AI SECURITY RESOURCES FROM ACUVITYAI Security
Resources Hub

AI security is the discipline of protecting artificial-intelligence systems — including models, agents, connectors, tools, and runtime execution flows — from misuse, malfunction, unauthorized access, or adversarial invocation. It extends beyond traditional cyber controls by addressing novel vectors such as prompt-injection, tool-call chains in agentic systems, unsanctioned model usage, and context manipulation during live AI operations.

Key elements of AI security include:

• Agent and tool-chain security: In systems where agents use external tools or services (for example invoking a document retrieval system, writing to databases, or orchestrating other agents) the security surface expands to include the entire call graph — permissions on tool invocation, identity of the agent, policy on tool results, chaining control and audit.

• Runtime inspection and enforcement: AI security requires visibility into inputs, context, model invocation, agent workflows, tool interactions, and outputs — all in real time — and enforcement of policy at those points (blocking, sanitizing, approval gates). Without runtime controls, risks persist even if design-time controls exist.

• Lifecycle management: From model training and fine-tuning, through deployment, to retirement, AI security demands controls on data provenance, model integrity, versioning, drift monitoring, adversarial testing, access control, and audit logging.

• Governance, trust and compliance: As defined in Gartner’s AI TRiSM (Artificial Intelligence Trust, Risk and Security Management) framework, AI security aligns with governance (visibility, accountability), risk and security management (model robustness, data protection, adversarial resistance), and runtime inspection & enforcement as one of the core layers.

• Emerging threats specific to AI: These include agentic systems acting autonomously, tools being misused through model-calls, prompt and context attacks (e.g., injection, jailbreak), hidden agent workflows performing unmonitored actions, and unsanctioned “Shadow AI” systems operating outside enterprise controls.