Full Report
Agentic AI is moving the perimeter from components to data — and most strategies aren't built for that.
Analysis Summary
# Best Practices: Securing Agentic AI Architectures
## Overview
These practices address the fundamental shift in the cyber-attack surface caused by Agentic AI. As AI agents move from static components (code/containers) to reasoning over dynamic data, the security perimeter must shift to the **data layer**. These guidelines focus on preventing "Indirect Prompt Injection" and unauthorized autonomous actions where untrusted data (emails, documents, RAG sources) can steer AI behavior and bypass traditional infrastructure security.
## Key Recommendations
### Immediate Actions
1. **Map the AI Data Flow:** Identify every data source your AI agent consumes (emails, internal knowledge bases, web scrapers). Treat these as untrusted inputs.
2. **Define Agentic Boundaries:** Restrict agents from executing sensitive actions (e.g., deleting data, sending external emails) without a "Human-in-the-Loop" (HITL) confirmation.
3. **Sanitize RAG Inputs:** Treat the Retrieval-Augmented Generation (RAG) pipeline as a high-risk vector. Implement basic filtering for known malicious strings and prompt injection patterns in ingested documents.
### Short-term Improvements (1-3 months)
1. **Shift to Probabilistic Trust:** Move away from binary "allow/deny" lists. Implement behavior-based monitoring that flags AI outputs or actions that deviate from expected "normal" reasoning patterns.
2. **Implement Data-Level Governance:** Deploy controls that govern what specific data an agent can access at runtime, ensuring it does not have "god-mode" access to all corporate repositories.
3. **Harden Prompt/Instruction Separation:** Use architectural patterns (like system message isolation) to separate trusted developer instructions from untrusted user/data content to minimize steering risks.
### Long-term Strategy (3+ months)
1. **Adopt Agentic SOC Operations:** Transition security operations to use AI-driven defense mechanisms capable of matching the machine-speed attacks of agentic malware.
2. **Zero-Trust for AI Identities:** Assign unique machine identities to AI agents with the absolute minimum privileges required (Principle of Least Privilege), treating an agent's reasoning as a potential execution vector.
3. **Continuous Context Verification:** Develop systems that verify the integrity of the "context window" to ensure the AI's reasoning hasn't been poisoned over time.
---
## Implementation Guidance
### For Small Organizations
* **Focus on Third-Party Risk:** Since small teams often use SaaS-based AI, focus on the security settings of the provider (e.g., disabling training on your data).
* **Manual Gatekeeping:** Ensure any AI-generated output is reviewed by a human before being used in customer-facing or financial workflows.
### For Medium Organizations
* **Inventory AI Components:** Use Software Supply Chain tools to track which libraries and models are being used.
* **Dedicated Data Silos:** Ensure the AI agent only has access to a specific, cleaned subset of data rather than the entire company drive.
### For Large Enterprises
* **Agentic Orchestration Layers:** Deploy a middleware layer that inspects all agent-to-tool communications for signs of prompt injection or data exfiltration.
* **Red Teaming for AI:** Conduct specialized penetration testing focused on "Indirect Prompt Injection" via common business tools (e.g., Slack, Email, Jira).
---
## Configuration Examples
* **Isolation Pattern:** Instead of `f"System Instructions: {user_input}"`, use structured API calls that strictly separate the `System` role from the `User` role to prevent the AI from confusing data with commands.
* **Least Privilege API Scoping:** If an agent needs to read emails, provide an API token with `Mail.Read` permissions only—never `Mail.ReadWrite` or `Directory.ReadWrite`.
---
## Compliance Alignment
* **NIST AI RMF:** Aligning with the AI Risk Management Framework to identify and measure AI-specific risks.
* **ISO/IEC 42001:** Establishing an AI Management System.
* **OWASP Top 10 for LLM:** Focus specifically on **LLM01: Prompt Injection** and **LLM06: Sensitive Information Disclosure**.
---
## Common Pitfalls to Avoid
* **Over-reliance on WAFs:** Traditional Web Application Firewalls cannot detect malicious payloads hidden in the semantic meaning of a document or email.
* **Assuming Data is Passive:** Never assume that data in a "trusted" internal knowledge base is safe; if an attacker can write a file to that base, they can control the AI.
* **Ignoring Machine Speed:** Failing to automate defenses; humans cannot react fast enough to an AI agent that decides to exfiltrate 10,000 records in seconds.
---
## Resources
* **OWASP Top 10 for LLM Applications:** [https://owasp.org/www-project-top-10-for-large-language-model-applications/]
* **NIST AI Risk Management Framework:** [https://www.nist.gov/itl/ai-risk-management-framework]
* **Spectra Assure (Supply Chain Security):** [https://www.reversinglabs.com/products/software-supply-chain-security]