AI for Cybersecurity & Information Security
Security teams have two jobs with AI. One is using it: triage, investigation and hunting at machine speed. The other is securing it: every assistant and agent the company deploys is a new system that takes instructions from text.
How AI is changing this work
- The SOC gets agents that triage alerts and draft investigations, with analysts handling what is new or serious.
- The attack surface grows: prompts, tools, model files and agent identities are all things to protect.
- Attackers use the same tools, so phishing, recon and exploit work get cheaper for them too.
Your layers: the 4 that matter most
1. Layer 8 · Agents
Why it matters
An agent acts with real permissions. Most serious AI incidents come down to an agent that could do more than its task needed.
What to do here
- Identity per agent. Give every agent its own identity, so you can scope, log and disable it like a user. Agent permissions & sandboxing
- Sandbox and approve. Limit files, network and commands by default; require approval for anything destructive. Agent permissions & sandboxing
- A kill switch and a playbook. Know how to stop an agent, revoke its access and review what it did. Responding to a compromised agent
Examples as of 2026-11-11
2. Layer 7 · Orchestration & Tooling
Why it matters
This is where text becomes action. A model cannot reliably tell instructions from data, so anything it reads can try to steer it.
What to do here
- Treat all content as untrusted. Emails, pages, files and tool results can carry hidden instructions. Screen them and limit what follows. Prompt injection
- Vet tool servers. Allow-list the tool servers agents may use, and review their descriptions as you would code. Tool poisoning
- Red-team before launch. Probe each AI app for injection, leakage and jailbreaks, and repeat after changes. Guardrails & evals
Examples as of 2026-11-11
3. Layer 9 · Applications & Interfaces
Why it matters
This is where AI works for you: assistants and agents inside the security console that read alerts and logs faster than a person can.
What to do here
- Alert triage. An agent sorts alerts, closes clear false positives with its reasons and escalates the rest. AI in the SOC
- Investigation drafts. Ask in plain words what happened on a host or account; verify the evidence it cites. AI in the SOC
- Set the autonomy level. Decide per action what the AI may do alone, such as tag or enrich, and what needs an analyst. Copilots
Examples as of 2026-11-11
4. Layer 6 · Inference & Optimization
Why it matters
Model files are software you download and run. They need the same supply-chain care as any other dependency, and exposed model servers are a common finding.
What to do here
- Safe formats only. Prefer weight formats that cannot run code on load, and scan the rest. Model supply chain
- Verify the source. Pin model versions and check signatures, as you do for packages. Model supply chain
- Do not expose model servers. Local and self-hosted model servers often ship without authentication. Keep them off the internet. Local inference runtimes
Examples as of 2026-11-11
High-leverage use cases
- Alert triage. Agents handle the first pass on high-volume alerts and explain each verdict.
- Investigation and reporting. Timeline, affected assets and a draft incident report from logs, for an analyst to verify.
- AI inventory. A register of every assistant, agent, model and tool server in the company, with owner and access.
- Red-teaming AI apps. Automated probes for injection, data leakage and unsafe tool use before each release.
- Detection writing. Draft detection rules and queries from a threat report, then test them.
Start here: the next 30 to 60 days
- Week 1 to 2. Inventory the AI already in use: assistants, agents, tool servers and who approved them.
- Week 3 to 4. Run an open-source scanner against one internal AI app and fix what it finds.
- Day 30 to 60. Set agent rules: own identity, least access, logging, and a tested way to shut one down.
- Day 30 to 60. Pilot AI triage on one alert type and measure it against analyst verdicts.
Risks and pitfalls
- Prompt injection has no full fix. It is the first item in the OWASP list for a reason. Assume it will sometimes work and limit what a steered model can do. (OWASP Top 10 for LLM Applications)
- Over-trusting the triage agent. A wrongly closed alert is a missed intrusion. Sample closed alerts and track misses.
- Shadow AI. Staff connect assistants and tool servers faster than you can review them. Make the approved path the easy one.
- Excessive agency. Agents given broad standing access turn a small trick into a large incident. (OWASP Top 10 for Agentic Applications)
- Sensitive data in prompts and logs. Prompts, transcripts and agent logs hold secrets and personal data. Protect and expire them like any other log.
Sources
A product named on this page is an example, not a recommendation.
- Microsoft Entra Agent ID (learn.microsoft.com) (2026-11-11)
- Claude Code sandboxing (code.claude.com) (2026-11-11)
- OWASP Top 10 for Agentic Applications (genai.owasp.org) (2026-11-11)
- Prompt Shields (Azure AI Content Safety) (learn.microsoft.com) (2026-11-11)
- garak (NVIDIA) (github.com) (2026-11-11)
- PyRIT (Microsoft) (github.com) (2026-11-11)
- OWASP Top 10 for LLM Applications (genai.owasp.org) (2026-11-11)
- Microsoft Security Copilot (microsoft.com) (2026-11-11)
- Google Security Operations (cloud.google.com) (2026-11-11)
- CrowdStrike Charlotte AI (crowdstrike.com) (2026-11-11)
- safetensors (Hugging Face) (huggingface.co) (2026-11-11)
- Hugging Face Hub pickle scanning (huggingface.co) (2026-11-11)
- model-transparency signing (Sigstore) (github.com) (2026-11-11)
- NIST AI Risk Management Framework (AI RMF 1.0) (2023-01-26)
Other roles
HR & People · Finance · Sales · Marketing · Product & Design · Engineering · Legal & Compliance · Operations · Customer Support