Checklist · Draft

The Business Checklist: Securing AI at Work

Draft by alkizz

Most AI security advice is either a 90-page framework or a warning about the robots coming for us. This is neither. It's a list of things you can check this week.

Each item has a why (one line) and a how (the quick version). The robot uprising is not on the list.

This one is for businesses and CISOs. Running agents on your own hardware? See The Builder's Checklist.

Your employees are already using AI. The question is whether you know which tools, with which data, and with what permissions. None of this needs a new committee.

1. Inventory the AI you already have, including the shadow stuff.

• Why: You can't govern what you can't see, and "we haven't approved any AI" usually means "we don't know which AI."
• How: Pull SaaS/OAuth grants, CASB or proxy logs, and expense reports for AI tools. Then ask teams directly, with amnesty. You'll get better answers that way.

2. Fix permissions before you turn on the copilot.

• Why: Enterprise copilots surface whatever the user can technically access, so years of "Everyone" sharing links are now one question away.
• How: Run an oversharing review on SharePoint/Drive/Teams, apply sensitivity labels to the crown jewels, and pilot with a small group before a tenant-wide rollout.

3. Treat inbound email and documents as prompt-injection vectors.

• Why: EchoLeak (CVE-2025-32711) showed a single crafted email could get Microsoft 365 Copilot to exfiltrate internal data with zero clicks. Microsoft patched it server-side, but the class of bug didn't go away.
• How: Ask every AI vendor how they separate untrusted external content from internal data, and limit which external sources copilots and agents can ingest by default.

4. Give people an approved tool that's actually good.

• Why: Banning AI tools without offering an alternative just pushes usage underground (see item 1).
• How: License an enterprise tier with no-training-on-your-data terms, SSO, and admin logging, and make it easier to use than the free one.

5. Write a one-page acceptable-use policy.

• Why: People need to know what's allowed, and a 40-page policy is a policy nobody reads.
• How: Cover what data can go where (public / internal / never), which tools are approved, and that a human owns any AI output that ships. One page. Review it twice a year.

6. Add AI questions to third-party risk reviews.

• Why: Your vendors are quietly adding AI features to products you already approved.
• How: Ask: Is our data used for training? Where's it processed and retained? Which sub-processors/model providers? How do you handle prompt injection? Can we turn the AI features off? Get the answers in the contract, not just the sales deck.

7. Control agent and plugin installs like any other software.

• Why: MCP servers, browser extensions, and copilot plugins run with real access. Supply chain risk is LLM03:2025 and ASI04 in the OWASP Top 10 for Agentic Applications.
• How: Maintain an allowlist of approved connectors/MCP servers, require review for anything touching email, files, or code, and pin versions in managed configs.

8. Give agents their own identities with least privilege.

• Why: An agent running on a human's full credentials turns one prompt injection into that person's whole access.
• How: Separate service identities per agent, scoped and short-lived tokens, and human approval for high-impact actions (payments, external sends, permission changes).

9. Make high-risk requests deepfake-proof with process, not detection.

• Why: Arup lost about $25 million after an employee joined a video call with deepfaked versions of the CFO and colleagues.
• How: Out-of-band callback to a known number for wire transfers, vendor bank changes, and credential resets, no matter how convincing the face on the screen looks. Add a code-word or dual-approval for large amounts.

10. Update phishing training for AI-written lures.

• Why: Attackers use AI too, and "look for typos" is retired advice.
• How: Train on context instead of grammar: urgency, secrecy, payment changes, unusual channels. Include voice and video impersonation scenarios in exercises.

11. Log and monitor AI usage like any other system.

• Why: If an agent or copilot leaks data, you'll want the prompts, retrievals, and tool calls.
• How: Turn on audit logging in your AI platforms, send it to your SIEM, and alert on bulk data access or unusual external sends from AI identities.

12. Pick a framework, then use only the parts you need.

• Why: Governance should help people move faster, safely.
• How: Map your controls to the NIST AI RMF and the OWASP LLM Top 10, assign one owner, and review quarterly. Done is better than a committee.

🧰 If You Only Do Five

1. Inventory the AI you already have. Including the shadow stuff, with amnesty. (Item 1)
2. Fix permissions before you turn on the copilot. Oversharing review and sensitivity labels first. (Item 2)
3. Control agent and plugin installs. Allowlist connectors/MCP servers, pin versions. (Item 7)
4. Give agents their own least-privilege identities. Scoped, short-lived tokens, a human approves high-impact actions. (Item 8)
5. Verify money and access requests out-of-band. A callback to a known number beats any deepfake detector. (Item 9)

The Closer

None of this is exotic. It's least privilege, patching, egress control, supply chain hygiene, and "call them back before you wire the money," applied to a new kind of software that happens to take instructions from anything it reads. The models will keep getting better. The basics will keep mattering more.

Start with the five. Then come back for the rest. And for the people building and running agents themselves, there's The Builder's Checklist.