The Hitchhiker’s Guide to AI Security: Navigating Exposure, Risk, and Sanity

If you’ve read The Hitchhiker’s Guide to the Galaxy, this is nothing like it. 

But it does explain, with some passable amount of clarity, why the answer to life, the universe, and everything is not 42; but AI security. 

At least in today’s digital ecosystem. 

AI security is a dizzying topic. Figuring out where your AI assets are, what they can expose, how to keep them safe, and how to make AI work for you to keep itself and other things safe—is admittedly a tough job. 

But with the right towels – erm, tools – it can be a lot simpler. We’re talking universe-simplifying things like exposure management, CNAPP, and everything that leads to better CI/CD pipeline security.

Buckle up.

What is AI security?

AI security… is big. Really big.

In a phrase, “AI security” is the discipline of using AI to secure both traditional and AI-based systems against traditional and AI-based attacks. 

For the purposes of this blog – and again, your sanity – it’s best to come clean and admit that “AI security” really means three different things, depending on who you’re talking to and the angle you want to hit it from.  

Which justifies the next section. 

“Don’t Panic”: There are three types

“AI security” refers to three distinct, totally not confusing, intertwined concepts:

Security OF AI: Protecting AI models against attacks.

Security FOR AI: Securing the AI deployment and usage lifecycle.

AI FOR Security: Using AI to bolster cybersecurity systems and defenses. 

To add to the non-confusion, this is all premised on the understanding that these elements will be used to protect against AI-powered attacks. Among others. 

But to keep things clear: AI security means using AI to protect all things (AI and non) against all kinds of attacks (AI and non)—and protect those pesky AI models, too. 

Knowing where one’s AI assets are—with CNAPP

First things first. Let’s focus on the Security OF AI, or locking your new AI investments into place in a way that won’t come back to bite you.

You’ll need to first understand where they are. And most of them are likely to be floating around in the cloud.

A CNAPP (Cloud-Native Application Protection Platform) discovers risks across cloud workloads, identities, applications, and infrastructure. The right CNAPP provider can extend this protection to include AI services and pipelines as well. 

This makes AI just another node in the attack graph CNAPP analyzes, putting it well within your capacity to monitor and protect. It covers:

• AI/ML assets: Models, APIs, notebooks, datasets are treated like workloads.
• Misconfigurations in AI services: Weak API auth, exposed AI models, unsecured S3 buckets with training data.
• AI identity risks: Excessive permissions and access to AI data pipelines or models.

The Takeaway: CNAPP secures AI as part of the cloud attack surface. 

Share and Enjoy: How exposure management uses this to “AI security” better

CNAPP is extremely useful, but it is just one data source inside a unified exposure management platform. 

Alone, an exposure management platform:

• Identifies all kinds of risks throughout the attack surface (misconfigurations, vulnerabilities, excessive permissions)
• Identifies attack paths and “toxic combinations” (exposed S3 bucket + weak IAM = trouble)
• Prioritizes risk based on context (exploitability, privileges, data sensitivity, impact)

And then summarizes risk in a human-readable format. All of which is done with the help of AI (AI FOR Security).

Combined, exposure management and CNAPP do a few very cool things:

• AI-based risks are discovered in CNAPP.
• CNAPP feeds exposure management. Risks are put into context against: Identity, Endpoint and Vulnerability data.
• AI risks are then prioritized globally (not just within the cloud).

Not entirely unlike securing the CI/CD pipeline

Now, let’s backtrack a bit. All of this is fine and good, but what about securing those AI models (Security FOR AI) before they deploy? 

CNAPP is good for that, too.

Here’s what CNAPP can do to shift runtime security down to the earliest DevSecOps stages:

• Scan IaC (Infrastructure-as-Code) before deployment
• Map risk from cloud to code to runtime (all in one system)
• Find misconfigurations, identity risks, and vulns in workloads and containers

By doing this, CNAPP enables AI pipeline security pre-runtime. 

And then, of course, it feeds all that information back into a connected exposure management platform, if one is available.

A practical survival guide for CISOs 

If your head is still spinning, here’s your brief but actionable summary for “doing AI security” right—and keeping things straight in cyberspace. 

1. Don’t Panic: there are three kinds of “AI security.” And that’s okay.
   Security OF AI
   Security FOR AI
   AI FOR Security
2. Know where your AI-based assets are: models, data, APIs, and identities – and all the exposures along with them. (Security OF AI)
3. Find out how important those weaknesses are (or aren’t) by prioritizing them in an AI-powered exposure management platform. (AI FOR Security)
4. Protect your AI resources in the build stage by leveraging CNAPP + exposure management to catch flaws pre-deployment. (Security FOR AI)
5. Again, Don’t Panic. 

Unless, of course, you don’t have a CNAPP or exposure management platform – or a towel – lined up. 

Then panic.

Related Articles:

1. AI Driven Cybersecurity Playbook
2. 7 Best AI Data Security Platforms
3. Top 5 AI Workspace Security Platforms
4. The AI Arms Race in Cybersecurity
5. Lessons from India’s AI-Driven Cybersecurity Lab
6. The Role of AI in CyberSecurity
7. How Cybercriminals Are Leveraging AI Tools for Cyberattacks