Know what is in use
Identify AI services, connected apps, the people using them, and the data they can access. Offer an approved route for common tasks.
+ THE AI SECURITY FRAMEWORK
From awareness
to action.
AI is changing the work.
Security needs to cover the whole organization.
A practical map for leaders: five areas to protect, the capabilities that help, and the evidence to ask for.
Find your starting pointFOR ENTERPRISES & GOVERNMENTS · NO TECHNICAL BACKGROUND NEEDEDStart a leadership conversation ↓
THE ORGANIZATION AT A GLANCE Save the map
FIVE AREAS. ONE SHARED FOUNDATION.Where does your
Where does your
organization need a boundary?
Start with the people, systems,
and decisions you depend on.
Select an area to explore it.
Know what you have. Name an owner. Set the rules. Keep evidence that they work.
Protect your own AI. Strengthen defenses against AI-enabled attackers.A map of responsibilities, not a maturity score.
AREA 01 / The AI people use
Open the full guide Make safe use easier.
Sensitive information can leave through an unapproved tool. A convincing message can trick someone into handing over access.
Protect the moment of sharing
Warn or block sensitive transfers where policy requires it. Check app permissions and detect suspicious messages and account activity.
Verify consequential requests
Confirm payment, account-change, or sensitive-data requests through a separate trusted channel. Do not share passwords or sign-in codes. Give people a simple way to report concerns.
ASK TO SEE THE EVIDENCE
Show one sensitive-data test from warning to resolution, and list the apps and devices that are outside coverage.
WHO SHOULD OWN THIS?
Workplace IT + security + privacy
WHAT TO KEEP IN MINDDiscovery can miss personal accounts or unmanaged devices. Polished text alone does not prove AI involvement; blocking prompts cannot eliminate deception.
What are these technologies called?
Names you may encounter in a buying conversation. Products often span several areas.
- AI usage discovery
- Find which AI services and connected apps people use.
- Data loss prevention
- Detect or restrict sharing of specified sensitive information.
- Email and messaging security
- Identify suspicious messages and attempts to impersonate trusted people.
- Identity protection
- Detect suspicious account access and reduce account takeover risk.
GUIDANCE BEHIND THESE CONTROLSAI Risk Management Framework 1.0: Core ↗The NIST Cybersecurity Framework 2.0 ↗Business Email Compromise ↗Protect verification codes from impersonation scams ↗
Choose another area ↑AREA 02 / The AI that takes action
Open the full guide Put boundaries around action.
An agent can mistake a hostile document for an instruction and use its permitted tools in a harmful way. Excessive access can make the damage worse.
Name the owner and the job
Record each agent, its purpose, identity, tools, data access, and accountable owner. Include agents supplied by vendors.
Enforce limits outside the model
Restrict tools, destinations, credentials, and permissions to the task. Treat instructions found in documents or websites as untrusted input.
Check and stop real actions
Require approval for high-impact actions. Record tool calls and outcomes. Test whether revoking access actually stops a running agent.
ASK TO SEE THE EVIDENCE
Test attempts to reach an unapproved system, show the enforced block, and explain the test’s limits. Demonstrate how you revoke the agent’s access.
WHO SHOULD OWN THIS?
AI platform + application owners + security
WHAT TO KEEP IN MINDA prompt filter or a written rule is not an access boundary. These controls apply to agents you operate or procure; they do not govern an attacker’s agents.
What are these technologies called?
Names you may encounter in a buying conversation. Products often span several areas.
- Agent inventory
- A record of agents, their owners, purposes, tools, and permissions.
- Identity and access controls
- Decide who or what may reach a resource, and what actions are allowed.
- Tool authorization
- Check an agent’s permission before a tool performs an action.
- Agent activity monitoring
- Record and inspect what agents ask their tools to do and what happens.
GUIDANCE BEHIND THESE CONTROLSLLM06:2025 Excessive Agency ↗OWASP Top 10 for Agentic Applications 2026 ↗Guidelines for Secure AI System Development ↗
Choose another area ↑AREA 03 / The systems AI can reach
Open the full guide Limit access. Spot misuse.
A stolen key or an exposed service can give an intruder access to connected systems and sensitive records.
Reduce paths into the environment
Map exposed services and permissions. Remove unnecessary access, protect secrets, and separate sensitive systems.
Watch behavior across services
Connect identity, cloud, and data-access events. Investigate unusual sign-ins, privilege changes, and unexpected data movement.
Contain and recover
Be able to revoke credentials, isolate workloads, and preserve evidence. Test restoration and recovery for essential services.
ASK TO SEE THE EVIDENCE
Trace a test credential from initial use to detection and revocation. Explain which connected systems remain reachable.
WHO SHOULD OWN THIS?
Cloud platform + identity + security operations
WHAT TO KEEP IN MINDGood configuration does not catch every misuse of legitimate access. Behavior monitoring depends on available logs, reliable detection, and timely response.
What are these technologies called?
Names you may encounter in a buying conversation. Products often span several areas.
- Cloud posture management
- Check cloud settings, exposure, and permissions for risky configurations.
- Cloud detection and response
- Find suspicious activity in cloud systems and help contain it.
- Secrets management
- Protect, limit, and rotate passwords, keys, and other access credentials.
- Identity threat protection
- Connect account activity to signs of compromise or misuse.
GUIDANCE BEHIND THESE CONTROLSThe NIST Cybersecurity Framework 2.0 ↗Guidelines for Secure AI System Development ↗
Choose another area ↑AREA 04 / The code your organization runs
Open the full guide Find, fix, and verify.
A flaw in an application or a third-party component can become an entry point. A rushed fix can introduce a new problem.
Find and prioritize
Inventory software and dependencies. Combine security testing with AI-assisted review; prioritize flaws by exposure, exploitability, and business impact.
Propose and review a repair
Use AI where useful to explain findings and draft changes. An accountable reviewer checks the security reasoning and the effect on the application.
Test, release, and verify
Test that the flaw is addressed and essential behavior still works. Use an approved deployment process, a rollback plan, and checks on the running system.
01Find02Prioritize03Propose a fix04Review & test05Deploy06Verify
AI can assist across the process. A person or an approved policy authorizes the release; a rollback path protects the running service.
ASK TO SEE THE EVIDENCE
Take one real finding through a tested fix into the running application. Show the evidence that the flaw is resolved and how to roll back.
WHO SHOULD OWN THIS?
Engineering + application security + service owners
WHAT TO KEEP IN MINDAI can miss flaws, invent findings, or propose insecure repairs. No tool finds and patches every vulnerability; a suggested change is not a deployed fix.
What are these technologies called?
Names you may encounter in a buying conversation. Products often span several areas.
- Code and dependency scanning
- Check application code and third-party components for known or suspected flaws.
- AI-assisted code review
- Use AI to examine code, explain possible problems, and propose changes.
- Vulnerability prioritization
- Decide which flaws to address first based on their practical risk.
- Patch validation and deployment
- Check a repair, release it safely, and verify it is running.
GUIDANCE BEHIND THESE CONTROLSSecure Software Development Framework 1.1 ↗Guidelines for Secure AI System Development ↗
Choose another area ↑AREA 05 / The AI helping defenders
Open the full guide Turn signals into decisions.
Clues can sit across separate tools while an intrusion continues. An automated response can also disrupt legitimate work.
Bring the evidence together
Collect relevant identity, cloud, application, and agent events with timestamps. Protect log integrity and limit access to sensitive content.
Assist the investigation
Use AI to organize evidence, suggest hypotheses, and draft detections. Keep links to original events so analysts can check the conclusions.
Bound the response
Define which actions can be automated and which require approval. Test playbooks, keep action records, and rehearse containment and recovery.
ASK TO SEE THE EVIDENCE
Run a realistic exercise. Measure time to a correct decision and containment, alongside false alarms and unintended disruption.
WHO SHOULD OWN THIS?
Security operations + incident response
WHAT TO KEEP IN MINDMore data or a faster summary does not guarantee a correct conclusion. Security AI needs its own access limits, evaluation, and oversight.
What are these technologies called?
Names you may encounter in a buying conversation. Products often span several areas.
- Security data platform
- Bring security events together so defenders can search and connect them.
- AI investigation workbench
- An environment where analysts use AI to examine evidence and develop hypotheses.
- Detection engineering
- Create and test rules or models that identify suspicious behavior.
- Response orchestration
- Coordinate response tools and actions with defined approvals.
GUIDANCE BEHIND THESE CONTROLSThe NIST Cybersecurity Framework 2.0 ↗AI Risk Management Framework 1.0: Core ↗LLM06:2025 Excessive Agency ↗
Choose another area ↑CONNECT THE INCIDENT TO THE DEFENSEWhere can you
Where can you
interrupt the chain?
The useful question is what you can control. Your organization can limit its own agents—and protect its systems even when an attacker controls the AI.
Protect what the attacker can reach.
In the 2025 AI-orchestrated espionage case, attackers used AI to perform much of the tactical work. The organizations being targeted did not control that AI. Read the sourced case ↗
01 / POSSIBLE ATTACK PATH
Look for a way in
→A PLACE TO INTERVENE
SoftwareFind exposed systems and fix reachable flaws.
Explore the controls ↗02 / POSSIBLE ATTACK PATH
Use access to move further
→A PLACE TO INTERVENE
CloudLimit permissions and protect credentials.
Explore the controls ↗03 / POSSIBLE ATTACK PATH
Reach and copy sensitive data
A PLACE TO INTERVENE
Security operationsSpot unusual access and interrupt the intrusion.
Explore the controls ↗This is an illustrative control map, not a reconstruction of every step or evidence that these controls were absent. Control mapping is editorial analysis, not proof of prevention.
Check permission where AI becomes action.
In the evaluation-pipeline attack reported as GTG-50020, malicious instructions caused a defender’s AI workflow to release access keys. Read the sourced case ↗
01 / POSSIBLE ATTACK PATH
An agent reads hostile material
→A PLACE TO INTERVENE
AgentsTreat outside text as data, not trusted authority.
Explore the controls ↗02 / POSSIBLE ATTACK PATH
A tool is asked to expose a secret
→A PLACE TO INTERVENE
AgentsCheck tool permissions; keep secrets outside untrusted tasks.
Explore the controls ↗03 / POSSIBLE ATTACK PATH
A leaked key could be reused
A PLACE TO INTERVENE
CloudLimit its reach, detect misuse, and revoke access.
Explore the controls ↗Prompt screening alone cannot guarantee safety. The third step describes a risk to contain, not an additional reported outcome. Control mapping is editorial analysis, not proof of prevention.
Make the trustworthy route easy to find.
In GTG-50021, a counterfeit Claude service delivered a different model and installed software designed to steal credentials. Read the sourced case ↗
01 / POSSIBLE ATTACK PATH
A person looks for AI access
→A PLACE TO INTERVENE
EmployeesProvide approved tools and a clear way to request access.
Explore the controls ↗02 / POSSIBLE ATTACK PATH
An untrusted app asks for access
→A PLACE TO INTERVENE
EmployeesCheck the supplier, downloads, and requested permissions.
Explore the controls ↗03 / POSSIBLE ATTACK PATH
An account may be put at risk
A PLACE TO INTERVENE
CloudDetect unusual account use and remove compromised access.
Explore the controls ↗The case concerns an AI-themed lure. The source does not establish that AI carried out the attack or that all users lost credentials. Control mapping is editorial analysis, not proof of prevention.
ACROSS ALL FIVE AREAS
Governance is the foundation.
Someone needs to own the risk—and be able to show what is being done about it.
Discover & assign
Maintain an inventory, purpose, supplier, data access, and accountable owner.
Set policy
Define allowed uses, sensitive data, approval thresholds, and requirements for vendors.
Check the evidence
Test controls and record exceptions, incidents, coverage gaps, and remediation.
Review & improve
Reassess as tools, permissions, risks, and organizational obligations change.
For public institutions and sensitive environments
Include the mission owner, procurement, privacy, records, and security teams. Specify where data may be processed, who can access it, what must be retained, and how essential services continue during an incident. Requirements depend on the organization and jurisdiction; this map does not establish compliance.
GUIDANCE BEHIND THESE CONTROLSAI Risk Management Framework 1.0: Core ↗The NIST Cybersecurity Framework 2.0 ↗
YOUR NEXT LEADERSHIP MEETINGAsk for a demonstration.
Ask for a demonstration.
Then ask what it missed.
Start with one important workflow. Turn broad assurances into an owner, a test, and a decision.
Open the discussion brief- 01
What can our AI access and change?
Bring the inventory, owners, permissions, and a short list of the most consequential actions.
- 02
Where would we notice or stop misuse?
Walk through one scenario across people, agents, cloud, software, and the response team.
- 03
What proof do we have—and what is uncovered?
Review test results, detection gaps, false alarms, patch status, and the person responsible for closing each gap.
WHY YOU CAN TRACE THIS GUIDECapabilities first.
Capabilities first.
Evidence always.
The five-area structure is our editorial synthesis, adapted from a user-supplied Abnormal AI security concept and extended to include software. Recommendations draw on the guidance below. NIST and OWASP do not endorse this site or this particular structure.
NISTAI Risk Management Framework 1.0: Core ↗NISTThe NIST Cybersecurity Framework 2.0 ↗OWASP Gen AI Security ProjectLLM06:2025 Excessive Agency ↗OWASP Gen AI Security ProjectOWASP Top 10 for Agentic Applications 2026 ↗NISTSecure Software Development Framework 1.1 ↗UK NCSC, CISA and international partnersGuidelines for Secure AI System Development ↗FBIBusiness Email Compromise ↗Federal Trade CommissionProtect verification codes from impersonation scams ↗
How should you evaluate a provider—including Abnormal?
Use these capability areas to evaluate coverage across your existing tools and any new provider. A product can cover several areas; no mapping here establishes that it would have prevented a particular incident.
WHAT PUBLIC MATERIAL SAYS
Abnormal describes email, messaging, account and identity protection, AI governance, and AI-assisted mailbox triage. Its AI Governance page describes discovery, risk assessment, and governance workflows. These are vendor descriptions, not an independent effectiveness assessment.
WHAT TO VERIFY BEFORE BUYING
The AI Governance page includes a roadmap disclaimer. Verify what is available today, licensing, deployment requirements, supported environments, and enforcement coverage. The supplied concept slide does not establish availability of every agent, cloud, workbench, or software capability.
Ask any provider: What is generally available? What is monitored versus blocked? Which paths are outside coverage? Can you demonstrate an end-to-end outcome in our environment? What evidence supports the claim?
Control recommendations and incident mappings are educational analysis. Effects depend on implementation, coverage, and the attack. The guide supplements established security practice, including access control, patching, backups, and incident response.
A GUIDE THAT CAN KEEP LEARNINGBring the context.
Bring the context.
Keep the evidence.
Have interviews or long-form conversations to draw from? Use our research prompt to extract useful explanations, decisions, and source references—while separating opinions, product claims, and verified facts.
Get the transcript research prompt
Produces a sourced brief and structured records for editorial review.
Download the framework data ↗