AI security questions
across teams
Different teams use AI in different ways. The same questions about untrusted input, permissions, and data exposure follow them.
Developer Teams
Inspect AI application behavior
A customer-facing AI application may read untrusted content, call tools, and handle sensitive data. Developer teams need to know where those paths cross a trust boundary and how the application behaves when they do.
Entry points
Identify where user input, retrieved content, and tool results enter the application.
Runtime inspection
Examine suspicious instructions and sensitive data as interactions move through the workflow.
Adversarial tests
Record the setup and observable result when a test input tries to redirect the application.
Legal Teams
Review Data Exposure
Legal teams may need to understand where personal information or confidential material enters an AI workflow, and where it could leave. Security findings can inform that review.
Personal Data
Examine where names, contact details, or other personal information may be exposed.
Compliance Review
Use security findings to inform your team's review of data handling obligations.
Confidential Material
Assess how proprietary code or business information could be disclosed through AI outputs.
Marketing Teams
Review AI content workflows
Marketing teams increasingly use applications that retrieve outside material and generate content. Those workflows can carry hidden instructions or expose information from connected systems.
Outside sources
Identify which pages, documents, or feeds the application treats as input.
Instruction boundaries
Test whether source material can redirect the intended task or alter the output.
Data exposure
Check whether connected documents or accounts can be disclosed through generated responses.
General Teams
Understand AI access and data flows
Teams using AI across an organization need to know which information an application can read, which actions it can take, and where authorization is checked.
Application inventory
Identify the AI workflows in use and the data and tools connected to each one.
Permission review
Examine whether an agent can take actions beyond the task a user authorized.
Testable boundaries
Use defined scenarios to check where instructions, permissions, and sensitive data meet.