Navigating AI Security and Compliance

As AI systems evolve from simple client-server models into agentic, multimodal architectures, securing them requires specialized frameworks. While traditional cybersecurity focuses on network and endpoint perimeters, AI introduces unique vulnerabilities in how data is processed, models are trained, and prompts are interpreted. To understand and defend against these risks, security teams rely on frameworks like MITRE ATT&CK, MITRE ATLAS, and the Cloud Security Alliance’s AI Controls Matrix (CSA AICM).

MITRE ATLAS v MITRE ATT&CK

 is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. It is traditionally used as the foundation for threat modeling across general Enterprise, Mobile, and Industrial Control Systems (ICS). It focuses broadly on how attackers infiltrate and move laterally across standard IT infrastructure.

MITRE ATLAS (Adversarial Threat Landscape for AI Systems), on the other hand, is specifically tailored to artificial intelligence. While ATT&CK looks at general enterprise threats, ATLAS focuses heavily on the "kill chain" of how attackers move within and manipulate AI-specific components. It categorizes attack techniques unique to Adversarial Machine Learning (AML).

ATLAS-Specific Controls and Attack Vectors

MITRE ATLAS outlines several AI-specific attack vectors that target the interaction, retrieval, logic, and execution layers of an AI system:

• Indirect Prompt Injection (MITRE AML.T0051.001): Attackers hide malicious commands in external sources (like a website, email, or shipping note) that the AI reads, causing the AI to execute the hidden instruction when it processes the data.

• RAG Poisoning (MITRE ATLAS): Adversaries corrupt the external knowledge bases that an AI uses for Retrieval-Augmented Generation (RAG). For example, uploading a fake "Product Manual" containing a universal discount code to a public forum so the AI ingests it and shares the code with users.

• Model Extraction (MITRE AML.T0012): Attackers send massive volumes of queries to a model to reverse-engineer its proprietary logic and fine-tuning weights, effectively stealing the model to create a free copycat.

• LLM Plugin / Tool Hijacking (MITRE AML.T0057): Attackers compromise third-party plugins (like a weather API) that the AI uses to access the internet, sending malicious instructions back through the plugin for the AI to execute on the host’s internal network.

Mapping the CSA AICM to AI Threats

The Cloud Security Alliance’s AI Controls Matrix (AICM) provides actionable security controls designed to mitigate the threats identified by MITRE ATLAS across the AI lifecycle. The AICM maps directly to these vulnerabilities through specific control families:

• Defending the Prompt Layer: To combat Indirect Prompt Injection, the AICM proposes the Prompt Injection Defense (DSP-25) control. Additionally, it uses Application & Interface Security controls like Input Validation (AIS-08) and Output Validation (AIS-09) to filter out adversarial patterns, and Prompt Differentiation (AIS-15) to ensure the model can explicitly distinguish between user input and system instructions.

• Protecting the Data & RAG Layer: To mitigate RAG Poisoning and corrupted training sets, the AICM relies on Data Poisoning Prevention & Detection (DSP-21) and Data Integrity Checks (DSP-23) to monitor for unauthorized modifications.

• Securing the Model: To prevent Model Extraction and similar logic attacks, the AICM emphasizes Adversarial Attack Analysis (MDS-06) and Model Hardening (MDS-07). It also proposes Model Inversion & Membership Inference Protection (DSP-26) to prevent attackers from reconstructing sensitive training data from model outputs.

• Securing the System & Plugins: To stop Tool Hijacking and unauthorized execution, the AICM mandates AI Sandboxing (AIS-13), which forces AI tools and plugins to execute in isolated environments, preventing unintended interactions with critical backend systems and limiting lateral movement.

How to Mitigate AI Security Risks

Mitigating these complex threats requires treating AI data security as lifecycle engineering—mapping safeguards to every phase of development rather than relying solely on perimeter defenses. Organizations should implement a "Defense-in-Depth" strategy encompassing the following tactics:

• Instruction Hierarchy: Explicitly tag system-level instructions as a higher priority than user inputs to prevent attackers from successfully executing direct or indirect prompt injections.

• Human-in-the-Loop: Prevent "Excessive Agency" by requiring a human to explicitly approve any high-impact actions the AI attempts to take, such as changing a delivery address or processing a refund.

• Output Sanitization: Never blindly trust AI-generated code or text. Always treat it as untrusted and use standard web sanitization libraries before rendering it in a UI to prevent attacks like Cross-Site Scripting (XSS).

• Monitoring & Guardrails: Deploy independent "Guardrail" models (such as Llama Guard) to actively inspect incoming prompts and outgoing responses for malicious intent or policy violations.