Cyber Security Month: Advanced AI Security Concepts

Our posts in the Cyber Security Awareness Month series decided where AI belongs in a utility, what it may touch, and which defensive jobs it does well. Guiding the AI Horses Where You Want to Go ended on four guardrails: placement, privilege, design and review. This post is the build behind them, the network, model and logging controls that hold those decisions in place.

The joint Principles for the Secure Integration of Artificial Intelligence in Operational Technology, published in December 2025 by the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Canadian Centre for Cyber Security and their international partners, and the NSA’s information sheet on Model Context Protocol security, released in May 2026, provide excellent reference material for integrating AI models into the network. We work through three layers: where the model sits and what may leave, what the model may do, and what you can prove afterwards.

Reference Architecture and Egress Control

Model Placement

Language models stay at Levels 4 and 5 of the Purdue Model, where our Cyber security month series put them. What matters is how operational technology (OT) data reaches them, and the answer is always a copy.

The CISA-led principles say to prefer push-based or brokered architectures that move required features or summaries out of OT without granting persistent inbound access. Where the data has to cross into business networks, use one-way transfer patterns and audited staging buffers.

In a utility, the historian at Level 3 pushes data through a one-way transfer to a broker and staging buffer in the OT demilitarized zone (DMZ), which feeds a historian replica. The assistant reads the replica. No session from Level 4 opens into Level 3, so a compromised assistant reaches the copy and nothing behind it.

Some data should not make the trip at all. The principles define engineering configuration data as network diagrams, asset inventories, documentation on operations sequences, safety-related information, logic diagrams, and schematics. The detectors later in this post are built to find exactly that list.

Figure 1 maps where AI sits in a utility, how OT data reaches it, and which paths out are allowed.

Egress Control

Through our AI Blog Series, we established a strategy and implemented said strategy for safe AI tool adoption. An approved tool list means little if the network will carry a prompt anywhere. Egress control allows for one single path for prompts, and the path can be logged.

Start with an allowlist:

Name the approved AI service being used in the organization. Deny the rest of the generative AI category by default to allow only the vetted AI model to run. Integrations and server-side agents call AI application programming interfaces (APIs) directly, so the allowlist names hosts and service accounts alongside people.

Note that an allowed domain still reaches personal accounts. Netskope’s Cloud and Threat Report 2026 found 47% of genAI users using personal AI apps. OpenAI’s corporate network controls add a ChatGPT-Allowed-Workspace-Id header to requests for chatgpt.com, after which any other workspaces (including personal workspaces) are filtered out by the system. Anthropic’s Tenant Restrictions do the same with an anthropic-allowed-org-ids header and answer any other organization with a 403 error.

Unmanaged devices need a separate answer, because they never cross your proxy. Require a compliant, managed device at sign-in to the corporate AI tenant; in Microsoft Entra conditional access, for one, that is the grant control "Require device to be marked as compliant", set on its own and not as one of several options. For the ChatGPT desktop and mobile apps, OpenAI notes that blocking the app domains stops all app traffic, personal accounts included.

Hardening the Model Layer

The Open Worldwide Application Security Project (OWASP) GenAI Large Language Model (LLM) Top 10 2026, published in August, includes prompt injection as one of its top risks. It advises designing the surrounding system on the explicit assumption that the model’s instruction boundary will eventually be bypassed. The UK National Cyber Security Centre reached the same view in December 2025, and IBM’s study found that more than 20% of organizations reported a breach targeting AI models or applications. So, the controls that hold sit around the model, where they can be tested.

Input and Output Filters

Text reaches a model from people you trust and from documents you do not. Mark the second kind as data.

OWASP’s guidance under LLM01:2026 covers the input side:

• Strip Unicode tag-block characters (U+E0000 to E007F), variation selectors (U+FE00 to FE0F) and zero-width characters before the model sees the input.
• Send external content in a structurally separate, provenance-labelled channel.

Microsoft’s spotlighting is one implementation, marking untrusted text by delimiting, datamarking or encoding it. Microsoft calls its own Prompt Shields classifier probabilistic, so read any classifier’s score as a signal.

Output gets the same suspicion:

• Check responses against a strict output schema in trusted application code, as OWASP asks.
• Run the data loss prevention (DLP) detectors that inspect prompts on responses too.
• Treat links as an exfiltration channel. Microsoft describes deterministic steps to block other data exfiltration techniques, such as the generation of certain untrusted links.

An assistant summarizing a vendor’s emailed PDF should never render a link or an image address that the PDF supplied.

Least-Privilege Agents

Excessive Agency was LLM06 in OWASP’s 2025 list and is LLM03 in 2026. OWASP advises the following:

• Keep the decision in code. Implement authorization in logic rather than relying on an LLM to decide if an action is allowed or not.
•  Adopt Meta’s Rule of Two as a floor for agent capabilities.
• Avoid open-ended tools where possible, such as running a shell command or fetching a URL.

The joint guidance Careful adoption of agentic AI services, co-authored by the Canadian Centre for Cyber Security, CISA and the NSA, turns this into identity rules:

• Treat each agent as a distinct principal, a cryptographically anchored identity.
• Replace static secrets with ephemeral credentials that expire when the job is complete.
• Draw tools from an approved allowlist of tools and versions that are regularly verified as secure.
• Block high-impact actions without prior human approval.

In a utility, an outage-summary agent gets a read-only account on the historian replica. It can draft a ticket but cannot submit one.

MCP Security

The Model Context Protocol (MCP) connects agents to the tools and data they act on. With guidance from the NSA and the MCP specification, use the following checklist:

1. Keep a clear inventory of all deployed MCP agents and tools with versions and patch history, and scan the network for MCP servers nobody approved.
2. Draw trust boundaries between agents, plugins, models and end users, and run MCP servers locally where possible.
3. Validate every tool call’s parameters against well-defined schemas and expected ranges before it runs.
4. Isolate each tool’s execution with operating system controls such as AppContainers, seccomp, AppArmor or SELinux, and deny at runtime any access path a server does not need.
5. Sign MCP messages and give them expiration timestamps and replay protection.
6. Treat every result as suspect, because each output must be treated as untrusted input to the next phase of the pipeline.

The MCP specification’s security best practices add two rules to enforce at the gateway:

• Servers must not accept any tokens that were not explicitly issued for the MCP server, which ends token passthrough.
• Scopes start minimal instead of as wildcard grants such as * or full-access.

Each of these controls in Figure 2 makes a decision.

Detection and Evidence

DLP Detectors Tuned to Utility Data

Ready-made detectors are tuned for someone else’s data. Netskope reports that regulated data, intellectual property and source code are the data most often sent to generative AI apps against policy. A utility’s sensitive set is the engineering configuration data listed earlier, and four detectors cover most of it:

• Match asset inventories exactly. Exact data match compares text against values in a source table. Hash an export of the OT inventory, keyed on hostname or asset number, with fields from CISA’s asset inventory guidance such as IP address, MAC address, model and firmware version. The detector gives fewer false positives than a pattern, and in Microsoft Purview only the hashed values are uploaded.
• Match relay and intelligent electronic device (IED) configuration on structure. IEC 61850 Substation Configuration Language (SCL) files carry network addressing inline, and the OpenSCD project shows the Communication section holding an IED’s address in <P type="IP"> elements. Pair those markers with a keyword dictionary built from your own substation and IED naming convention and relay setting exports.
• Put a threshold on network ranges. The private blocks in RFC 1918 (10/8, 172.16/12 and 192.168/16), plus the organization’s own public ranges, make the pattern. NERC’s definition of Bulk Electric System (BES) Cyber System Information excludes individual IP addresses without context and includes collections of network addresses and network topology of the BES Cyber System, which supports a rule to audit a single address and block a collection.
• Label drawings at the source. Document fingerprinting turns a title-block template into a detector, but Microsoft’s documentation says it does not detect files that contain images only. Use endpoint DLP to block labelled files from upload to AI sites.

Roll each detector out in stages: audit, then warn, then block.

Figure 3 shows the four detectors.

Logging Schema

Give every AI event one record with the same fields, whether it came from a browser, an agent or an MCP tool call. The CISA-led principles ask for logging of all AI system operating data (including timestamps, inputs, and outputs) under an AI identity distinct from any typical machine or user identifiers.

The NSA adds: All tool and model invocations should be logged, including the exact parameters, identities involved, and (where feasible) cryptographic hashes of results or output.

Agentic guidance adds identity and privilege changes. Name the fields after the OpenTelemetry GenAI semantic conventions so security information and event management (SIEM) parsers carry over between tools, and set prompt and response capture by data tier.

Audit Retention

Gate 5 in our AI Blog Series asked whether you could tell a regulator, from records, if AI touched a submission. We treat the retention period that applies to your organization’s other event logs as the floor for AI records, even where the AI tools sit outside the scope of that rule. In our view, a logged prompt that carries sensitive data is as sensitive as the data itself, and the log belongs inside the same information protection program as the source. Protect the logs in their own right:

• Keep them longer than the default. The Australian Signals Directorate (ASD) warns that default log retention periods are often insufficient.
• Store them in a separate or segmented network with cryptographic integrity checks, as ASD advises.
• Scrub them before they are read. OWASP adds a step before any monitoring platform ingests them. Restrict and scrub logs and traces before application performance monitoring (APM) ingestion.

Figure 4 shows a guide for recording AI events.

At the start of Cyber Security month, the barn door was open. The horses are now fenced, put to work and saddled: a network that carries prompts only to the services you named, a model that cannot act beyond its tools, and records that show what happened.

The horses will keep pulling. But the reins decide where they will go.

References