Every company is shipping AI features. Far fewer can answer a basic question: where is AI running in our environment, what data can it touch, and what happens when someone feeds it a malicious prompt? That gap is the new attack surface — and it opened faster than most security programs could react.
This is a practical checklist for closing it. It's organized around the five risks we see most often in production AI systems, each paired with concrete controls you can actually work through. It's vendor-neutral: nothing here requires a specific product, and most of it is the security fundamentals you already know, applied to a system that now talks back and takes actions. Where relevant, we map to the OWASP Top 10 for LLM Applications, the closest thing the field has to a shared reference.
The AI attack surface, in one view
Before the checklist, a mental model. Traditional apps take data in and return data out. AI systems insert a model in the middle that interprets untrusted input as instructions, reaches into your data to answer, and — increasingly — calls tools and takes actions on your behalf. Each of those is a control point.
1. Shadow AI — you can't protect what you can't see
The risk: Teams wire up LLM APIs, copilots, and agents without telling security. There's no inventory, so there's no program — just unknown integrations quietly moving your data to third parties.
The checklist:
- ▢ Maintain an inventory of every AI feature, model, and LLM API integration — treated like any other production asset.
- ▢ Record, for each: what data it receives, which provider it calls, and who owns it.
- ▢ Establish an intake path so new AI use cases are reviewed before launch, not discovered after.
- ▢ Scan code and cloud accounts for AI SDKs and API keys to catch what didn't come through intake.
2. Prompt injection — treat all model input as untrusted
The risk: The #1 entry on the OWASP LLM list. Untrusted content — a web page, a PDF, an email, a support ticket — carries hidden instructions that hijack the model into ignoring its rules, leaking data, or taking unintended actions.
The checklist:
- ▢ Separate trusted instructions (your system prompt) from untrusted data (anything a user or document supplies).
- ▢ Constrain what the model is allowed to do — least functionality, not just least privilege.
- ▢ Never let raw model output trigger a sensitive action (a purchase, an email, a database write) without a validation or human-in-the-loop step.
- ▢ Sanitize and label external content the model ingests, especially in retrieval (RAG) pipelines.
- ▢ Red-team your prompts adversarially before launch — try to break your own guardrails.
3. Data leakage — govern the whole data path
The risk: Sensitive data flows into prompts, embeddings, logs, and third-party APIs — and sometimes back out to the wrong user. The model becomes an unintended data-exfiltration channel.
The checklist:
- ▢ Classify what data is allowed into a prompt or embedding, and enforce it.
- ▢ Redact secrets and PII before they reach the model or its logs.
- ▢ Know and document each provider's data-retention and training-use policy; disable training-on-your-data where possible.
- ▢ Scope model responses to the requesting user's own authorization — retrieval must respect access control, or one user's query returns another's data.
- ▢ Treat prompt and completion logs as sensitive data, with the same access controls and retention limits.
4. Over-permissioned agents — least privilege for machines too
The risk: AI agents are getting real credentials and real actions — often with far broader access than they need. An agent with admin rights is a breach waiting for a bad prompt, because prompt injection plus excessive permissions equals real-world impact.
The checklist:
- ▢ Give each agent its own scoped identity — never a shared or human user's credentials.
- ▢ Grant the minimum permissions the task requires, and nothing broader "just in case."
- ▢ Log every action an agent takes, attributable to that agent, and monitor for anomalies.
- ▢ Put high-impact actions behind explicit approval rather than letting an agent execute them autonomously.
- ▢ Set spending and rate limits so a hijacked or looping agent can't run away.
5. The model supply chain — know what you're running
The risk: Open-weight models, datasets, and ML dependencies are pulled from public hubs with little scrutiny. A poisoned model or a malicious package inherits all the trust you place in the system it runs in.
The checklist:
- ▢ Build an AI SBOM — track the provenance of every model, dataset, and ML dependency you ship.
- ▢ Pull models and packages from trusted, verified sources; pin versions and verify integrity.
- ▢ Scan ML dependencies for known vulnerabilities and malicious packages, as you would any software supply chain.
- ▢ Vet third-party AI vendors on their own security posture before you route data through them.
Where to start: the first 30 days
You don't need to do all of this at once. If you're starting from zero, the highest-leverage sequence is:
- Week 1 — See it. Build the AI inventory (risk #1). Everything else depends on knowing what you have.
- Week 2 — Scope it. Review agent and integration permissions (risk #4). Cut the obvious over-provisioning.
- Weeks 3–4 — Test it. Red-team your highest-exposure AI feature for prompt injection and data leakage (risks #2 and #3) before an attacker does.
The through-line
AI security isn't a new discipline bolted on the side. It's asset inventory, least privilege, data governance, and supply-chain hygiene — the fundamentals — applied to a system that interprets untrusted input and takes actions. The organizations getting this right aren't the ones with the fanciest models. They're the ones who can see their AI, scope it, and test it.
For related reading on prioritizing what actually matters, see our guides on how the cloud security categories fit together and attack path analysis — the same "context over checklist-length" thinking applies to securing AI.