are allowed in the organization and which are prohibited.
-
Deployment and configuration
We deploy the vendor AI security solution and configure the agreed rules on it.
-
Logging and reporting
The solution logs the use of AI services. The report shows which services are being used in the organization.
-
Handover
We document the rules and settings and hand them over. Operation after the rollout is available under a separate agreement.
Deliverables
What you get at the end
items handed over
- Rules for allowed and prohibited AI services
- Deployment and configuration
- Logging and reporting on AI use
- Handover documentation
Related services
What comes before and alongside the controls
To set the rules, you need to know what employees use today.
Shadow AI assessment with an AI usage policy
We find out which AI tools employees use and with what data. The results feed into a recommendation for the technical controls you need.
GenAI data loss prevention
Stops sensitive data from ending up in AI tools, specifically in the traffic going to AI services.
Security review of LLM and AI agent infrastructure
A review of in-house or adopted language models, AI agents, and RAG systems based on the OWASP LLM Top 10.
Security and AI usage training
Live training tailored to your company on what may and may not be entered into an AI tool, combined with classic security awareness in one program.
Frequently asked questions
The questions we hear most
Do the controls filter out every prompt injection?
No. Even filtering cannot fully eliminate prompt injection, so protection has to focus on limiting the impact. When you design your own AI system, this means strictly separating input from instructions, keeping the tools the model can call to a minimum, checking output before it is executed, and requiring human approval for risky operations. Our security review of LLM and AI agent infrastructure checks this. For details, see our article Security risks of enterprise AI adoption.
Is it enough to block public AI services?
A ban on its own does not work, because employees find ways around it. Give them a usable alternative instead, such as an enterprise subscription with a data processing agreement or a locally hosted model. Employees also need to know clearly what they may enter and where.
How do we find out which AI services employees are using right now?
A first picture can be pulled from proxy or firewall logs: which AI services are reached from the organization, and in what volume. In our experience, the result almost always comes as a surprise. We wrote about this in our article Shadow AI: when employees use AI without approval.
