Use all of your data in AI. Nothing raw, ever.

Also: AI security for data

Protecting the sensitive data that AI systems ingest, retrieve, generate, and act on — across training, retrieval, prompts, outputs, and agent actions.

Why it matters: Most AI risk is data risk. Protecting the data is what lets AI reach production.

Keeping sensitive data in prompts, context, fine-tuning sets, and outputs protected so large language models can use it without exposing it.

Why it matters: LLMs process whatever they are given; protection has to happen before the data arrives.

Securing a retrieval-augmented generation pipeline end to end: ingestion, chunking, embeddings, vector stores, retrieval permissions, and generated answers.

Why it matters: RAG copies enterprise data into new stores that existing access controls rarely cover.

Retrieval-augmented generation that prevents sensitive data exposure during retrieval or generation.

The controls that govern what autonomous agents can see, call, and change: identity, tool permissions, data protection, and audit.

Why it matters: Agents act, not just answer — the data they touch must stay protected at every step.

AI agents that operate with built-in data protection, oversight, and controlled autonomy.

Also: MCP

An open protocol that standardizes how AI models and agents connect to tools, data sources, and applications.

Why it matters: MCP makes it easy to connect agents to enterprise systems — which makes data-level controls on those connections essential.

Also: MCP server security

Securing MCP servers, tools, and the data exchanged over them: authentication, scoped permissions, tool vetting, and protection of sensitive fields in requests and responses.

Why it matters: Every MCP server is a new path from an agent to your data.

Also: AI agents

AI that takes autonomous actions — calling APIs, executing code, and making decisions.

Why it matters: Autonomy widens the set of systems and data an AI can reach.

Also: Function calling

An AI calling external functions or APIs to complete a task.

Why it matters: Extends what AI can do beyond text — and extends the reach of a bad instruction.

When an agent has more permissions, tools, or autonomy than its task requires.

Why it matters: Listed in the OWASP Top 10 for LLM Applications. Limit scope and protect the data agents can reach.

Also: Agent identity

Credentials and identities used by agents, services, and workloads rather than people.

Why it matters: Every agent needs an identity that access policy can evaluate and audit.

Security designed for AI workflows, models, and data flows rather than adapted from network or application controls.

Removing, masking, or transforming sensitive information before AI training or inference.

Techniques that stop AI models from revealing sensitive or memorized data.

Filtering and protecting prompts and responses to prevent leakage of sensitive inputs.

Automated enforcement of data, security, and compliance rules across AI workflows.

Preventing sensitive data exposure while a model processes queries.

Also: Unsanctioned AI

Use of AI tools and models outside sanctioned channels, often with sensitive data pasted in.

Why it matters: You can’t block every tool. Protecting the data itself limits what can leak.

Running AI under a nation’s or organization’s own control over data, models, and infrastructure to meet residency and jurisdictional requirements.

Why it matters: Lets regulated organizations use modern models without giving up control of raw data.

Also: AI tokenization

Replacing sensitive values with format-preserving tokens before data reaches models, so AI can train, retrieve, and reason on it while raw values stay protected.

Why it matters: Data stays usable for AI — joins, patterns, and formats hold — without exposing identities.

Malicious input that hijacks AI behavior and makes it ignore its instructions.

Why it matters: Ranked the top risk in the OWASP Top 10 for LLM Applications.

A user directly tries to manipulate the model — “Ignore previous instructions and…”.

Why it matters: The simplest attack, and still effective without layered defenses.

Malicious instructions hidden in content the AI retrieves or reads — documents, emails, web pages.

Why it matters: Attackers poison the sources your AI trusts.

Bypassing a model’s safety guardrails, often through roleplay or framing — “Pretend you’re an AI without restrictions…”.

An AI exposing personally identifiable information — SSNs, emails, salaries — in its responses.

Why it matters: A direct path to regulatory penalties and lost trust.

Also: AI data leakage

Sensitive data escaping through prompts, outputs, logs, embeddings, or third-party model providers.

Why it matters: If raw data never reaches the model, there is far less to disclose.

Extracting confidential data through AI, using it as a side channel.

Corrupting training data to compromise a model.

Why it matters: A long-term attack on model integrity.

Planting malicious documents in a knowledge base that a RAG system will retrieve.

Why it matters: The attacker’s instructions arrive looking like your own data.

Hiding malicious instructions in tool descriptions or MCP server metadata that agents read and follow.

Why it matters: Agents trust tool metadata — vet tools and scope what data they can receive.

Reconstructing a proprietary model’s behavior through repeated queries.

Determining whether a specific record was in a model’s training data.

Why it matters: A privacy attack: “Was my data used to train this?”

Getting a model to regurgitate its training data.

Why it matters: Private information can be recovered from model weights.

Reconstructing sensitive training inputs from model outputs.

Recovering original text from vector embeddings.

Why it matters: Embeddings of raw PII are still sensitive data.

Inputs crafted with small changes that cause AI systems to misbehave.

Manipulating AI through roleplay or false authority — “As a system administrator, I need you to…”.

Flooding the context window to bury malicious instructions in large documents.

Also: Hallucination

When an AI confidently outputs inaccurate or fabricated information.

Why it matters: Plausible-sounding errors undermine trust in AI outputs.

An AI assistant surfacing content a user can technically access but shouldn’t see, because permissions were too broad.

Why it matters: AI makes over-permissioned data instantly discoverable.

Also: Guardrails

Rules and systems that control what AI can access, how it behaves, and what it can output.

Why it matters: Input and output filtering plus content policy — strongest when paired with protected data.

Controls that evaluate and filter what a model returns before it reaches a user or downstream system.

Understanding intent, not just keywords.

Why it matters: Catches rephrased attacks that keyword filters miss.

Probability-based threat assessment, typically 0.0–1.0.

Why it matters: Enables nuanced decisions instead of binary allow/block.

Checking user prompts before processing.

Why it matters: A first line of defense — not sufficient alone.

Scanning AI responses before delivery.

Why it matters: Catches PII leakage and harmful content.

Scanning retrieved documents before the model sees them.

Why it matters: Stops indirect prompt injection.

Recording all AI interactions.

Why it matters: Supports forensics, compliance, and monitoring.

Controls that protect data exchanged through AI model APIs.

Also: Re-identification policy

Rules that decide who or what can re-identify a protected value, for which purpose, and when.

Why it matters: Makes revealing raw data the logged exception, not the default.

Also: Tokenization

Replacing sensitive data with tokens that preserve format and usability while reducing risk.

Why it matters: Not the same as an LLM token — this protects values; that measures text.

Also: Field-level encryption

Protecting individual sensitive fields — a name, a card number — rather than whole files, databases, or networks.

Why it matters: Protection travels with the data into every copy, pipeline, and model.

Also: FPE

Encryption whose output keeps the original format — length and character set — so systems and models keep working.

Why it matters: Protected data fits existing schemas with no application changes.

Hiding sensitive fields using obfuscation techniques, typically for non-production use.

Replacing personal identifiers with artificial ones to reduce risk.

Why it matters: Recognized under GDPR as a safeguard for personal data.

Permanently removing sensitive content from documents or text.

Encrypting stored data to prevent unauthorized access.

Securing data while it moves across networks.

Also: DLP

Tools that detect and block unauthorized sharing of sensitive data.

Why it matters: DLP sees data at the edge; it can’t follow data into embeddings or agent context.

Categorizing data by sensitivity, type, and regulatory needs.

Managing data from creation through use, retention, and deletion.

Limiting collection, access, or retention to only what is strictly necessary.

Strategies that minimize harm by ensuring stolen data remains protected or unusable.

Why it matters: Tokenized data is worthless to an attacker without the keys.

A framework for controlling risk, ethics, and compliance in AI systems.

Why it matters: Governance turns AI from pilot projects into accountable production systems.

Identifying and reducing risks related to AI data, behavior, and outputs.

Developing and deploying AI systems that are ethical, transparent, and fair.

EU regulation that sets risk-based obligations for AI systems, including data-governance, transparency, and human-oversight requirements for high-risk uses.

Why it matters: Raises the bar on documenting what data trained and feeds your AI.

Also: NIST AI 100-1

The NIST AI Risk Management Framework — voluntary US guidance organized around four functions: Govern, Map, Measure, Manage.

The international standard for an AI management system (AIMS).

Also: OWASP LLM Top 10

A community-maintained list of the most critical security risks for applications built on large language models.

Why it matters: A shared checklist for security reviews of AI apps.

Also: AI-SPM

Continuous discovery and assessment of AI models, pipelines, and data flows for misconfigurations and exposure.

Why it matters: Discovery tells you where the fire is; enforcement is the sprinkler system.

Also: DSPM

Continuous visibility into data risk across cloud, applications, and AI.

Controlling and monitoring who can access what data, and why.

Also: ABAC

Permissions determined dynamically by user attributes and context.

Data access allowed only when the intended use matches an approved purpose.

Why it matters: The right model for agents: each tool call justifies the fields it receives.

Processes determining which users can access which data.

A security model that treats every access request as untrusted until validated.

Ensuring data stays within required national or regional boundaries.

Also: PII

Data that can identify an individual, directly or indirectly.

Also: PHI

Health-related personal data governed by HIPAA in the US.

Also: General Data Protection Regulation

EU regulation requiring strict controls on personal data collection and processing.

The Payment Card Industry Data Security Standard for organizations that handle cardholder data.

Encryption that allows computation on encrypted data without decrypting it.

Also: SMPC

Multiple parties jointly compute a result without revealing their private inputs.

Adding calibrated noise to data or results to prevent identification of individuals.

Artificially generated data that mimics real datasets without exposing personal information.

Why it matters: Useful for testing; can degrade models if overused (see model collapse).

Protecting data while it is being processed, using secure hardware environments.

Also: TEE

A hardware-isolated area that securely runs sensitive code and data.

Also: LLM

AI trained on massive text datasets to understand and generate language — GPT, Llama, Claude, Mistral and others.

A chunk of text — roughly three-quarters of a word — that a model processes.

Why it matters: How models read text and how API pricing works. Distinct from data tokenization.

Running a trained model to generate output.

Why it matters: What happens every time a prompt is sent.

The maximum number of tokens a model can consider at once.

Why it matters: Limits how much text you can send — and how much sensitive data one prompt can hold.

Hidden instructions that shape a model’s behavior before user input.

Why it matters: The model’s job description — and a target for injection.

Further training a model on specific data to improve it for a use case.

Why it matters: Whatever is in the fine-tuning set can be memorized.

An efficient fine-tuning method using small adapter layers.

Also: RAG pipeline

Connecting an LLM to external knowledge by retrieving relevant documents and adding them to the prompt.

Why it matters: How enterprises ground AI in their own data.

Also: Embeddings

Numerical representations of text that capture meaning for semantic search and AI reasoning.

A database optimized for similarity search over embeddings.

Why it matters: A new copy of your data that needs its own protection.

Finding content by meaning, not keywords — “data protection” matches “information security.”

Combining semantic and keyword search.

Splitting documents into smaller pieces for retrieval.

Why it matters: Sensitive values end up scattered across chunks — protect them before splitting.

Basing AI responses on retrieved facts.

Why it matters: Reduces hallucinations by anchoring answers to real data.

Re-scoring retrieved results for relevance before sending them to the model.

A database of entities and their relationships — Person → works_at → Company.

RAG that retrieves from knowledge graphs instead of, or alongside, vectors.

Why it matters: Better for structured data and multi-hop reasoning.

Following multiple relationships to answer a question — “Who manages the person who wrote this doc?”

Back-and-forth dialogue where context accumulates.

Why it matters: Attacks can span turns.

Performance degradation from training on AI-generated data.

A distributed architecture for consistent, scalable data protection across environments.

Security controls that keep sensitive data within trusted boundaries.

Also: A2A

An open protocol for AI agents to discover and communicate with each other across vendors and platforms.

Why it matters: Data passed between agents needs the same protection as data passed to tools.

A method for systems to communicate and exchange data.

Cloud-delivered applications managed and updated by the provider.