01 ·
Shadow AI
Assistants, extensions and agents adopted by teams without going through IT. No inventory, no control over which data ends up where.
AI security for enterprises: Copilot, chatbots, agents and shadow AI under control.
When AI enters a company it brings data, access and autonomy. Fortgale integrates AI security technologies into the MDR and SOC cycle: alerts are handled 24·7·365 by the analysts in Milan, and posture is reported in the Fortgale Defence Platform.
References
AI Act
ISO/IEC 42001
NIST AI RMF
MITRE ATLAS
OWASP Top 10 for LLM
Two different things
Protecting AI and defending with AI.
They are two distinct problems. Defending with AI means using it in SOC and MDR work: we cover it in AI in cyber defence. Protecting AI means securing the systems the company adopts: that is the subject of this page.
The problem
What breaks when AI enters the company.
Four ways an AI system becomes an attack surface or a data leakage channel.
02 ·
Direct and indirect prompt injection
A user, but also a document, a web page or an email, can carry instructions that the model executes as if they were legitimate.
03 ·
Data leakage to LLMs
Personal data, code and confidential documents pasted into external tools, or retrieved by an assistant with permissions that are too broad.
04 ·
Excessive Agency
An agent with more access, tools and autonomy than its task needs: if it deviates, it deviates with the keys in hand.
The scope
The scope we protect: models, agents and generative tools.
A general integration model, valid for the technologies the company has already adopted as well as for those we choose with you.
01 ·
Inventory and shadow AI
A census of the AI systems in use, official or not, and of the data they touch.
02 ·
Prompts and responses
Controls on what goes into and comes out of the models: hostile instructions, sensitive content, out-of-policy responses.
03 ·
Data going to the models
Protection of the data that reaches the models, internal or external, and of the sources assistants retrieve information from.
04 ·
Agents and copilots
Monitoring of what agents do, with which identities and which permissions.
05 ·
Microsoft 365 and Copilot
Permissions, classification and policies on the environment the assistant works in.
06 ·
Internal LLM applications
Applications built in house on top of a model: inputs, integrations, access to data and tools.
How we do it
Technologies integrated into the MDR and SOC cycle.
Fortgale selects and integrates third-party AI security technologies into the defence cycle. As with MDR built on the customer's technology, the technology can be the one already in use or one chosen by Fortgale, and the SOC operates it: alerts are handled 24·7·365 by the analysts in Milan, with the same method as MDR and SOC. The posture of AI systems is reported in the Fortgale Defence Platform: the deliverable is the dashboard in the portal.
Three levels
Discover, Protect, Verify.
01 · Discover
Inventory and shadow AI
What is in use and what is exposed, with Exposure and Cloud Posture: reachable AI services, weak configurations, forgotten access.
02 · Protect
Identity, data, detection
Agent identities and OAuth tokens with ITDR. Data with Microsoft 365 policies, see Microsoft 365 security. Detection in the managed SOC.
03 · Verify
Assessment and red teaming
Assessment against MITRE ATLAS and the OWASP Top 10 for LLM 2026. Red teaming of AI systems goes through Cybersecurity Advisory.
Governance
AI Act, ISO/IEC 42001, NIST AI RMF.
A table of references, not of promises: Fortgale does not attest compliance or promise certifications. It provides technical evidence that feeds your governance process. The AI Act timetable, the OWASP entries and a checklist are in OWASP Top 10 for LLM 2026, MITRE ATLAS and the AI Act.
| Reference | What it is for |
|---|---|
| Regulation (EU) 2024/1689 · AI Act | The European framework on AI. Article 15: accuracy, robustness and cybersecurity for high-risk systems. Annex III from 2 December 2027. |
| ISO/IEC 42001 | Standard for an AI management system. A governance reference: our technical evidence can feed it. |
| NIST AI RMF | AI risk management framework (Govern, Map, Measure, Manage). Useful to structure the assessment. |
| MITRE ATLAS | Matrix of tactics and techniques against AI systems, in the vein of ATT&CK. Basis for scenarios and detection. |
| OWASP Top 10 for LLM 2026 | List of the most frequent risks of LLM-based applications. Basis of the assessments. |
Supervised entities
For supervised entities: the ECB letter and the ESAs.
On 7 July 2026 the ECB wrote to significant banks about AI-enabled cybersecurity threats, and the ESAs have set out their expectations on AI inside the DORA framework: both are read in cybersecurity for banking and finance. The technical side described here is the material the evidence comes from. The evidence we provide is technical; the assessment of adequacy and compliance with the AI Act remain with the board and the control functions.
Our line
Prompt injection: detect and contain, do not claim to eliminate.
Whoever promises to eliminate prompt injection promises something nobody can deliver today. Our line is different: reduce agent permissions to what is necessary, check prompts and responses, watch what the agent does and contain within minutes when it deviates, with the same detection and response cycle we use on the rest of the defence.
FAQ
Frequently asked questions on AI Security.
What is shadow AI?
Shadow AI is the use of generative AI tools, assistants, extensions and agents that the company has not inventoried, approved or brought under control. The risk is twofold: company data leaving for external models, and systems acting with access that nobody governs. It starts with an inventory: you cannot protect what you do not know you have.
Can prompt injection be eliminated?
No. As long as a model handles instructions and data in the same text channel, hostile content can influence it. It is detected and contained: agent permissions are limited, prompts and responses are checked, what the agent does is monitored, and the response is fast when it deviates. That is the Fortgale line: detect and contain, not promise to eliminate.
Is Copilot secure?
It depends on how the environment it works in is configured. Copilot works with the user's permissions: if document permissions are too broad, the assistant makes it easier to find what was already accessible by mistake. What matters is permissions, data classification, Microsoft 365 policies and monitoring of use.
Does the AI Act impose cybersecurity obligations on us too?
For high-risk AI systems, Article 15 of Regulation (EU) 2024/1689 requires accuracy, robustness and cybersecurity throughout the lifecycle. The timetable applies the obligations for Annex III systems from 2 December 2027. If you neither develop nor integrate high-risk systems, your obligations are different: check your role (provider, deployer) before assuming the article applies to you. The updated timetable is in the guide OWASP Top 10 for LLM 2026, MITRE ATLAS and the AI Act.
Further reading
Related resources and services.
Resource
AI in cyber defence
How AI enters SOC and MDR work, and where it stops.
Read →Service
Identity Protection · ITDR
Agent identities, OAuth tokens and sessions.
Discover ITDR →Service
AiTM phishing
Phishing written with language models, and session theft.
Discover →Service
Brand & Social Intelligence
Deepfakes and impersonation against your brand and executives.
Discover →Resource
OWASP, ATLAS and the AI Act
The ten OWASP entries for LLM applications, MITRE ATLAS and the AI Act timetable.
Read →Resource
Microsoft 365 security
Permissions, policies and monitoring of the environment Copilot works in.
Read →
Where to start
Inventory first. Then controls.
An AI Security assessment shows which AI systems are in use, which data they touch and where controls are missing. Milan SOC, active since 2017, 24·7·365.