Security
Three decades defending environments that cannot stop, and now the new surface: models, agents, data leaving the perimeter and decisions taken by software. This page holds both things: what we already operate, and what your company needs to plan for before putting AI to work.
What we already run
Everything in this section exists under contract today, with people on call and records an auditor can read. It is the ground AI security stands on: without identity management, inventory and logging, there is nothing to protect in the new layer.
Continuous monitoring with model-assisted investigation at the first level. The analyst receives a case that is already enriched: indicators cross-referenced, timeline built, severity classified.
Internal and external penetration testing run by the same people who defend. Whoever knows where the operation hurts finds the fastest way in.
More than 14 PCI-DSS certifications delivered, from gap analysis to InPlace. And the part that matters more: keeping the controls alive between one audit and the next.
Security that goes into the design instead of being bolted on later. Anticipation, prevention, detection and response as four parts of the same project.
Controls inside the pipeline the team already uses. Governance that lives outside the pipeline is abandoned at the first tight deadline.
From the personal data inventory to the channel with the data subject. Processing with a declared legal basis and minimisation applied, not promised.
Why AI changes the problem
Traditional security protects a system that does what it was programmed to do. A model does what it was induced to do, and the inducement arrives as text, through the same channel where legitimate data travels. Command and content have stopped being separate channels.
An agent with connected tools is no longer an assistant: it is a user with credentials, executing actions in the ERP, in the service desk and in internal APIs. Every control that exists for a person now applies to it, and almost no company has done that yet.
The AI Index Report 2026, from Stanford HAI, records 362 documented AI incidents in 2025, up from 233 in 2024. In the same survey, models score well on safety benchmarks under normal use and lose ground under deliberate attack. The distance between the lab and the operation is exactly where the incident happens.
In the classic model, command and content arrive on different channels. The perimeter inspects the command and blocks whatever is not authorized.
The control works because the two channels are distinguishable. You inspect one and let the other through.
With a model in the path, the hostile instruction travels hidden inside the content. It crosses the perimeter because it is indistinguishable from legitimate data, and the model carries it out through the connected tools.
There is only one channel, and it carries both. The control leaves the edge and moves into tool scoping and human approval.
More incidents recorded in one year than in the whole previous series. The pressure for evidence of control stopped being hypothetical.
The drop is real, and it still leaves one in nine companies running AI with no written rule. The stated obstacles remain knowledge, budget and regulatory uncertainty.
The eight risks
A risk list without the control beside it is a diagnosis without a prescription. On the left, what happens in practice; on the right, what reduces the surface or limits the damage.
What happens
A hostile instruction hidden in a document, email, web page, ticket or image that the model will read. The attack needs no credentials: it only needs the content to reach the context.
What answers it
What happens
Sensitive data enters the prompt, the vector store or the debug log and leaves through a route nobody planned: a response to another user, vendor telemetry, or the training set of a third-party model.
What answers it
What happens
An agent with more permission than the task requires, or able to chain actions with no stopping point. The error stops being a wrong answer and becomes an executed transaction.
What answers it
What happens
Most of the AI a company uses was not built by that company. Model, weights, library, extension and tool server enter the environment carrying the trust of whoever installed them.
What answers it
What happens
A wrong answer delivered with conviction and used as input to a decision. The AI Index 2026 measured hallucination rates from 22% to 94% across 26 top models on an accuracy benchmark.
What answers it
What happens
A tool bought on one department’s credit card, a browser extension with access to email, an assistant wired into a system with nobody informed. It is the most common problem and the least discussed.
What answers it
What happens
An agent using a person’s credentials, or a key shared between services. When something goes wrong, there is no way to know who acted, and no way to revoke without taking the rest down.
What answers it
What happens
Policy in a slide deck, and controls that depend on somebody remembering to write things down. In an audit, intent does not count: the record counts. This is the item that fails most often.
What answers it
The eight risks are not solved in the same place. This is the defense stack, from the perimeter to the record, with each risk code on the layer that answers for it. No layer works without the one below.
Segmentation, firewall, WAF and IPS. Still necessary, and still not enough on its own.
base
Who is who, and what each one may do. This is where the agent enters as a user, with its own identity and lifecycle.
R7
Classification before ingestion, permissions at retrieval, and masking at the log source.
R2
Scope of what the agent can reach, per-run limits, human approval, and provenance of whatever was installed.
R1R3R4R5
Controls embedded in the flow, producing evidence as a by-product of the work. This is what the audit reads.
R6R8
From the outermost layer to the innermost · the codes point to the risks above
How this becomes a program
Discover
An inventory of every model, agent, tool and integration in use, including whatever went live without passing by anyone. Without an inventory there is no scope, and without scope no control is possible.
Classify
Which data feeds each use case, on what legal basis, and what must never leave the perimeter under any circumstance. That is what determines where each model may run.
Control
Tool scope, human approval, masking, evaluation and per-execution limits, deployed inside the pipeline the team already uses.
Observe
Per-execution telemetry in the control tower: what it cost, how often it was right, where a human was needed. Without measurement there is no way to loosen or tighten with judgement.
Prove
The record the controls generate on their own, organised in the shape ISO/IEC 42001, the NIST AI RMF and data protection law ask for. This is where governance stops being a slide.
The yardsticks
The standard that turns practice into auditable evidence. We are in the process of adopting and validating it internally.
Read the paperIt organises the practice into govern, map, measure and manage. It helps you do the work, while ISO lets you prove it.
The engineering reference for prompt injection, context leakage and excessive agency.
Legal basis, minimisation, data subject rights and impact assessment, wherever the AI system processes personal data.
Where AI touches the cardholder data environment, the compliance scope comes with it.
Relevant for anyone operating or selling in Europe. ISO 42001 assembles much of the evidence it requires.
What we say before we start
We would rather say this in the first conversation than in the third. A vendor who only tells you what you want to hear charges for the difference later.
Most AI risk is not the model: it is the access we give it. The most effective control is usually reducing permission, not switching vendor.
A guardrail that gets in the way too much gets switched off. If the safe path is slower than the shortcut, the team takes the shortcut, and you lose the visibility you had.
There is no AI security without a security baseline. A company with no identity management, no inventory and no logging will not fix that at the AI layer.
Prompt injection has no definitive solution today. What exists is surface reduction and damage limitation, and anyone promising complete protection is selling something they do not have.
The standards
In adoption at haapit
ISO/IEC 42001 is the first certifiable international standard for an artificial intelligence management system. We are in study, adoption and internal validation before leading a client through it, exactly as we did with PCI-DSS. When we say we lead it, it will be because we have been through it.
From gap analysis to InPlace, and then keeping the controls alive between one audit and the next. With QSA, SA, CISSP, CISA analysts on the team.
PCI-DSS
v3.2
14+ led
ISO 27001
Security
Gap to InPlace
SOC 2
SSAE 16
Type I and II
SOC 1 · 3
ISAE 3402
Reporting
ISO 9001
Quality
Process
SOX
Controls
Financial
LGPD
Privacy
Readiness
ITIL · Cobit
Governance
Operation
The badges indicate the standards in which haapit leads and sustains readiness projects, not certifications issued in haapit's name. The individual credentials on the team are QSA, SA, CISSP, CISA.
An assessment at no cost: an inventory of what is already running, where sensitive data is touched, and which of the eight risks are open in your environment today.