AI Security tracks Security in the Era of AI. Browse the hub for AI acceptable use policy, aimed at CTOs and delivery teams putting AI into real work.
AI governance
Every date in the Act reads like a filing deadline. Read it instead as a capability that has to be live inside your operating model by then, owned by a named role. Same calendar, different seat.
AI Security
Agent security debates fixate on attacks reaching the agent. The question that comes first: what is the agent allowed to do, and through whose identity? That standing authority is owned by no one and revisited approximately never.
AI governance
You funded the AI rollout. Per-developer output climbed, the demos got faster, and then the delivery numbers refused to move. The slowdown most teams blame on governance is usually the wrong governance, or its absence. Here is the version of the argument that holds up.
Role Playbooks
A background agent opened a PR at 2 a.m. and the gate let it through, because the gate was built for a worker who could be reasoned with. The DevOps job is no longer writing infrastructure. It is owning the bounded environment agents act inside.
AI Security
Connecting an MCP server is not enabling a feature. It is taking on a code dependency that holds execution and data rights nobody reviewed. You already govern packages and APIs as a supply chain. Your MCP fleet is the same risk under a new name.
AI Security
For two years teams filed prompt injection under "someone else's problem." That filing expired. The moment an agent reads content it did not author, every author of that content can rewrite its instructions.
AI Security
Three lines of hidden text in a README can exfiltrate your AWS credentials while Claude finishes your task. That is not a thought experiment. It is a documented production attack vector.
AI Security
You blocked ChatGPT on the corporate network and added an acceptable-use policy. The incident log did not change, because shadow AI is not a discipline problem. It is a workflow problem: people take the faster path you did not give them.
AI governance
Every AI failure I have investigated had a human who pushed the button. Automation is a delivery mechanism, not a transfer of responsibility.
AI Security
Most AI rollouts ship the tool before the policy. By Q3 the org has the habits the policy was meant to prevent. Ship policy first - in days, not quarters.