AI Security Hub
07AI Security Pillar

Monitoring and Threat Detection

Monitor AI usage, suspicious patterns, system changes, and security events after launch.

Business focus

Maintain visibility

Why it matters

Security starts with a defined business boundary

AI monitoring combines activity logs, attack-pattern tracking, anomaly detection, integrity checks, and clear escalation paths.

Business risk

A business cannot investigate misuse, drift, or an unsafe action if it cannot see what the system accessed, generated, attempted, or changed.

What this pillar covers
  • Prompt, retrieval, tool, and activity logs
  • Attack-pattern tracking
  • Anomaly and integrity monitoring
  • Security alerts and escalation
Operating model

Turn maintain visibility into repeatable controls

A policy is only the starting point. For each AI use case, name the business owner, define the allowed boundary, configure the relevant technical controls, and decide what evidence proves those controls are working. Repeat the review when the model, data, connected tools, or business purpose changes.

Start with a single high-value workflow instead of trying to govern every experimental use at once. That makes it possible to test the controls with real users, find exceptions, and create a pattern the rest of the business can reuse.

StepDecisionEvidence to retain
1Scope the workflowOwner, purpose, approved data, users, and connected systems.
2Apply the controlsConfiguration, access rules, approval points, and test cases.
3Operate and reviewLogs, review results, exceptions, incidents, and change records.
Launch reading list

Start with these practical guides

Each pillar begins with one anchor guide and two supporting articles. Published guides become active automatically as they enter the blog.

Available

MITRE ATLAS: How to Use the AI Threat Knowledge Base

Use shared AI attack terminology to improve testing, detection, and response.

Read the guide
Available

Concept Drift Monitoring: Keeping AI Reliable After Launch

Detect when production data and results move away from the approved baseline.

Read the guide
Available

AI Model Integrity Verification: Proving the Right Model Is Running

Verify model provenance, files, deployment artifacts, and runtime identity.

Read the guide

Questions for leadership

  • Which AI events are recorded and for how long?
  • What behaviour should trigger an alert or pause?
  • Who reviews anomalies, and what evidence do they receive?
  • Can the team investigate the model, data, prompt, and action together?
Practical control checklist

Put the pillar into practice

  1. 1Log identities, inputs, sources, tools, approvals, outputs, and errors.
  2. 2Protect logs from unauthorized access or alteration.
  3. 3Define expected usage, cost, latency, and error patterns.
  4. 4Alert on unusual access, repeated attacks, or integrity changes.
  5. 5Test the escalation and evidence-collection process.
Authoritative guidance

Use recognised guidance to validate the control design

These resources help teams translate AI-specific risks into documented, testable business and technical controls. Apply them to the actual data, permissions, and actions in the workflow rather than treating them as a one-time compliance exercise.

Review a real workflow

Turn this pillar into operating controls

Map the data, access, approvals, monitoring, and evidence around one important AI use case before expanding it.

Explore AI services