A Practical AI Security Checklist
Discover shadow AI in use, provide sanctioned alternatives, enforce least-privilege access with audit trails, classify and block sensitive data, verify high-stakes requests out of band, and use AI defensively, which cuts breach cost $1.9M and lifecycle 80 days.
The checklist
Six moves, in order: discover, provide, control access, classify data, verify out of band, and defend with AI. Each maps directly to a documented breach driver or defense.
- Discover, inventory the AI tools already in use, sanctioned or not.
- Provide, offer sanctioned, enterprise-grade tools easier than the risky ones.
- Control access, least-privilege, role-based, fully logged.
- Classify, define sensitive data that must never reach external models, and block it.
- Verify, confirm high-stakes requests through a separate channel to defeat deepfakes.
- Defend, use AI and automation in security to cut breach cost and lifecycle.
Governance is the glue
A written AI governance policy ties the controls together and is exactly what 63% of breached organizations lacked. Without it, the technical controls drift and accountability disappears.
Technical controls without a governing policy erode; a policy without technical enforcement is ignored. The organizations that avoid the $670K shadow-AI penalty do both, and turn security maturity into a measurable financial edge.
Frequently asked questions.
Where should a small business start with AI security?
Start with discovery and sanctioned tools: find what AI is already in use, then provide a safe, easy alternative and classify the data that must stay out of public models. Those two moves remove most shadow-AI risk before you invest in heavier controls.