Applying security fundamentals to AI: Practical advice for CISOs

This Microsoft Office of the CISO guidance explains how organizations should approach AI security by treating AI as software and part of a broader system: apply least-privilege identity and access controls, limit agent capabilities, guard against indirect prompt injection (XPIA), use threat modeling and written safety plans, continuously test and monitor models, and vet model sources and runtimes to reduce risks.