Jul 19 2025

The AI Readiness Gap: High Usage, Low Security

Category: AI — disc7 @ 3:56 pm

1. AI Adoption Rates Are Sky‑High
According to F5’s mid‑2025 report based on input from 650 IT leaders and 150 AI strategists across large enterprises, a staggering 96 % of organizations are deploying AI models in some form. Yet, only 2 % qualify as ‘highly ready’ to scale AI securely throughout their operations.

2. Readiness Is Mostly Moderate or Low
While the majority—77 %—fall into a “moderately ready” category, they often lack robust governance and security practices. Meanwhile, 21 % are low–readiness, executing AI in siloed or experimental contexts rather than at scale .

3. AI Usage vs. Saturation
Even in moderately ready firms, AI is actively used—around 70 % already employ generative AI, and 25 % of applications on average incorporate AI. In low‑readiness firms, AI remains under‑utilized—typically in less than one‑quarter of apps.

4. Model Diversity and Risks
Most organizations use a diverse mix of tools—65 % run two or more paid AI models alongside at least one open‑source variant (e.g. GPT‑4, Llama, Mistral, Gemma). However, this diversity heightens risk unless proper governance is in place.

5. Security Gaps Leave Firms Vulnerable
Only 18 % of moderately ready firms have deployed an AI firewall, though 47 % plan to in a year. Continuous data labeling—a key measure for transparency and adversarial resilience—is practiced by just 24 %. Hybrid and multi-cloud environments exacerbate governance gaps and expand the attack surface.

6. Recommendations for Improvement
F5’s report urges companies to: diversify models under tight governance; embed AI across workflows, analytics, and security; deploy AI‑specific protections like firewalls; and institutionalize formal data governance—including continuous labeling—to safely scale AI.

7. Strategic Alignment Is Essential
Leaders are clear: AI demands more than experimentation. To truly harness AI’s potential, organizations must align strategy, operations, and risk controls. Without mature governance and cross‑cloud security alignment, AI risks becoming a liability rather than a transformative asset.

AI adoption is widespread, but deep readiness is rare

This report paints a familiar picture: AI adoption is widespread, but deep readiness is rare. While nearly all organizations are deploying AI, very few—just 2 %—are prepared to scale it securely and strategically. The gap between “AI explored” and “AI operationalized responsibly” is wide and risky.

The reliance on multiple models—particularly open‑source variants—without strong governance frameworks is especially concerning. AI firewalls and continuous data labeling, currently underutilized, should be treated as foundational controls—not optional add‑ons.

Ultimately, organizations that treat AI scaling as a strategic transformation—rather than just a technical experiment—will lead. This requires aligning technology investment, data culture, governance, and workforce skills. Firms that ignore these pillars may see short‑term gains in AI experimentation, but they’ll miss long‑term value—and may expose themselves to unnecessary risk.

Artificial Intelligence (AI) Governance and Cyber-Security: A beginner’s handbook on securing and governing AI systems

Databricks AI Security Framework (DASF) and the AI Controls Matrix (AICM) from CSA can both be used effectively for AI security readiness assessments, though they serve slightly different purposes and scopes.

✅ How to Use DASF for AI Security Readiness Assessment

DASF focuses specifically on securing AI and ML systems throughout the model lifecycle. It’s particularly suited for technical assessments in data and model-centric environments like Databricks, but can be adapted elsewhere.

Key steps:

  1. Map Your AI Lifecycle: Identify where your models are in the lifecycle—data ingestion, training, evaluation, deployment, monitoring.
  2. Assess Security Controls by Domain: DASF has categories like:
    • Data protection
    • Model integrity
    • Access controls
    • Incident response
  3. Score Maturity: Rate each domain (e.g., 0–5 scale) based on current security implementations.
  4. Gap Analysis: Highlight where controls are absent or underdeveloped.
  5. Prioritize Remediation: Use risk impact (data sensitivity, exposure risk) to prioritize control improvements.

✅ Best for:

  • ML-heavy organizations
  • Data science and engineering teams
  • Deep-dive technical control validation

✅ How to Use AICM (AI Controls Matrix by CSA)

AICM is a comprehensive, governance-first matrix with 243 control objectives across 18 domains, aligned with industry standards like ISO 42001, NIST AI RMF, and EU AI Act.

Key steps:

  1. Map Business and Risk Context: Understand how AI is used in business processes, risk categories, and critical assets.
  2. Select Relevant Controls: Use AICM to filter based on AI system types (foundational, open source, fine-tuned, etc.).
  3. Perform Readiness Assessment:
    • Mark controls as implemented, partially implemented, or not implemented.
    • Evaluate across governance, privacy, data security, lifecycle management, transparency, etc.
  4. Generate a Risk Scorecard: Assign weighted risk scores to each domain or control set.
  5. Benchmark Against Frameworks: AICM allows alignment with ISO 42001, NIST AI RMF, etc., to help demonstrate compliance.

✅ Best for:

  • Enterprise risk & compliance teams
  • vCISOs / AI governance leads
  • Cross-functional readiness scoring (governance + technical)

🔁 How to Combine DASF and AICM

You can layer both:

  • Use AICM for the top-down governance, risk, and control mapping, especially to align with regulatory requirements.
  • Use DASF for bottom-up, technical control assessments focused on securing actual AI/ML pipelines and systems.

For example:

  • AICM will ask “Do you have data lineage and model accountability policies?”
  • DASF will validate “Are you logging model inputs/outputs and tracking versions with access controls in place?”

🧠 Final Thought

Using DASF + AICM together gives you a holistic AI security readiness assessment—governance at the top, technical controls at the ground level. This combination is particularly powerful for AI risk audits, compliance readiness, or building an AI security roadmap.

⚙️ Service Name

AI Security Readiness Assessment (ASRA)
(Powered by CSA AICM + Databricks DASF)

📋 Scope of Work

Phase 1 – Discovery & Scoping

  • Business use cases of AI
  • Model types and deployment workflows
  • Regulatory obligations (e.g., ISO 42001, NIST AI RMF, EU AI Act)

Phase 2 – AICM-Based Governance Readiness

  • 18 domains / 243 controls (filtered by your AI system type)
  • Governance, accountability, transparency, bias, privacy, etc.
  • Scorecard: Implemented / Partial / Not Implemented
  • Regulatory alignment

Phase 3 – DASF-Based Technical Security Review

  • AI/ML pipeline review (data ingestion → model monitoring)
  • Model protection, access controls, audit logging
  • ML-specific threat modeling
  • Deployment maturity review (cloud, on-prem, hybrid)

Phase 4 – Gap Analysis & Risk Scorecard

  • Heat map by control domain
  • Weighted risk scores and impact areas
  • Governance + technical risk exposure

Phase 5 – Action Plan & Recommendations

  • Prioritized remediation roadmap
  • Suggested tooling or automation
  • Quick wins vs strategic improvements
  • Optional: Continuous assessment model

📊 Deliverables

  • 10-page AI Security Risk Scorecard
  • 1-page Executive Summary with Risk Heatmap
  • Custom Governance & Security Gap Report
  • Actionable Roadmap aligned to business goals

Feel free to reach out with any questions. ✉ info@deurainfosec.com ☏ (707) 998-5164

AIMS and Data Governance

Hands-On Large Language Models: Language Understanding and Generation

AWS Databases for AI/ML: Architecting Intelligent Data Workflows (AWS Cloud Mastery: Building and Securing Applications)


Trust Me – ISO 42001 AI Management System

ISO/IEC 42001:2023 – from establishing to maintain an AI management system

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: AI Readiness Gap

Jul 18 2025

Mitigate and adapt with AICM (AI Controls Matrix)

Category: AI,ISO 42001 — disc7 @ 9:03 am

The AICM (AI Controls Matrix) is a cybersecurity and risk management framework developed by the Cloud Security Alliance (CSA) to help organizations manage AI-specific risks across the AI lifecycle.

AICM stands for AI Controls Matrix, and it is:

  • A risk and control framework tailored for Artificial Intelligence (AI) systems.
  • Built to address trustworthiness, safety, and compliance in the design, development, and deployment of AI.
  • Structured across 18 security domains with 243 control objectives.
  • Aligned with existing standards like:
    • ISO/IEC 42001 (AI Management Systems)
    • ISO/IEC 27001
    • NIST AI Risk Management Framework
    • BSI AIC4
    • EU AI Act

+———————————————————————————+
| ARTIFICIAL INTELLIGENCE CONTROL MATRIX (AICM) |
| 243 Control Objectives | 18 Security Domains |
+———————————————————————————+

Domain No.Domain NameExample Controls Count
1Governance & Leadership15
2Risk Management14
3Compliance & Legal13
4AI Ethics & Responsible AI18
5Data Governance16
6Model Lifecycle Management17
7Privacy & Data Protection15
8Security Architecture13
9Secure Development Practices15
10Threat Detection & Response12
11Monitoring & Logging12
12Access Control14
13Supply Chain Security13
14Business Continuity & Resilience12
15Human Factors & Awareness14
16Incident Management14
17Performance & Explainability13
18Third-Party Risk Management13
+———————————————————————————+
TOTAL CONTROL OBJECTIVES: 243
+———————————————————————————+

Legend:
📘 = Policy Control
🔧 = Technical Control
🧠 = Human/Process Control
🛡️ = Risk/Compliance Control

🧩 Key Features

  • Covers traditional cybersecurity and AI-specific threats (e.g., model poisoning, data leakage, prompt injection).
  • Applies across the entire AI lifecycle—from data ingestion and training to deployment and monitoring.
  • Includes a companion tool: the AI-CAIQ (Consensus Assessment Initiative Questionnaire for AI), enabling organizations to self-assess or vendor-assess against AICM controls.

🎯 Why It Matters

As AI becomes pervasive in business, compliance, and critical infrastructure, traditional frameworks (like ISO 27001 alone) are no longer enough. AICM helps organizations:

  • Implement responsible AI governance
  • Identify and mitigate AI-specific security risks
  • Align with upcoming global regulations (like the EU AI Act)
  • Demonstrate AI trustworthiness to customers, auditors, and regulators

Here are the 18 security domains covered by the AICM framework:

  1. Audit and Assurance
  2. Application and Interface Security
  3. Business Continuity Management and Operational Resilience
  4. Change Control and Configuration Management
  5. Cryptography, Encryption and Key Management
  6. Datacenter Security
  7. Data Security and Privacy Lifecycle Management
  8. Governance, Risk and Compliance
  9. Human Resources
  10. Identity and Access Management (IAM)
  11. Interoperability and Portability
  12. Infrastructure Security
  13. Logging and Monitoring
  14. Model Security
  15. Security Incident Management, E‑Discovery & Cloud Forensics
  16. Supply Chain Management, Transparency and Accountability
  17. Threat & Vulnerability Management
  18. Universal Endpoint Management

Gap Analysis Template based on AICM (Artificial Intelligence Control Matrix)

#DomainControl ObjectiveCurrent State (1-5)Target State (1-5)GapResponsibleEvidence/NotesRemediation ActionDue Date
1Governance & LeadershipAI governance structure is formally defined.253John D.No documented AI policyDraft governance charter2025-08-01
2Risk ManagementAI risk taxonomy is established and used.341Priya M.Partial mappingAlign with ISO 238942025-07-25
3Privacy & Data ProtectionAI models trained on PII have privacy controls.154Sarah W.Privacy review not performedConduct DPIA2025-08-10
4AI Ethics & Responsible AIAI systems are evaluated for bias and fairness.253Ethics BoardInformal process onlyImplement AI fairness tools2025-08-15
…………………………

🔢 Scoring Scale (Current & Target State)

  • 1 – Not Implemented
  • 2 – Partially Implemented
  • 3 – Implemented but Not Reviewed
  • 4 – Implemented and Reviewed
  • 5 – Optimized and Continuously Improved

The AICM contains 243 control objectives distributed across 18 security domains, analyzed by five critical pillars, including Control Type, Control Applicability and Ownership, Architectural Relevance, LLM Lifecycle Relevance, and Threat Category.

It maps to leading standards, including NIST AI RMF 1.0 (via AI NIST 600-1), and BSI AIC4 (included today), as well as ISO 42001 & ISO 27001 (next month).

This will be the framework for STAR for AI organizational certification program. Any AI model provider, cloud service provider or SaaS provider will want to go through this program. CSA is leaving it open as to enterprises, they believe it is going to make sense for them to consider the certification as well. The release includes the Consensus Assessment Initiative Questionnaire for AI (AI-CAIQ), so CSA encourage you to start thinking about showing your alignment with AICM soon.

CSA will also adapt our Valid-AI-ted AI-based automated scoring tool to analyze AI-CAIQ submissions

Download info and 7 minute intro video: https://lnkd.in/gZmWkQ8V

#AIGuardrails #CSA #AIControlsMatrix #AICM

🎯 Use Case: ISO/IEC 42001-Based AI Governance Gap Analysis (Customized AICM)

#AICM DomainISO 42001 ClauseControl ObjectiveCurrent State (1–5)Target State (1–5)GapResponsibleEvidence/NotesRemediation ActionDue Date
1Governance & Leadership5.1 LeadershipLeadership demonstrates AI responsibility and commitment253CTONo AI charter signed by execsFormalize AI governance charter2025-08-01
2Risk Management6.1 Actions to address risksAI risk register and risk criteria are defined and maintained341Risk LeadRisk register lacks AI-specific itemsIntegrate AI risks into enterprise ERM2025-08-05
3AI Ethics & Responsible AI6.3 Ethical impact assessmentAI system ethical impact is documented and reviewed periodically154Ethics TeamNo structured ethical reviewCreate ethics impact assessment process2025-08-15
4Data Governance8.3 Data & data qualityData used in AI is validated, labeled, and assessed for bias253Data OwnerInconsistent labeling practicesImplement AI data QA framework2025-08-20
5Model Lifecycle Management8.2 AI lifecycleAI lifecycle stages are defined and documented (from design to EOL)253ML LeadNo documented lifecycleAdopt ISO 42001 lifecycle guidance2025-08-30
6Privacy & Data Protection8.3.2 Privacy & PIIPII used in AI training is minimized, protected, and compliant253DPONo formal PII minimization strategyConduct AI-focused DPIAs2025-08-10
7Monitoring & Logging9.1 MonitoringAI systems are continuously monitored for drift, bias, and failure352DevOpsLogging enabled, no alerts setAutomate AI model monitoring2025-09-01
8Performance & Explainability8.4 ExplainabilityModels provide human-understandable decisions where needed143AI TeamBlack-box model in productionAdopt SHAP/LIME/XAI tools2025-09-10
……………………………

🧭 Scoring Scale:

  • 1 – Not Implemented
  • 2 – Partially Implemented
  • 3 – Implemented but not Audited
  • 4 – Audited and Maintained
  • 5 – Integrated and Continuously Improved

🔗 Key Mapping to ISO/IEC 42001 Sections:

  • Clause 4: Context of the organization
  • Clause 5: Leadership
  • Clause 6: Planning (risk, opportunities, impact)
  • Clause 7: Support (resources, awareness, documentation)
  • Clause 8: Operation (AI lifecycle, data, privacy)
  • Clause 9: Performance evaluation (monitoring, audit)
  • Clause 10: Improvement (nonconformity, corrective action)

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: #AI Guardrails, #CSA, AI Controls Matrix, AICM, Controls Matrix, EU AI Act, iso 27001, ISO 42001, NIST AI Risk Management Framework

Jul 17 2025

Securing AI from Within: How to Defend Against Prompt Injection Attacks

Category: AI — disc7 @ 9:29 am

Prompt injection attacks are a rising threat in the AI landscape. They occur when malicious instructions are embedded within seemingly innocent user input. Once processed by an AI model, these instructions can trigger unintended and dangerous behavior—such as leaking sensitive information or generating harmful content. Traditional cybersecurity defenses like firewalls and antivirus tools are powerless against these attacks because they operate at the application level, not the content level where AI vulnerabilities lie.

A practical example is asking a chatbot to summarize an article, but the article secretly contains instructions that override the intended behavior of the AI—like requesting sensitive internal data or malicious actions. Without specific safeguards in place, many AI systems follow these hidden prompts blindly. This makes prompt injection not only technically alarming but a serious business liability.

To counter this, AI security proxies are emerging as a preferred solution. These proxies sit between the user and the AI model, inspecting both inputs and outputs for harmful instructions or data leakage. If a prompt is malicious, the proxy intercepts it before it reaches the model. If the AI response includes sensitive or inappropriate content, the proxy can block or sanitize it before delivery.

AI security proxies like Llama Guard use dedicated models trained to detect and neutralize prompt injection attempts. They offer several benefits: centralized protection for multiple AI systems, consistent policy enforcement across different models, and a unified dashboard to monitor attack attempts. This approach simplifies and strengthens AI security without retraining every model individually.

Relying solely on model fine-tuning to resist prompt injections is insufficient. Attackers constantly evolve their tactics, and retraining models after every update is both time-consuming and unreliable. Proxies provide a more agile and scalable layer of defense that aligns with the principle of defense in depth—an approach that layers multiple controls for stronger protection.

More than a technical issue, prompt injection represents a strategic business risk. AI systems that leak data or generate toxic content can trigger compliance violations, reputational harm, and financial loss. This is why prompt injection mitigation should be built into every organization’s AI risk management strategy from day one.

Opinion & Recommendation:
To effectively counter prompt injection, organizations should adopt a layered defense model. Start with strong input/output filtering using AI-aware security proxies. Combine this with secure prompt design, robust access controls, and model-level fine-tuning for context awareness. Regular red-teaming exercises and continuous threat modeling should also be incorporated. Like any emerging threat, proactive governance and cross-functional collaboration will be key to building AI systems that are secure by design.

Adversarial AI Attacks, Mitigations, and Defense Strategies: A cybersecurity professional’s guide to AI attacks, threat modeling, and securing AI with MLSecOps

AIMS and Data Governance

Hands-On Large Language Models: Language Understanding and Generation

AWS Databases for AI/ML: Architecting Intelligent Data Workflows (AWS Cloud Mastery: Building and Securing Applications)


Trust Me – ISO 42001 AI Management System

ISO/IEC 42001:2023 – from establishing to maintain an AI management system

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: Adversarial AI Attacks, AI Prompt Injection

Jul 12 2025

Why Integrating ISO Standards is Critical for GRC in the Age of AI

Category: AI,GRC,Information Security,ISO 27k,ISO 42001 — disc7 @ 9:56 am

Integrating ISO standards across business functions—particularly Governance, Risk, and Compliance (GRC)—has become not just a best practice but a necessity in the age of Artificial Intelligence (AI). As AI systems increasingly permeate operations, decision-making, and customer interactions, the need for standardized controls, accountability, and risk mitigation is more urgent than ever. ISO standards provide a globally recognized framework that ensures consistency, security, quality, and transparency in how organizations adopt and manage AI technologies.

In the GRC domain, ISO standards like ISO/IEC 27001 (information security), ISO/IEC 38500 (IT governance), ISO 31000 (risk management), and ISO/IEC 42001 (AI management systems) offer a structured approach to managing risks associated with AI. These frameworks guide organizations in aligning AI use with regulatory compliance, internal controls, and ethical use of data. For example, ISO 27001 helps in safeguarding data fed into machine learning models, while ISO 31000 aids in assessing emerging AI risks such as bias, algorithmic opacity, or unintended consequences.

The integration of ISO standards helps unify siloed departments—such as IT, legal, HR, and operations—by establishing a common language and baseline for risk and control. This cohesion is particularly crucial when AI is used across multiple departments. AI doesn’t respect organizational boundaries, and its risks ripple across all functions. Without standardized governance structures, businesses risk deploying fragmented, inconsistent, and potentially harmful AI systems.

ISO standards also support transparency and accountability in AI deployment. As regulators worldwide introduce new AI regulations—such as the EU AI Act—standards like ISO/IEC 42001 help organizations demonstrate compliance, build trust with stakeholders, and prepare for audits. This is especially important in industries like healthcare, finance, and defense, where the margin for error is small and ethical accountability is critical.

Moreover, standards-driven integration supports scalability. As AI initiatives grow from isolated pilot projects to enterprise-wide deployments, ISO frameworks help maintain quality and control at scale. ISO 9001, for instance, ensures continuous improvement in AI-supported processes, while ISO/IEC 27017 and 27018 address cloud security and data privacy—key concerns for AI systems operating in the cloud.

AI systems also introduce new third-party and supply chain risks. ISO standards such as ISO/IEC 27036 help in managing vendor security, and when integrated into GRC workflows, they ensure AI solutions procured externally adhere to the same governance rigor as internal developments. This is vital in preventing issues like AI-driven data breaches or compliance gaps due to poorly vetted partners.

Importantly, ISO integration fosters a culture of risk-aware innovation. Instead of slowing down AI adoption, standards provide guardrails that enable responsible experimentation and faster time to trust. They help organizations embed privacy, ethics, and accountability into AI from the design phase, rather than retrofitting compliance after deployment.

In conclusion, ISO standards are no longer optional checkboxes; they are strategic enablers in the age of AI. For GRC leaders, integrating these standards across business functions ensures that AI is not only powerful and efficient but also safe, transparent, and aligned with organizational values. As AI’s influence grows, ISO-based governance will distinguish mature, trusted enterprises from reckless adopters.

The Strategic Synergy: ISO 27001 and ISO 42001 – A New Era in Governance

ISO 42001 Readiness: A 10-Step Guide to Responsible AI Governance

AI is Powerful—But Risky. ISO/IEC 42001 Can Help You Govern It

Historical data on the number of ISO/IEC 27001 certifications by country across the Globe

Understanding ISO 27001: Your Guide to Information Security

Download ISO27000 family of information security standards today!

ISO 27001 Do It Yourself Package (Download)

ISO 27001 Training Courses –  Browse the ISO 27001 training courses

What does BS ISO/IEC 42001 – Artificial intelligence management system cover?
BS ISO/IEC 42001:2023 specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving an AI management system within the context of an organization.

AI Act & ISO 42001 Gap Analysis Tool

AI Policy Template

ISO/IEC 42001:2023 – from establishing to maintain an AI management system.

ISO/IEC 27701 2019 Standard – Published in August of 2019, ISO 27701 is a new standard for information and data privacy. Your organization can benefit from integrating ISO 27701 with your existing security management system as doing so can help you comply with GDPR standards and improve your data security.

Check out our earlier posts on the ISO 27000 series.

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: AIMS, isms, iso 27000

Jul 11 2025

The Hidden Dangers of AI: Why Data Security Can’t Be an Afterthought

Category: AI,data security — disc7 @ 9:18 am

1. The Rise of AI and the Data Dilemma
Artificial intelligence (AI) is revolutionizing industries, enabling faster decisions and improved productivity. However, its exponential growth is outpacing efforts to ensure data protection and security. The integration of AI into critical infrastructure and business systems introduces new vulnerabilities, particularly as vast amounts of sensitive data are used for training models.

2. AI as Both Solution and Threat
AI offers great potential for threat detection and prevention, yet it also presents new risks. Threat actors are exploiting AI tools to create sophisticated cyberattacks, such as deepfakes, phishing campaigns, and automated intrusion tactics. This dual-use nature of AI complicates its adoption and regulation.

3. Data Privacy in the Age of AI
AI systems often rely on massive datasets, which can include personally identifiable information (PII). Improper handling or insufficient anonymization of data poses privacy risks. Regulators and organizations are increasingly concerned with how data is collected, stored, and used within AI systems, as breaches or misuse can lead to severe legal and reputational consequences.

4. Regulatory Pressure and Gaps
Governments and regulatory bodies are rushing to catch up with AI advancements. While frameworks like GDPR and the AI Act (in the EU) aim to govern AI use, there remains a lack of global standardization. The absence of unified policies leaves organizations vulnerable to compliance gaps and fragmented security postures.

5. Shadow AI and Organizational Blind Spots
One emerging challenge is the rise of “shadow AI”—tools and models used without official oversight or governance. Employees may experiment with AI tools without understanding the associated risks, leading to data leaks, IP exposure, and compliance violations. This shadow usage exacerbates existing security blind spots.

6. Vulnerable Supply Chains
AI systems often depend on third-party tools, open-source models, and external data sources. This complex supply chain introduces additional risks, as vulnerabilities in any component can compromise the entire system. Supply chain attacks targeting AI infrastructure are becoming more common and harder to detect.

7. Security Strategies Lag Behind AI Adoption
Despite the growing risks, many organizations still treat AI security reactively rather than proactively. Traditional cybersecurity frameworks may not be sufficient to protect dynamic AI systems. There’s a pressing need to embed security into AI development and deployment processes, including model integrity checks and data governance protocols.

8. Building Trust in AI Requires Transparency and Collaboration
To address these challenges, organizations must foster transparency, cross-functional collaboration, and continuous monitoring of AI systems. It’s essential to align AI innovation with ethical practices, robust governance, and security-by-design principles. Trustworthy AI must be both functional and safe.

Opinion:
The article accurately highlights a growing paradox in the AI space—innovation is moving at breakneck speed, while security and governance lag dangerously behind. In my view, this imbalance could undermine public trust in AI if not corrected swiftly. Organizations must treat AI as a high-stakes asset, not just a tool. Proactively securing data pipelines, monitoring AI behaviors, and setting strict access controls are no longer optional—they are essential pillars of responsible innovation. Investing in data governance and AI security now is the only way to ensure its benefits outweigh the risks.

Hidden Dangers of AI: The Risks We Can’t Ignore

AIMS and Data Governance

Hands-On Large Language Models: Language Understanding and Generation

AWS Databases for AI/ML: Architecting Intelligent Data Workflows (AWS Cloud Mastery: Building and Securing Applications)


Trust Me – ISO 42001 AI Management System

ISO/IEC 42001:2023 – from establishing to maintain an AI management system

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: Dangers of AI, The Hidden Dangers of AI

Jul 10 2025

Why Smart Enterprises Are Hiding AI Models Behind APIs

Category: AI,API security — disc7 @ 2:49 pm

  1. Introduction to Model Abstraction
    Leading AI teams are moving beyond fine-tuning and instead are abstracting their models behind well-designed APIs. This architectural approach shifts the focus from model mechanics to delivering reliable, user-oriented outcomes at scale.
  2. Why Users Don’t Need Models
    End users and internal stakeholders aren’t interested in the complexities of LLMs; they want consistent, dependable results. Model abstraction isolates internal variability and ensures APIs deliver predictable functionality.
  3. Simplifying Integration via APIs
    By converting complex LLMs into standardized API endpoints, engineers free teams from model management. Developers can build AI-driven tools without worrying about infrastructure or continual model updates.
  4. Intelligent Task Routing
    Enterprises are deploying intelligent routing systems that send tasks to optimal models—open-source, proprietary, or custom—based on need. This orchestration maximizes both performance and cost-effectiveness.
  5. Governance, Monitoring, and Cost Control
    API-based architectures enable central oversight of AI usage. Teams can enforce policies, track usage, and apply cost controls across every request—something much harder with ad hoc LLM deployments.
  6. Scalable, Multi‑Model Resilience
    With abstraction layers, systems can gracefully degrade or shift models without breaking integrators. This flexible pattern supports redundancy, rollout strategies, and continuous improvement across multiple AI engines.
  7. Foundations for Internal AI Tools
    These API layers make it easy to build internal developer portals and GPT-style copilots. They also underpin real‑time decisioning systems—providing business value via low-latency, scalable automation.
  8. The Future: AI as Infrastructure
    This architectural shift represents a new frontier in enterprise AI infrastructure—AI delivered as dependable, governed service layers. Instead of customizing models per task, teams build modular intelligence platforms that power diverse use cases.

Conclusion
Pulling models behind APIs lets organizations treat AI as composable infrastructure—abstracting away technical complexity while maintaining flexibility, control, and scale. This approach is reshaping how enterprises deploy and govern AI at scale.

Hands-On Large Language Models: Language Understanding and Generation

AWS Databases for AI/ML: Architecting Intelligent Data Workflows (AWS Cloud Mastery: Building and Securing Applications)


Trust Me – ISO 42001 AI Management System

ISO/IEC 42001:2023 – from establishing to maintain an AI management system

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: AI Model, Model Abstraction

Jul 10 2025

Why Smart Businesses Are Investing in Data Governance Now

Category: AI,Data Governance,IT Governance — disc7 @ 9:11 am

  1. The global data governance market is on a strong upward trajectory and is expected to reach $9.62 billion by 2030. This growth is fueled by an evolving business landscape where data is at the heart of decision-making and operations. As organizations recognize the strategic value of data, governance has shifted from a technical afterthought to a business-critical priority.
  2. The demand surge is largely attributed to increased regulatory pressure, including global mandates like ISO 27001, ISO 42001, ISO 27701, GDPR and CCPA, which require organizations to manage personal data responsibly. Simultaneously, companies face mounting obligations to demonstrate compliance and accountability in their data handling practices.
  3. The exponential growth in data volumes, driven by digital transformation, IoT, and cloud adoption, has added complexity to data environments. Enterprises now require sophisticated frameworks to ensure data accuracy, accessibility, and security throughout its lifecycle.
  4. Highly regulated sectors such as finance, insurance, and healthcare are leading the charge in governance investments. For these industries, maintaining data integrity is not just about compliance—it’s also about building trust with customers and avoiding operational and reputational risks.
  5. Looking back, the data governance market was valued at just $1.3 billion in 2015. Over the past decade, cyber threats, cloud adoption, and the evolving regulatory climate have dramatically reshaped how organizations view data control, privacy, and stewardship.
  6. Governance is no longer a luxury—it’s an operational necessity. Businesses striving to scale and innovate recognize that a lack of governance leads to data silos, inconsistent reporting, and increased exposure to risk. As a result, many are embedding governance policies into their digital strategy and enterprise architecture.
  7. The focus on data governance is expected to intensify over the next five years. Emerging trends such as AI governance, real-time data lineage, and automation in compliance management will shape the next generation of tools and frameworks. As organizations increasingly adopt data mesh and decentralized architectures, governance solutions will need to be more agile, scalable, and intelligent to meet modern demands.

Data Governance Market Progression (Next 5 Years):

The next five years will see data governance evolve into a more intelligent, automated, and embedded function within digital enterprises. Expect the market to expand across small and mid-sized businesses, not just large enterprises, driven by affordable SaaS solutions and frameworks tailored to industry-specific needs. Additionally, AI and machine learning will become central to governance platforms, enabling predictive policy enforcement, automated classification, and real-time anomaly detection. With the increasing use of generative AI, data lineage and auditability will gain prominence. Overall, governance will move from being reactive to proactive, adaptive, and risk-focused, aligning closely with broader ESG (Environmental, Social, and Governance factors) and data ethics initiatives.

📘 Data Governance Guidelines Outline

1. Define Objectives and Scope

  • Align governance with business goals (e.g., compliance, quality, security).
  • Identify which data domains and systems are in scope.
  • Establish success metrics (e.g., reduced errors, compliance rate).

2. Establish Governance Roles and Responsibilities

  • Data Owners – accountable for data quality and policies.
  • Data Stewards – responsible for day-to-day data management.
  • Data Governance Council – oversees strategy and conflict resolution.
  • IT/Data Teams – implement and support governance tools and policies.

3. Create Data Policies and Standards

  • Data classification (e.g., PII, confidential, public).
  • Access control and data usage policies.
  • Data retention and archival rules.
  • Naming conventions, metadata standards, and documentation guidelines.

4. Ensure Data Quality Management

  • Define data quality dimensions: accuracy, completeness, timeliness, consistency, validity.
  • Use profiling tools to monitor and report data quality issues.
  • Set up data cleansing and remediation processes.

5. Implement Data Security and Privacy Controls

  • Align with frameworks like ISO 27001, NIST, and GDPR/CCPA.
  • Encrypt sensitive data in transit and at rest.
  • Conduct privacy impact assessments (PIAs).
  • Establish audit trails and logging mechanisms.

6. Enable Data Lineage and Transparency

  • Document data sources, transformations, and flows.
  • Maintain a centralized data catalog.
  • Support traceability for compliance and analytics.

7. Provide Training and Change Management

  • Educate stakeholders on governance roles and data handling practices.
  • Promote a data-driven culture.
  • Communicate changes in policies and ensure adoption.

8. Measure, Monitor, and Improve

  • Track key performance indicators (KPIs).
  • Conduct regular audits and maturity assessments.
  • Review and update governance policies annually or when business needs change.

Data Governance: How to Design, Deploy, and Sustain an Effective Data Governance Program

Data Governance: The Definitive Guide: People, Processes, and Tools to Operationalize Data Trustworthiness

Secure Your Business. Simplify Compliance. Gain Peace of Mind

AIMS and Data Governance

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: Data Governance

Jul 09 2025

Why Tokenization is the Key to Stronger Data Security

Category: data security,Information Security,pci dss — disc7 @ 10:01 am

  1. In today’s landscape, cyber threats are no longer a question of “if” but “when.” The financial and reputational costs of data breaches can be devastating. Traditionally, encryption has served as the frontline defense—locking data away. But tokenization offers a different—and arguably superior—approach: remove sensitive data entirely, and hackers end up breaking into an empty vault
  2. Tokenization works much like casino chips. Instead of walking around with cash, players use chips that only hold value within the casino. If stolen, these chips are useless outside the establishment. Similarly, sensitive information (like credit card numbers) is stored in a highly secure “token vault.” The system returns a non-sensitive, randomized token to your application—a placeholder with zero intrinsic value
  3. Once your systems are operating solely with tokens, real data never touches them. This minimizes the risk: even if your servers are compromised, attackers only obtain meaningless tokens. The sensitive data remains locked away, accessible only through secure channels to the token vault
  4. Tokenization significantly reduces your “risk profile.” Without sensitive data in your environment, the biggest asset that cybercriminals target disappears. This process, often referred to as “data de-scoping,” eliminates your core liability—if you don’t store sensitive data, you can’t lose it
  5. For businesses handling payment cards, tokenization simplifies compliance with PCI DSS. Most mandates apply only when real cardholder data enters your systems. By outsourcing tokenization to a certified provider, you dramatically shrink your audit scope and compliance burden, translating into cost and time savings
  6. Unlike many masking methods, tokenization preserves the utility of data. Tokens can mirror the format of the original data—such as 16-digit numbers preserving the last four digits. This allows you to perform analytics, generate reports, and support loyalty systems without ever exposing the actual data
  7. More than just an enhanced security layer, tokenization is a strategic data management tool. It fundamentally reduces the value of what resides in your systems, making them less enticing and more resilient. This dual benefit—heightened security and operational efficiency—forms the basis for a more robust and trustworthy enterprise

🔒 Key Benefits of Tokenization

  • Risk Reduction: Sensitive data is removed from core systems, minimizing exposure to breaches.
  • Simplified Compliance: Limits PCI DSS scope and lowers audit complexity and costs.
  • Operational Flexibility: Maintains usability of data for analytics and reporting.
  • Security by Design: Reduces attack surface—no valuable data means no incentive for theft.

🔄 Step-by-Step Example (Credit Card Payment)

Scenario: A customer enters their credit card number on an e-commerce site.

  1. Original Data Collected:
    Customer enters: 4111 1111 1111 1111.
  2. Tokenization Process Begins:
    The payment processor sends the card number to a tokenization service.
  3. Token Issued:
    The service generates a random token, like A94F-Z83D-J1K9-X72B, and stores the actual card number securely in its token vault.
  4. Token Returned:
    The merchant’s system only stores and uses the token (A94F-Z83D-J1K9-X72B)—not the real card number.
  5. Transaction Authorization:
    When needed (e.g. to process a refund), the merchant sends the token to the tokenization provider, which maps it back to the original card and processes the transaction securely.

Tokenization (data security) – Wikipedia

PCI DSS Version 4.0.1 – A Guide to the Payment Card Industry Data Security Standard

Secure Your Business. Simplify Compliance. Gain Peace of Mind

AIMS and Data Governance

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: Tokenization

Jul 08 2025

Stop Managing Risks—Start Enabling Better Decisions

Category: Information Security,Risk Assessment,Security Risk Assessment — disc7 @ 2:22 pm

Most risk assessments fail to support real decisions. Learn how to turn risk management into a strategic advantage, not just a compliance task.

1.
In many organizations, risk assessments are treated as checklist exercises—completed to meet compliance requirements, not to drive action. They often lack relevance to current business decisions and serve more as formalities than strategic tools.

2.
When no real decision is being considered, a risk assessment becomes little more than paperwork. It consumes time, effort, and even credibility without providing meaningful value to the business. In such cases, risk teams risk becoming disconnected from the core priorities of the organization.

3.
This disconnect is reflected in recent research. According to PwC’s 2023 Global Risk Survey, while 73% of executives agree that risk management is critical to strategic decisions, only 22% believe it is effectively influencing those decisions. Gartner’s 2023 survey also found that over half of organizations see risk functions as too siloed to support enterprise-wide decisions.

4.
Even more concerning is the finding from NC State’s ERM Initiative: over 60% of risk assessments are performed without a clear decision-making context. This means that most risk work happens in a vacuum, far removed from the actual choices business leaders are making.

5.
Risk management should not be a separate track from business—it should be a core driver of decision-making under uncertainty. Its value lies in making trade-offs explicit, identifying blind spots, and empowering leaders to act with clarity and confidence.

6.
Before launching into a new risk register update or a 100 plus page report, organizations should ask a sharper business related question: What business decision are we trying to support with this assessment? When risk is framed this way, it becomes a strategic advantage, not an overhead cost.

7.
By shifting focus from managing risks to enabling better decisions, risk management becomes a force multiplier for strategy, innovation, and resilience. It helps business leaders act not just with caution—but with confidence.

Conclusion
A well-executed risk assessment helps businesses prioritize what matters, allocate resources wisely, and protect value while pursuing growth. To be effective, risk assessments must be decision-driven, timely, and integrated into business conversations. Don’t treat them as routine reports—use them as decision tools that connect uncertainty to action.

Fundamentals of Risk Management: Understanding, Evaluating and Implementing Effective Enterprise Risk Management

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: Business Enabler, Enabling Better Decisions

Jul 08 2025

Securing AI Data Across Its Lifecycle: How Recent CSI Guidance Protects What Matters Most

Category: AI,ISO 42001 — disc7 @ 9:35 am

In the race to leverage artificial intelligence (AI), organizations are rushing to train, deploy, and scale AI systems—but often without fully addressing a critical piece of the puzzle: AI data security. The recent guidance from the Cybersecurity and Infrastructure Security Agency (CISA) and Cybersecurity Strategic Initiative (CSI) offers a timely blueprint for protecting AI-related data across its lifecycle.

Why AI Security Starts with Data

AI models are only as trustworthy as the data they are trained on. From sensitive customer information to proprietary business insights, the datasets feeding AI systems are now prime targets for attackers. That’s why the CSI emphasizes securing this data not just at rest or in transit, but throughout its entire lifecycle—from ingestion and training to inference and long-term storage.

A Lifecycle Approach to Risk

Traditional cybersecurity approaches aren’t enough. The AI lifecycle introduces new risks at every stage—like data poisoning during training or model inversion attacks during inference. To counter this, security leaders must adopt a holistic, lifecycle-based strategy that extends existing security controls into AI environments.

Know Your Data: Visibility and Classification

Effective AI security begins with understanding what data you have and where it lives. CSI guidance urges organizations to implement robust data discovery, labeling, and classification practices. Without this foundation, it’s nearly impossible to apply appropriate controls, meet regulatory requirements, or detect misuse.

Evolving Controls: IAM, Encryption, and Monitoring

It’s not just about locking data down. Security controls must evolve to fit AI workflows. This includes applying least privilege access, enforcing strong encryption, and continuously monitoring model behavior. CSI makes it clear: your developers and data scientists need tailored IAM policies, not generic access.

Model Integrity and Data Provenance

The source and quality of your data directly impact the trustworthiness of your AI. Tracking data provenance—knowing where it came from, how it was processed, and how it’s used—is essential for both compliance and model integrity. As new AI governance frameworks like ISO/IEC 42001 and NIST AI RMF gain traction, this capability will be indispensable.

Defending Against AI-Specific Threats

AI brings new risks that conventional tools don’t fully address. Model inversion, adversarial attacks, and data leakage are becoming common. CSI recommends implementing defenses like differential privacy, watermarking, and adversarial testing to reduce exposure—especially in sectors dealing with personal or regulated data.

Aligning Security and Strategy

Ultimately, protecting AI data is more than a technical issue—it’s a strategic one. CSI emphasizes the need for cross-functional collaboration between security, compliance, legal, and AI teams. By embedding security from day one, organizations can reduce risk, build trust, and unlock the true value of AI—safely.

Ready to Apply CSI Guidance to Your AI Roadmap?

Don’t leave your AI initiatives exposed to unnecessary risk. Whether you’re training models on sensitive data or deploying AI in regulated environments, now is the time to embed security across the lifecycle.

At Deura InfoSec, we help organizations translate CSI and CISA guidance into practical, actionable steps—from risk assessments and data classification to securing training pipelines and ensuring compliance with ISO 42001 and NIST AI RMF.

👉 Let’s secure what matters most—your data, your trust, and your AI advantage.

Book a free 30-minute consultation to assess where you stand and map out a path forward:
📅 Schedule a Call | 📩 info@deurainfosec.com

AWS Databases for AI/ML: Architecting Intelligent Data Workflows (AWS Cloud Mastery: Building and Securing Applications)


Trust Me – ISO 42001 AI Management System

ISO/IEC 42001:2023 – from establishing to maintain an AI management system

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: Securing AI Data

Jul 07 2025

Attack Surface Management (ASM) trends for 2025

Category: API security,ASM,Cloud computing,Cyber Attack,Information Security,IoT Security — disc7 @ 3:43 pm

  1. ASM Is Evolving Into Holistic, Proactive Defense
    Attack Surface Management has grown from merely tracking exposed vulnerabilities to encompassing all digital assets—cloud systems, IoT devices, internal apps, corporate premises, and supplier infrastructure. Modern ASM solutions don’t just catalog known risks; they continuously discover new assets and alert on changes in real time. This shift from reactive to proactive defense helps organizations anticipate threats before they materialize.
  2. AI, Machine Learning & Threat Intelligence Drive Detection
    AI/ML is now foundational in ASM tools, capable of scanning vast data sets to find misconfigurations, blind spots, and chained vulnerabilities faster than human operators could. Integrated threat-intel feeds then enrich these findings, enabling contextual prioritization—your team can focus on what top adversaries are actively attacking.
  3. Zero Trust & Continuous Monitoring Are Essential
    ASM increasingly integrates with Zero Trust principles, ensuring every device, user, or connection is verified before granting access. Combined with ongoing asset monitoring—both EASM (external) and CAASM (internal)—this provides a comprehensive visibility framework. Such alignment enables security teams to detect unexpected changes or suspicious behaviors in hybrid environments.
  4. Third-Party, IoT/OT & Shadow Assets in Focus
    Attack surfaces are no longer limited to corporate servers. IoT and OT devices, along with shadow IT and third-party vendor infrastructure, are prime targets. ASM platforms now emphasize uncovering default credentials, misconfigured firmware, and regularizing access across partner ecosystems. This expanded view helps mitigate supply-chain and vendor-based risks
  5. ASM Is a Continuous Service, Not a One-Time Scan
    Today’s ASM is about ongoing exposure assessment. Whether delivered in-house or via ASM-as-a-Service, the goal is to map, monitor, validate, and remediate 24/7. Context-rich alerts backed by human-friendly dashboards empower teams to tackle the most critical risks first. While tools offer automation, the human element remains vital—security teams need to connect ASM findings to business context

In short, ASM in 2025 is about persistent, intelligent, and context-aware attack surface management spanning internal environments, cloud, IoT, and third-party ecosystems. It blends AI-powered insights, Zero Trust philosophy, and continuous monitoring to detect vulnerabilities proactively and prioritize them based on real-world threat context.

Attack Surface Management: Strategies and Techniques for Safeguarding Your Digital Assets

You’ll learn:

  • Fundamental ASM concepts, including their role in cybersecurity
  • How to assess and map your organization’s attack surface, including digital assets and vulnerabilities
  • Strategies for identifying, classifying, and prioritizing critical assets
  • Attack surfaces types, including each one’s unique security challenges
  • How to align technical vulnerabilities with business risks
  • Principles of continuous monitoring and management to maintain a robust security posture
  • Techniques for automating asset discovery, tracking, and categorization
  • Remediation strategies for addressing vulnerabilities, including patching, monitoring, isolation, and containment
  • How to integrate ASM with incident response and continuously improve cybersecurity strategies

ASM is more than a strategy—it’s a defense mechanism against growing cyber threats. This guide will help you fortify your digital defense.

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: ASM, Attack Surface Management

Jul 07 2025

Fighting Fire with Fire: How to Counter Scattered Spider’s Next-Gen Ransomware Tactics

Category: Malware,Scattered Spider — disc7 @ 10:02 am

The Scattered Spider attack marked a turning point in ransomware tactics. This wasn’t just a case of unauthorized access and lateral movement—it was a deliberate, aggressive operation where the attackers pushed back against defenders. Traditional incident response measures were met with real-time counteractions, with the adversaries reopening closed access points and actively interfering with business operations during their exit.

This attack wasn’t a warning about the future; it demonstrated that this evolved, combative approach is already here. Organizations must recognize that advanced threat actors are willing to engage in direct digital conflict, not just quietly exfiltrate data.

Among the key takeaways was how effective social engineering still is. In this case, the attackers impersonated a company CFO and successfully tricked the help desk into resetting MFA credentials. It underscored how traditional identity verification methods like voice recognition are no longer reliable.

Additionally, privileged executive accounts remain attractive targets. These accounts typically have expansive access but fewer technical restrictions, making them easy entry points for deep internal compromise. Meanwhile, poorly monitored cloud setups and virtual machines gave the attackers room to operate unseen, creating and moving through systems without endpoint detection.

Even after being detected, Scattered Spider didn’t simply retreat—they fought to maintain access, using admin-level privileges to resist eviction and extend their presence. This level of persistence signals a shift in the attacker mindset: disruption and sabotage are becoming as important as data theft.

To defend against this new breed of adversary, incident response teams must prioritize stronger identity controls, particularly around help desk functions. Executive accounts should undergo strict privilege audits, and virtual environments like VDI and ESXi must be treated as high-risk zones, monitored accordingly. Playbooks must also evolve to include strategies for dealing with hostile, entrenched attackers.

Ultimately, Scattered Spider taught us that modern threat actors aren’t just intruders—they’re saboteurs. They disrupt operations, adapt in real time, and observe our responses. Security is now a live-fire exercise, and organizations must regularly rehearse responses—not just write them down. You won’t rise to the occasion; you’ll fall to your level of preparation.

Scattered Spider

To counter an advanced adversary like Scattered Spider, you need a layered, adaptive defense strategy that blends identity security, cloud visibility, and aggressive incident response readiness. Here’s how to fight back effectively:

1. Fortify Identity Verification Processes

  • No MFA resets without strong multi-channel verification. Train your help desk to never accept identity claims at face value—use callback procedures, ID validation, or supervisor approvals.
  • Flag high-risk user changes. Automate alerts for any privilege escalations, MFA resets, or login anomalies tied to executives or IT admins.

2. Harden Executive & Admin Accounts

  • Enforce least privilege. Even C-level executives shouldn’t have standing domain-wide access. Use just-in-time access tools where possible.
  • Segment roles. Separate financial, operational, and IT privileges, so no one user holds keys to multiple kingdoms.

3. Monitor and Secure Cloud & Virtual Infrastructure

  • Audit your VDI, ESXi, and cloud assets. Look for over-permissioned accounts, open management ports, and missing endpoint agents.
  • Apply EDR/XDR visibility to all workloads. Treat virtual machines and cloud instances as part of your core infrastructure—no blind spots.

4. Build Playbooks for Adversaries Who Fight Back

  • Prepare for active resistance. Include steps for dealing with real-time counterattacks and sabotage (e.g., destroying logs, disabling EDR).
  • Use tiered containment strategies. Don’t just isolate endpoints—be ready to revoke tokens, rotate secrets, and block cloud provisioning.

5. Train for Real-World Scenarios

  • Run purple team and red team exercises. Simulate Scattered Spider-style campaigns—long dwell time, social engineering, and persistent access.
  • Include IT and help desk in rehearsals. They’re often the first point of compromise, and they need to know how to recognize and escalate social engineering attempts.

6. Enhance Detection & Logging

  • Track privilege abuse and identity shifts. Use UEBA (User and Entity Behavior Analytics) to catch lateral movement and unusual behaviors.
  • Protect logs and backups. Isolate critical logs and ensure backups are immutable and off-network, to withstand data destruction efforts.

7. Strengthen Internal Communications & Trust

  • Educate employees on tactics like impersonation. Especially finance, IT, and exec assistants.
  • Verify urgency with caution. Make it culture to pause and verify, even under pressure—Scattered Spider relies on urgency to bypass defenses.

The Ransom Republic: How Cybercriminals Hijacked the World One File at a Time

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: Scattered Spider

Jul 06 2025

Turn Compliance into Competitive Advantage with ISO 42001

Category: AI,Information Security,ISO 42001 — disc7 @ 10:49 pm

In today’s fast-evolving AI landscape, rapid innovation is accompanied by serious challenges. Organizations must grapple with ethical dilemmas, data privacy issues, and uncertain regulatory environments—all while striving to stay competitive. These complexities make it critical to approach AI development and deployment with both caution and strategy.

Despite the hurdles, AI continues to unlock major advantages. From streamlining operations to improving decision-making and generating new roles across industries, the potential is undeniable. However, realizing these benefits demands responsible and transparent management of AI technologies.

That’s where ISO/IEC 42001:2023 comes into play. This global standard introduces a structured framework for implementing Artificial Intelligence Management Systems (AIMS). It empowers organizations to approach AI development with accountability, safety, and compliance at the core.

Deura InfoSec LLC (deurainfosec.com) specializes in helping businesses align with the ISO 42001 standard. Our consulting services are designed to help organizations assess AI risks, implement strong governance structures, and comply with evolving legal and ethical requirements.

We support clients in building AI systems that are not only technically sound but also trustworthy and socially responsible. Through our tailored approach, we help you realize AI’s full potential—while minimizing its risks.

If your organization is looking to adopt AI in a secure, ethical, and future-ready way, ISO Consulting LLC is your partner. Visit Deura InfoSec to discover how our ISO 42001 consulting services can guide your AI journey.

We guide company through ISO/IEC 42001 implementation, helping them design a tailored AI Management System (AIMS) aligned with both regulatory expectations and ethical standards. Our team conduct a comprehensive risk assessment, implemented governance controls, and built processes for ongoing monitoring and accountability.

👉 Visit Deura Infosec to start your AI compliance journey.

ISO 42001—the first international standard for managing artificial intelligence. Developed for organizations that design, deploy, or oversee AI, ISO 42001 is set to become the ISO 9001 of AI: a universal framework for trustworthy, transparent, and responsible AI.


Trust Me – ISO 42001 AI Management System

ISO/IEC 42001:2023 – from establishing to maintain an AI management system

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: AIMS, ISO 42001

Jul 03 2025

Secure Your Business. Simplify Compliance. Gain Peace of Mind

Category: Information Security,NIST CSF,NIST Privacy,Security Compliance,vCISO — disc7 @ 1:56 pm

At Deura InfoSec, we help small to mid-sized businesses navigate the complex world of cybersecurity and compliance—without the confusion, cost, or delays of traditional approaches. Whether you’re facing a looming audit, need to meet ISO 27001, NIST, HIPAA, or other regulatory standards, or just want to know where your risks are—we’ve got you covered.

We offer fixed-price compliance assessments, vCISO services, and easy-to-understand risk scorecards so you know exactly where you stand and what to fix—fast. No bloated reports. No endless consulting hours. Just actionable insights that move you forward.

Our proven SGRC frameworks, automated tools, and real-world expertise help you stay audit-ready, reduce business risk, and build trust with customers.

📌 ISO 27001 | ISO 42001 | SOC 2 | HIPAA | NIST | Privacy | TPRM | M&A
📌 Risk & Gap Assessments | vCISO | Internal Audit
📌 Security Roadmaps | AI & InfoSec Governance | Awareness Training

Start with our Compliance Self-Assessment and discover how secure—and compliant—you really are.

👉 DeuraInfoSec.com – Let’s make security simple.

If you’re dealing with audits, scaling security, or just want to know how exposed your business is—we’re the no-BS partner you’ve been looking for.

✅ Big 4 experience + hands-on delivery
✅ Cyber data governance tailored to small/mid-sized orgs
✅ Practical, business-first approach to InfoSec

Next Steps: Let us prepare a customized scorecard or walk you through a free 15-minute discovery call.

Contact: info@discinfosec.com | www.discinfosec.com

Vineyard and Wineries may be at Risk

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: Deura InfoSec, DISC InfoSec, Secure Your Business

Jul 03 2025

Most Organizations Unprepared for AI-Powered Cyberattacks: Accenture Warns of Urgent Need for Proactive Security

Category: AI,Cyber Attack — disc7 @ 9:32 am

“90% aren’t ready for AI attacks, are you?”, with remediation guidance at the end:

1. Organizations are lagging in AI‑era security
A recent Accenture report warns that while AI is rapidly reshaping business operations, around 90% of organizations remain unprepared for AI‑driven cyberattacks. Alarmingly, 63% fall into what Accenture labels the “Exposed Zone”—lacking both a defined cybersecurity strategy and critical technical safeguards.

2. Threat landscape outpacing defenses
AI has increased the speed, scope, and sophistication of cyber threats far beyond what current defenses can manage. Approximately 77% of companies do not practice essential data and AI security hygiene, leaving their business models, data architectures, and cloud environments dangerously exposed.

3. Cybersecurity must be integrated into AI initiatives
Paolo Dal Cin of Accenture underscores that cybersecurity can no longer be an afterthought. Growing geopolitical instability and AI‑augmented attacks demand that security be designed into AI projects from the very beginning to maintain competitiveness and customer trust.

4. AI systems need governance and protection
Daniel Kendzior, Accenture’s global Data & AI Security lead, stresses the importance of formalizing security policies and maintaining real‑time oversight of AI systems. This includes ensuring secure AI development, deployment, and operational readiness to stay ahead of evolving threats.

5. Cyber readiness varies sharply across regions
The report reveals stark geographic differences in cybersecurity maturity. Only 14% of North American and 11% of European organizations are deemed “Reinvention Ready,” while in Latin America and the Asia‑Pacific region, over 70% remain in the “Exposed Zone,” highlighting major readiness disparities.

6. Reinvention‑Ready firms lead in resilience and trust
The top 10% of organizations—the “Reinvention Ready” group—are demonstrably more effective at defending against advanced attacks. They block threats nearly 70% more successfully, cut technical debt, improve visibility, and enhance customer trust, illustrating that maturity aligns with tangible business benefits.

Help Net Security article “90% aren’t ready for AI attacks, are you?”

🔧 Remediation Recommendations

To bridge the gap, organizations should:

  1. Build AI‑centric security governance
    • Implement accountability structures and frameworks tuned to AI risks, ensuring compliance and alignment with business goals.
  2. Incorporate security into AI design
    • Embed protections into every stage of AI system development, from data handling to model deployment and infrastructure configuration.
  3. Secure and monitor AI systems continuously
    • Regularly test AI pipelines, enforce encryption and access controls, and proactively update threat detection capabilities.
  4. Leverage AI defensively
    • Use AI to streamline security workflows—automating threat hunting, anomaly detection, and rapid response.
  5. Conduct maturity assessments by region and function
    • Benchmark cybersecurity posture across different regions and business units to identify and address vulnerabilities.
  6. Commit to education and culture change
    • Train staff on AI‑related risks and security best practices, and shift the organizational mindset to view cybersecurity as foundational rather than optional.

By adopting these measures, companies can climb into the “Reinvention Ready Zone,” significantly reducing their risk exposure and reinforcing trust in their AI‑enabled operations.

Combating Cyberattacks Targeting the AI Ecosystem: Assessing Threats, Risks, and Vulnerabilities

The Rise of AI-Driven Cyberattacks: How Companies Can Defend

ISO/IEC 42001:2023 – from establishing to maintain an AI management system

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: AI-Powered Cyberattacks, Proactive Security

Jul 02 2025

 ISO/IEC 42001:2023 – from establishing to maintain an AI management system

Category: AI — disc7 @ 12:06 pm

AI businesses are at risk due to growing cyber threats, regulatory pressure, and ethical concerns. They often process vast amounts of sensitive data, making them prime targets for breaches and data misuse. Malicious actors can exploit AI systems through model manipulation, adversarial inputs, or unauthorized access. Additionally, lack of standardized governance and compliance frameworks exposes them to legal and reputational damage. As AI adoption accelerates, so do the risks.

AI businesses are at risk because they often handle large volumes of sensitive data, rely on complex algorithms that may be vulnerable to manipulation, and operate in a rapidly evolving regulatory landscape. Threats include data breaches, model poisoning, IP theft, bias in decision-making, and misuse of AI tools by attackers. Additionally, unclear accountability and lack of standardized AI security practices increase their exposure to legal, reputational, and operational risks.

Why it matters

It matters because the integrity, security, and trustworthiness of AI systems directly impact business reputation, customer trust, and regulatory compliance. A breach or misuse of AI can lead to financial loss, legal penalties, and harm to users. As AI becomes more embedded in critical decision-making—like healthcare, finance, and security—the risks grow more severe. Ensuring responsible and secure AI isn’t just good practice—it’s essential for long-term success and societal trust.

To reduce risks in AI businesses, we can:

  1. Implement strong governance with AIMS – Define clear accountability, policies, and oversight for AI development and use.
  2. Secure data and models – Encrypt sensitive data, restrict access, and monitor for tampering or misuse.
  3. Conduct risk assessments – Regularly evaluate threats, vulnerabilities, and compliance gaps in AI systems.
  4. Ensure transparency and fairness – Use explainable AI and audit algorithms for bias or unintended consequences.
  5. Stay compliant – Align with evolving regulations like GDPR, NIST AI RMF, or the EU AI Act.
  6. Train teams – Educate employees on AI ethics, security best practices, and safe use of generative tools.

Proactive risk management builds trust, protects assets, and positions AI businesses for sustainable growth.

 ISO/IEC 42001:2023 – from establishing to maintain an AI management system (AIMS)

BSI ISO 31000 is standard for any organization seeking risk management guidance

ISO/IEC 27001 and ISO/IEC 42001, both standards address risk and management systems, but with different focuses. ISO/IEC 27001 is centered on information security—protecting data confidentiality, integrity, and availability—while ISO/IEC 42001 is the first standard designed specifically for managing artificial intelligence systems responsibly. ISO/IEC 42001 includes considerations like AI-specific risks, ethical concerns, transparency, and human oversight, which are not fully addressed in ISO 27001. Organizations working with AI should not rely solely on traditional information security controls.

While ISO/IEC 27001 remains critical for securing data, ISO/IEC 42001 complements it by addressing broader governance and accountability issues unique to AI. The article suggests that companies developing or deploying AI should integrate both standards to build trust and meet growing stakeholder and regulatory expectations. Applying ISO 42001 can help demonstrate responsible AI practices, ensure explainability, and mitigate unintended consequences, positioning organizations to lead in a more regulated AI landscape.

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: AIMS, ISO 42001, ISO/IEC 42001

Jul 02 2025

Emerging AI Security and Privacy Challenges and Risks

Category: AI,data security,Information Privacy,Information Security — disc7 @ 6:59 am

Several posts published recently discuss AI security and privacy, highlighting different perspectives and concerns. Here’s a summary of the most prominent themes and posts:

Emerging Concerns and Risks:

  • Growing Anxiety around AI Data Privacy: A recent survey found that a significant majority of Americans (91%) are concerned about social media platforms using their data to train AI models, with 69% aware of this practice.
  • AI-Powered Cyber Threats on the Rise: AI is increasingly being used to generate sophisticated phishing attacks and malware, making it harder to distinguish between legitimate and malicious content.
  • Gap between AI Adoption and Security Measures: Many organizations are quickly adopting AI but lag in implementing necessary security controls, creating a major vulnerability for data leaks and compliance issues.
  • Deepfakes and Impersonation Scams: The use of AI in creating realistic deepfakes is fueling a surge in impersonation scams, increasing privacy risks.
  • Opaque AI Models and Bias: The “black box” nature of some AI models makes it difficult to understand how they make decisions, raising concerns about potential bias and discrimination. 

Regulatory Developments:

  • Increasing Regulatory Scrutiny: Governments worldwide are focusing on regulating AI, with the EU AI Act setting a risk-based framework and China implementing comprehensive regulations for generative AI.
  • Focus on Data Privacy and User Consent: New regulations emphasize data minimization, purpose limitation, explicit user consent for data collection and processing, and requirements for data deletion upon request. 

Best Practices and Mitigation Strategies:

  • Robust Data Governance: Organizations must establish clear data governance frameworks, including data inventories, provenance tracking, and access controls.
  • Privacy by Design: Integrating privacy considerations from the initial stages of AI system development is crucial.
  • Utilizing Privacy-Preserving Techniques: Employing techniques like differential privacy, federated learning, and synthetic data generation can enhance data protection.
  • Continuous Monitoring and Threat Detection: Implementing tools for continuous monitoring, anomaly detection, and security audits helps identify and address potential threats.
  • Employee Training: Educating employees about AI-specific privacy risks and best practices is essential for building a security-conscious culture. 

Specific Mentions:

  • NSA’s CSI Guidance: The National Security Agency (NSA) released joint guidance on AI data security, outlining best practices for organizations.
  • Stanford’s 2025 AI Index Report: This report highlighted a significant increase in AI-related privacy and security incidents, emphasizing the need for stronger governance frameworks.
  • DeepSeek AI App Risks: Experts raised concerns about the DeepSeek AI app, citing potential security and privacy vulnerabilities. 

Based on current trends and recent articles, it’s evident that AI security and privacy are top-of-mind concerns for individuals, organizations, and governments alike. The focus is on implementing strong data governance, adopting privacy-preserving techniques, and adapting to evolving regulatory landscapes. 

The rapid rise of AI has introduced new cyber threats, as bad actors increasingly exploit AI tools to enhance phishing, social engineering, and malware attacks. Generative AI makes it easier to craft convincing deepfakes, automate hacking tasks, and create realistic fake identities at scale. At the same time, the use of AI in security tools also raises concerns about overreliance and potential vulnerabilities in AI models themselves. As AI capabilities grow, so does the urgency for organizations to strengthen AI governance, improve employee awareness, and adapt cybersecurity strategies to meet these evolving risks.

There is a lack of comprehensive federal security and privacy regulations in the U.S., but violations of international standards often lead to substantial penalties abroad for U.S. organizations. Penalties imposed abroad effectively become a cost of doing business for U.S. organizations.

Meta has faced dozens of fines and settlements across multiple jurisdictions, with at least a dozen significant penalties totaling tens of billions of dollars/euros cumulatively.

Artificial intelligence (AI) and large language models (LLMs) emerging as the top concern for security leaders. For the first time, AI, including tools such as LLMs, has overtaken ransomware as the most pressing issue.

AI-Driven Security: Enhancing Large Language Models and Cybersecurity: Large Language Models (LLMs) Security

AI Security Essentials: Strategies for Securing Artificial Intelligence Systems with the NIST AI Risk Management Framework (Artificial Intelligence (AI) Security)

ISO 42001 Readiness: A 10-Step Guide to Responsible AI Governance

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: AI privacy, AI Security Essentials, AI Security Risks, AI-Driven Security

Jul 01 2025

The NIST Gap Assessment Tool will cost-effectively assess your organization against the NIST SP 800-171 standard

Category: Information Security,NIST CSF,Security Tools — disc7 @ 1:49 pm

The NIST Gap Assessment Tool is a structured resource—typically a checklist, questionnaire, or software tool—used to evaluate an organization’s current cybersecurity or risk management posture against a specific NIST framework. The goal is to identify gaps between existing practices and the standards outlined by NIST, so organizations can plan and prioritize improvements.

The NIST SP 800-171 standard is primarily used by non-federal organizations—especially contractors and subcontractors—that handle Controlled Unclassified Information (CUI) on behalf of the U.S. federal government.

Specifically, it’s used by:

  1. Defense Contractors – working with the Department of Defense (DoD).
  2. Contractors/Subcontractors – serving other civilian federal agencies (e.g., DOE, DHS, GSA).
  3. Universities & Research Institutions – receiving federal research grants and handling CUI.
  4. IT Service Providers – managing federal data in cloud, software, or managed service environments.
  5. Manufacturers & Suppliers – in the Defense Industrial Base (DIB) who process CUI in any digital or physical format.

Why it matters:

Compliance with NIST 800-171 is required under DFARS 252.204-7012 for DoD contractors and is becoming a baseline for other federal supply chains. Organizations must implement the 110 security controls outlined in NIST 800-171 to protect the confidentiality of CUI.

✅ NIST 800-171 Compliance Checklist

1. Access Control (AC)

  • Limit system access to authorized users.
  • Separate duties of users to reduce risk.
  • Control remote and internal access to CUI.
  • Manage session timeout and lock settings.

2. Awareness & Training (AT)

  • Train users on security risks and responsibilities.
  • Provide CUI handling training.
  • Update training regularly.

3. Audit & Accountability (AU)

  • Generate audit logs for events.
  • Protect audit logs from modification.
  • Review and analyze logs regularly.

4. Configuration Management (CM)

  • Establish baseline configurations.
  • Control changes to systems.
  • Implement least functionality principle.

5. Identification & Authentication (IA)

  • Use unique IDs for users.
  • Enforce strong password policies.
  • Implement multifactor authentication.

6. Incident Response (IR)

  • Establish an incident response plan.
  • Detect, report, and track incidents.
  • Conduct incident response training and testing.

7. Maintenance (MA)

  • Perform system maintenance securely.
  • Control and monitor maintenance tools and activities.

8. Media Protection (MP)

  • Protect and label CUI on media.
  • Sanitize or destroy media before disposal.
  • Restrict media access and transfer.

9. Physical Protection (PE)

  • Limit physical access to systems and facilities.
  • Escort visitors and monitor physical areas.
  • Protect physical entry points.

10. Personnel Security (PS)

  • Screen individuals prior to system access.
  • Ensure CUI access is revoked upon termination.

11. Risk Assessment (RA)

  • Conduct regular risk assessments.
  • Identify and evaluate vulnerabilities.
  • Document risk mitigation strategies.

12. Security Assessment (CA)

  • Develop and maintain security plans.
  • Conduct periodic security assessments.
  • Monitor and remediate control effectiveness.

13. System & Communications Protection (SC)

  • Protect CUI during transmission.
  • Separate system components handling CUI.
  • Implement boundary protections (e.g., firewalls).

14. System & Information Integrity (SI)

  • Monitor systems for malicious code.
  • Apply security patches promptly.
  • Report and correct flaws quickly.

The NIST Gap Assessment Toolkit will cost-effectively assess your organization against the NIST SP 800-171 standard. It will help you to:

  • Understand the NIST SP 800-171 requirements for storing, processing, and transmitting CUI (Controlled Unclassified Information)
  • Quickly identify your NIST SP 800-171 compliance gaps
  • Plan and prioritise your NIST SP 800-171 project to ensure data handling meets U.S. DoD (Department of Defense) requirements

NIST 800-171: System Security Plan (SSP) Template & Workbook

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: NIST Gap Assessment Tool, NIST SP 800-171

Jul 01 2025

ISO 42001 Readiness: A 10-Step Guide to Responsible AI Governance

Category: AI,ISO 27k,ISO 42001 — disc7 @ 10:51 am

The ISO 42001 readiness checklist structured into ten key sections, followed by my feedback at the end:

1. Context & Scope
Identify internal and external factors affecting AI use, clarify stakeholder requirements, and define the scope of your AI Management System (AIMS)

2. Leadership & Governance
Secure executive sponsorship, assign AIMS responsibilities, establish an ethics‐driven AI policy, and communicate roles and accountability clearly

3. Planning
Perform a gap analysis to benchmark current state, conduct a risk and opportunity assessment, set measurable AI objectives, and integrate risk practices throughout the AI lifecycle.

4. Support & Resources
Dedicate resources for AIMS, create training around AI ethics, safety, and governance, raise awareness, establish communication protocols, and maintain documentation.

5. Operational Controls
Outline stages of the AI lifecycle (design to monitoring), conduct risk assessments (bias, safety, legal), ensure transparency and explainability, maintain data quality and privacy, and implement incident response.

6. Change Management
Implement structured change control—assessing proposed AI modifications, conducting ethical and feasibility reviews, cross‐functional governance, staged rollouts, and post‐implementation audits.

7. Performance Evaluation
Monitor AIMS effectiveness using KPIs, conduct internal audits, and hold management reviews to validate performance and compliance.

8. Nonconformity & Corrective Action
Identify and document nonconformities, implement corrective measures, review their efficacy, and update the AIMS accordingly.

9. Certification Preparation
Collect evidence for internal audits, address gaps, assemble required documentation (including SoA), choose an accredited certification body, and finalize pre‐audit preparations .

10. External Audit & Continuous Improvement
Engage auditors, facilitate assessments, resolve audit findings, publicly share certification results, and embed continuous improvement in AIMS operations.

📝 Feedback

  • Comprehensive but heavy: The checklist covers every facet of AI governance—from initial scoping and leadership engagement to external audits and continuous improvement.
  • Aligns well with ISO 27001: Many controls are familiar to ISMS practitioners, making ISO 42001 a viable extension.
  • Resource-intensive: Expect demands on personnel, training, documentation, and executive involvement.
  • Change management focus is smart: The dedication to handling AI updates (design, rollout, monitoring) is a notable strength.
  • Documentation is key: Templates like Statement of Applicability and impact assessment forms (e.g., AISIA) significantly streamline preparation.
  • Recommendation: Prioritize gap analysis early, leverage existing ISMS frameworks, and allocate clear roles—this positions you well for a smooth transition to certification readiness.

Overall, ISO 42001 readiness is achievable by taking a methodical, risk-based, and well-resourced approach. Let me know if you’d like templates or help mapping this to your current ISMS.

AI Act & ISO 42001 Gap Analysis Tool

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: ISO 42001 Readiness

Jun 30 2025

Why AI agents could be the next insider threat

Category: AI,Risk Assessment,Security Risk Assessment — disc7 @ 5:11 pm

1. Invisible, Over‑Privileged Agents
Help Net Security highlights how AI agents—autonomous software acting on behalf of users—are increasingly embedded in enterprise systems without proper oversight. They often receive excessive permissions, operate unnoticed, and remain outside traditional identity governance controls

2. Critical Risks in Healthcare
Arun Shrestha from BeyondID emphasizes the healthcare sector’s vulnerability. AI agents there handle Protected Health Information (PHI) and system access, increasing risks to patient privacy, safety, and regulatory compliance (e.g., HIPAA)

3. Identity Blind Spots
Research shows many firms lack clarity about which AI agents have access to critical systems. AI agents can impersonate users or take unauthorized actions—yet these “non‑human identities” are seldom treated as significant security threats.

4. Growing Threat from Impersonation
TechRepublic’s data indicates only roughly 30% of US organizations map AI agent access, and 37% express concern over agents posing as users. In healthcare, up to 61% report experiencing attacks involving AI agents

5. Five Mitigation Steps
Shrestha outlines five key defenses: (1) inventory AI agents, (2) enforce least privilege, (3) monitor their actions, (4) integrate them into identity governance processes, and (5) establish human oversight—ensuring no agent operates unchecked.

6. Broader Context
This video builds on earlier insights about securing agentic AI, such as monitoring, prompt‑injection protection, and privilege scoping. The core call: treat AI agents like any high-risk insider.

📝 Feedback (7th paragraph):
This adeptly brings attention to a critical and often overlooked risk: AI agents as non‑human insiders. The healthcare case strengthens the urgency, yet adding quantitative data—such as what percentage of enterprises currently enforce least privilege on agents—would provide stronger impact. Explaining how to align these steps with existing frameworks like ISO 27001 or NIST would add practical value. Overall, it raises awareness and offers actionable controls, but would benefit from deeper technical guidance and benchmarks to empower concrete implementation.

Source Help Net security: Why AI agents could be the next insider threat

Agentic AI: Navigating Risks and Security Challenges

Artificial Intelligence: The Next Battlefield in Cybersecurity

AI and The Future of Cybersecurity: Navigating the New Digital Battlefield

“Whether you’re a technology professional, policymaker, academic, or simply a curious reader, this book will arm you with the knowledge to navigate the complex intersection of AI, security, and society.”

AI Governance Is a Boardroom Imperative—The SEC Just Raised the Stakes on AI Hype

How AI Is Transforming the Cybersecurity Leadership Playbook

Previous AI posts

IBM’s model-routing approach

Top 5 AI-Powered Scams to Watch Out for in 2025

Summary of CISO 3.0: Leading AI Governance and Security in the Boardroom

AI in the Workplace: Replacing Tasks, Not People

Why CISOs Must Prioritize Data Provenance in AI Governance

Interpretation of Ethical AI Deployment under the EU AI Act

AI Governance: Applying AI Policy and Ethics through Principles and Assessments

ISO/IEC 42001:2023, First Edition: Information technology – Artificial intelligence – Management system

ISO 42001 Artificial Intelligence Management Systems (AIMS) Implementation Guide: AIMS Framework | AI Security Standards

Businesses leveraging AI should prepare now for a future of increasing regulation.

Digital Ethics in the Age of AI 

DISC InfoSec’s earlier posts on the AI topic

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: AI Agents, Insider Threat

Next Page »