The Definitive Guide to AI Security

Most AI security programs are built around one type of AI deployment. Most enterprises are running five. This guide provides a structured framework for understanding the full AI security landscape: what each deployment archetype entails, the risks it introduces, and the controls required at every phase of the lifecycle, from governance and discovery through detection and response.

What’s Inside:

A structured map of the AI security landscape, covering the lifecycle phases, deployment archetypes, industry categories, and controls every enterprise program must understand.

The agent is the perimeter: Why identity, data, cloud, endpoint, and network controls are context inputs for what the agent decides to do, not standalone AI security solutions. No single control secures the agent in isolation.

The AI security lifecycle: Six phases of coverage, from governance and asset identification through detection and response, structured around the NIST Cybersecurity Framework (CSF). Each phase maps to distinct capabilities and controls.

How industry analysts are framing this market: Seven emerging categories now being defined by analysts: AI Governance, AI Usage Control, AI Security Posture Management (AISPM), AI Security Testing, AI Runtime Defense, AI Detection and Response (AIDR), and Guardian Agents. Where each one sits in the lifecycle and what it covers.

Five deployment patterns, five distinct risk profiles: Enterprise AI doesn't arrive in a single form. It spans five deployment archetypes, each with distinct threat models, attack surfaces, and governance requirements. A typical large enterprise is running all five simultaneously.

Per-archetype security controls: For each of the five archetypes, a complete view of what it is, who builds it, the platforms it covers, and the security controls required across every NIST CSF phase. Embedded AI Systems, Democratized AI Systems, Homegrown AI Systems, Device-based AI Systems, and Homegrown Models.

What You'll Walk Away With:

Whether you're building an enterprise AI security program from scratch or assessing gaps in an existing one, this guide provides the frameworks and vocabulary to do it right.

A clear mental model for how AI security is structured: Understand the landscape as a whole: the phases, the categories, the archetypes, and how they connect. Move past ad hoc coverage and toward a program with defined scope.

A map of the five AI archetypes running in your environment: Know which types of AI are active across your organization, what each one does, and the specific risks it introduces. Embedded SaaS copilots, citizen-built agents, homegrown pipelines, device-based coding agents, and fine-tuned models each require a different approach.

A lifecycle framework you can act on: Six phases of coverage mapped to the NIST CSF, with distinct capabilities at each phase. Use it to assess where your program has depth and where it has gaps.

Visibility into the seven categories your program needs to address: From AI Governance and AI Usage Control to AI Runtime Defense and AIDR, understand what each analyst-recognized category covers and how it fits into a complete security program.

Per-archetype control breakdowns you can use today: For each of the five archetypes, a concrete view of the controls required across Govern, Identify, Protect, Detect, and Respond. Use it to pressure-test your current coverage or brief your team.