Security — Charter
What security owns in an AI-operated company — posture, incident response, and the attack surface that only exists because AI systems can read untrusted content and take actions.
Security's job is unchanged in principle: keep systems and data available, correct and private against people actively trying otherwise. What changes in an AI-operated company is the surface — you now run systems that read untrusted content and can act on it, which is a combination security has not had to reason about before.
What this role owns#
Posture. Controls actually in place, evidenced, not aspirational.
Access. Who can reach what, reviewed rather than assumed.
Incident response. Detection, containment, communication, and the record afterwards.
Third-party risk. Suppliers, and now also model providers and MCP servers — an AI integration from the internet is a dependency running with whatever access you grant it.
AI-specific security. The category below, which does not belong to Engineering by default and falls between roles if not assigned here.
KPIs#
| Measure | Why this one |
|---|---|
| MFA coverage | The single control that defeats the most common attack |
| Time to patch criticals | The window between disclosure and mass exploitation is now days |
| Access review completeness | Share of systems reviewed in the last quarter |
| Backup restore test recency | A backup is unproven until restored |
| Mean time to detect | If long, everything downstream is worse |
| AI tool inventory coverage | Share of AI systems with a named owner and a declared tool list |
| Findings closed within SLA | Open findings are accepted risk, whether or not anyone accepted them |
The AI attack surface#
The part that is genuinely new. Reference material: the OWASP Top 10 for LLM Applications (2025) and the OWASP Top 10 for Agentic Applications (2026).
Prompt injection. Hostile instructions inside content the model reads. Not solvable by better prompts — contained by architecture: narrow tools, human approval on consequential actions, and never one component holding both broad read and broad write access.
Agent goal hijacking. The agentic version, where the consequence is actions taken rather than text produced.
Tool misuse. A legitimate tool used for an unintended purpose. The tool worked; the grant was too wide.
Memory and context poisoning. False information written into an agent's memory and treated as fact on every later run. It persists after the original input is gone and is invisible unless someone inspects stored context.
Excessive agency. Systems granted more capability than the task needs — the most common design failure, because it is easier to grant broadly than to enumerate narrowly.
Shadow AI. Staff pasting company data into consumer AI tools. A ban does not stop it; it makes it invisible. Provide an approved tool with terms that exclude training on your data.
AI agents in this function#
Log anomaly agent — surfaces unusual authentication and access patterns. Read-only.
Vulnerability triage agent — correlates advisories against your actual inventory, so the queue is what affects you rather than everything published.
Access review assistant — assembles who has what, highlights dormant accounts and privilege accumulation. A human approves every revocation.
Phishing analysis agent — triages reported messages.
What stays human: incident declaration, containment decisions that disconnect systems, accepting a risk, and anything touching credentials. An agent with the power to revoke access is also an agent an attacker would love to reach.
SOPs#
- Access provisioning and revocation — same-day off-boarding, no exceptions.
- Patching — criticals within a defined window; a record when that window is missed.
- Incident response — declare, contain, communicate, record. Named decision-maker with authority to disconnect, and a contact list that does not live on the systems that may be down.
- Out-of-band verification — any payment change or credential request confirmed on a channel the requester did not choose. This one control prevents a whole category of loss.
- AI system registration — before anything goes live: owner, declared tools, permissions, what it can and cannot decide.
- Quarterly access review and quarterly restore test.
Templates#
Security Checklist — includes the model-layer, agent-layer and governance sections · Incident Report · access review record.
Depth in Cyber Security and AI Agents.
Workflows#
In: alerts · vulnerability advisories · reported phishing · new system registrations · supplier assessments.
Out: findings with owners and dates · incident reports · access decisions · go/no-go on security grounds.
Handoffs: Engineering for fixes · DevOps for infrastructure controls · Legal and Compliance for anything notifiable · CEO for incident declaration above a threshold.
FAQ#
Does AI make us more or less secure?#
Both. It improves detection and triage, and it introduces an attack surface that did not exist — systems that read untrusted input and take actions. The net depends almost entirely on whether tool permissions were designed narrowly.
Can we just block staff from using AI tools?#
You can, and they will use personal accounts instead, which is worse because you cannot see it. Provide an approved tool with appropriate terms and say clearly what may and may not go into it.
What is the single highest-value control?#
Multi-factor authentication on email first. Stolen credentials remain the most common way in, and email resets every other password you own.
How do we secure an AI agent?#
By what you let it do, not by what you tell it. Narrow tools, the requesting user's permissions rather than a service account, human approval on anything destructive or outbound, hard step and spend caps, and a log of every tool call.
What else is coming for Security
Charter Ready
What this department owns and is accountable for.
KPIs Not yet
The numbers it is judged on.
AI Agents Not yet
What is automated, and what stays human.
SOPs Not yet
How the recurring work is done.
Templates Not yet
The documents it produces.
Workflows Not yet
How work enters, moves and leaves.