AI security as part of strategy, not an afterthought

The short answer

An AI strategy that does not answer security questions is incomplete, because AI systems introduce a genuinely new attack surface. Models follow instructions, and they cannot reliably tell your instructions from instructions hidden inside the content they read: a document, an email, a web page, a customer message, a product review. That is prompt injection, and there is no complete technical fix for it. What determines the damage is not the model’s sophistication but two decisions you make: what the system is allowed to reach, and what it is allowed to do without a person. A model that reads your documents and produces text for a human to review is low risk. The same model with write access to your CRM, your email and your payment system, acting autonomously on content from the outside world, is a serious one. The controls are therefore architectural: least privilege, human approval for consequential actions, validation of outputs before they are used, separation between systems that read untrusted content and systems that can write, and logging that makes unusual behaviour visible. These belong in the strategy, before the first project.

The AI-specific risks

Risk	What it means	Control
Prompt injection	Instructions hidden in content the model reads override your intent	Least privilege; human approval; treat retrieved content as untrusted; separate read and write systems
Excessive agency	The system can take consequential actions alone	Define what may be done without approval; keep spending, sending and deleting behind a person
Sensitive data disclosure	The model reveals data from its context to the wrong user	Filter what goes into context by the asking user’s permissions; never put secrets in prompts
Improper output handling	The system’s output is used without validation, as code, a query or a command	Validate and escape outputs before any downstream use
Supply chain	A compromised model, library, plugin or connector	Known providers; pinned versions; review connectors as you would dependencies
Data poisoning	Attacker content enters your knowledge base and shapes answers	Control what enters the index; review sources; monitor answer quality
Model denial of wallet	An attacker drives usage to exhaust limits or run up spend	Rate limits, per-user caps, spending caps, bot protection on public features
Shadow AI	Staff connect tools to company systems without review	Approved-tools list; access review; monitoring of connected applications

Putting it in the strategy

What this changes about buying

When a vendor demonstrates an agent that handles a process end to end, the security questions are specific: what systems can it reach, with which permissions, what can it do without a person, what happens if it processes hostile content, how is it logged, and how do we switch it off. Vendors with good answers give them immediately. Vendors who describe the model’s capabilities instead have not thought about it, and the risk transfers to you.

What this means for you

Put AI security in the strategy as two questions answered for every system: what can it reach, and what can it do alone. Keep access minimal, put consequential actions behind human approval, validate outputs, separate untrusted-content readers from write access, cap and log everything, and review connected tools quarterly. Prompt injection cannot be filtered away, but its consequences can be designed away.