No one seems to have a good, comprehensive security framework for AI – at least, not one that has enough detail to address the fear that keeps security teams up at night, thinking “What am I missing about securing AI that is going to bite me later?”
As an active member of Microsoft Intelligent Security Association and Microsoft’s Inner Circle for AI Business Solutions, backed by 5 Microsoft awards across security, compliance, and social impact, Cyclotron is uniquely positioned to answer that question. This is a detailed summary of how we approach AI security, compliance, and governance in our professional services engagements. Let’s approach creating a framework the right way:
- Quantify risk (why)
- Define inventory/scope (what)
- Define attacks and mitigating response (how)
Meaning we will:
- Define the AI security risk
- Understand components of AI workflows so we can secure them
- Determine what a security framework for AI should include
- Onboarding (seeing all agent types) & Observability (minimum signals)
- Security
- Data Protection & Compliance
- Identity
- Governance & process
What’s the risk of AI?
There is a plethora of scary statistical information regarding AI and its rate of adoption that outpaces even the best security teams; I will avoid regurgitating that here. Instead, I’m going to explain the risk in as straightforward terms as I can, synthesizing our lessons from hundreds of customer discussions.
In your environment, today:
- Your most critical data repositories are being connected to AI by your users, with or without your consent.
- Your Microsoft 365 tenant is being connected to Claude and ChatGPT, including both personal and work instances.
- Your users might use the AI services you provide to them, but they definitely will use their favorite AI services anyway, despite your adoption efforts.
- Any AI application that can use or read your data poses major cybersecurity risk to everything you hold dear, including:
- Risking your compliance state
- Risking your intellectual property
- Risking your industry-specific crown jewels– patient health data, engineering specs, confidential financial discussions, payment information, etc.
- Risking your company identities
- Risking your company devices
- Your sanctioned AI use is growing faster than you can manage, necessitating a scalable approach to governance.
- Your users are probably using AI in ways you should consider unethical, like asking it to represent their expertise, working around AI safeguards, chatting about work items on personal AI accounts, or simply not double-checking AI output before sending it as their own.
Cyclotron’s Secure AI Framework
Securing the AI workflow
Start from an understanding of key control points in AI workflows:
Prompt-in is typically what users type, and requires sanitization for sensitive data, appropriate use, and direct prompt injection. LLM processing is the model itself processing how it should respond or act (largely driven by model choice, with minor control in app architecture). Data retrieval involves how the AI handles your data, necessitating delegated permissions, classification filtering, sensitive data blocking, and indirect prompt injection protection. Tool calls & actions includes securing what AI can do on your behalf – if it’s acting with the user’s permissions, what access policy governs it, and defining normal behavior patterns to find deviations. Response out is a mirror of Prompt-in, but in reverse – sanitizing the AI/agent’s output for sensitive data, appropriate use, and data exfiltration activities that can occur after.
The security framework we develop needs to, at minimum, include these features.
Security, compliance, and governance
Security, compliance, and governance address these critical issues. Specifically:
- Security for AI says:
- I can observe a minimum level of signals from my AI apps to know what they are doing.
- I can see when an agent starts misbehaving against a known, good state.
- I can detect when a prompt injection attack occurs.
- I can quarantine or kill an agent in order to protect us.
- I can see and block when unauthorized agents attempt to act within our environment.
- Compliance for AI says:
- I know all my AI & agents run within my compliant service boundary.
- I can validate the security attestation of every AI app and agent.
- I can prevent agents from sharing or even reading sensitive data (when it would be undesired).
- I keep a close eye on what agents do with sensitive data.
- I see evidence when my users try to circumvent my AI safeguards.
- I can see evidence when users successfully circumvent my AI safeguards.
- I can see when unauthorized agents attempt to use our company data
- Governance for AI says:
- I can onboard every type of agent into my security and compliance strategy.
- I have an identity for every agent.
- I can ensure every agent has an identified owner.
- I can ensure every agent is validated and approved in a request process.
- I can assess when agents are no longer needed & remove them.
- I can establish KPIs and metrics for successful AI & agent use.
- I can see and prevent agents with duplicative purposes.
- I have human oversight established in governance processes that are regularly audited & adhered to.
Data Governance for AI
Data governance for AI answers a different question than traditional security: not just “who can access the data,” but “which data is authoritative, appropriate, current, classified, permitted for this AI use case, and traceable after the fact?” AI governance requires clear data ownership, sensitivity classification, lineage, retention, quality standards, access reviews, and usage policies that determine how data can be retrieved, summarized, transformed, or acted upon by agents.
Without this layer, organizations may secure the agent while still allowing it to reason over stale, overshared, low-quality, or improperly governed data. A mature framework should therefore establish accountable data owners, define approved source systems, validate data quality, enforce least-privilege access, apply sensitivity and retention policies, and preserve lineage so teams can understand what data influenced an AI response or action.
The most important shift is moving from access alone to permitted use. A user may be able to read a document, but that does not automatically mean the document should be available for every AI scenario, including summarization, retrieval-augmented generation, enrichment, automated decision support, external sharing, or tool-based action. Data governance for AI creates the policy layer that determines which data can be used, for what purpose, by which agent, under which controls, and with what evidence for audit.
To achieve these concepts, we first need to establish onboarding & observability.
Onboarding & Observability
Getting every agent under governance, or even just visible, will feel like a herculean task – at least, for now. Establishing governance early makes this easier down the road.
We break agents & AI into a few key areas (and you’ll see our admitted Microsoft-centric bias in this conversation here):
The Microsoft-native agents like Copilot and Power Platform already handle several components of the framework built-in: They run in your service boundary, have native security & compliance policy, and provide comprehensive auditing. Third-party AI requires much more effort to onboard; each AI app or agent needs to support sending audit signals to a common format (given in Agent 365, we can accept quite a lot), and it may represent with an app registration in Entra too. Custom-developed apps require code changes to integrate (typically the Agent 365 SDK is used here). Lastly, outside our boundary, we want to protect against Shadow AI services such as personal instances of Claude, ChatGPT, Gemini, browser extensions, and more.
Now that we know what we should secure, and how to connect it, here’s the specific data we want all our customers to be logging from AI by default:
Most AI apps and agents will have enough data in these categories for meaningful detections. Not all of these are going to be relevant to every AI app & agent type, but whatever you can get, the better the outcome.
Implementing the framework
Cyclotron helps organizations design and implement a practical, scalable framework for AI and agent security, compliance, and governance. While the core principles are consistent, applying them effectively requires tailoring controls across tools like Agent 365, Purview, Defender, and Entra based on each organization’s environment, risk profile, and maturity.
If you want to know more, reach out to Cyclotron here, and we’ll set up time to discuss how we can help you implement a formal AI Governance program using this framework.