Tagged:
incident-response5 posts
-
AI Secrets Management: Protecting API Keys, System Prompts, and Model Credentials in Production
API keys for model providers have a blast radius unlike traditional credentials. System prompts encode proprietary business logic that teams rarely treat as secrets. This is a practical guide to treating AI credentials as the first-class secrets they are — with concrete patterns for storage, rotation, agent scoping, and incident response.
-
Shadow AI in the Enterprise: Detecting, Governing, and Securing Unauthorized AI Tool Use
How to detect, govern, and secure unauthorized AI tool use in the enterprise — before sensitive corporate data leaves through AI prompts.
-
AI Incident Response: A Practitioner's Playbook for When Your AI System Is Compromised
Detection signals, containment options, evidence preservation, and recovery procedures for AI-specific security incidents — the operational complement to attack coverage. NIST IR lifecycle applied to prompt injection, model backdoors, data poisoning, and adversarial input attacks.
-
AI Security and the Law: What the EU AI Act, NIST AI RMF, and ISO 42001 Actually Require of Builders
The EU AI Act creates statutory security obligations for high-risk AI systems; NIST AI RMF 1.0 and ISO/IEC 42001:2023 are becoming de facto requirements through procurement and certification. This post maps specific requirements — adversarial testing, incident reporting deadlines, robustness mandates — to the attack classes they govern and the controls that address them.
-
1,000 Breaches Later: The Disclosure Lag Is Worse Than Ever
Troy Hunt's HIBP milestone analysis shows breach disclosure times are lengthening, not shrinking — driven by class-action fear, legal posturing, and regulatory carve-outs. The same dynamics will shape how AI incidents get disclosed.