A foundation model is a large, pre-trained AI system that can be adapted to many tasks without starting from scratch. It learns broad patterns from massive data, then supports fine-tuning or prompting for specific uses. In identity security, it can underpin agents, detection, automation, and policy decisions.
What AI foundation models are for
Foundation models are general-purpose AI systems that learn broad patterns first, then get adapted to specific tasks. That makes them useful as a shared base for chat, analysis, automation, detection, summarisation and decision support.
The security relevance is that one model can become a dependency for many downstream systems. If its behaviour, access patterns or outputs are weakly governed, the same flaw can propagate across multiple applications instead of staying isolated to one use case.
How foundation models change AI security decisions
Because foundation models are reused rather than built anew, the main question is not just whether the model works, but where it is embedded, who can prompt it, what data it can see and what actions it can trigger. That is why model scope, tenancy boundaries and downstream use matter as much as model quality.
For organisations, the risk surface includes prompt injection, data leakage, untrusted outputs, model abuse and overconfident automation. If a foundation model is connected to tools, policies or workflows, it can become part of an operational control plane rather than just a content engine.
Foundation models also sit at the centre of many agentic and enterprise AI designs, so governance decisions often need to account for deployment context, integration paths and dependency management. The same base model may be acceptable for a low-impact assistant but inappropriate for sensitive decision support without stronger controls and oversight.
Where foundation models create control and governance pressure
A foundation model is not inherently insecure, but its scale and reuse make control failures more consequential. A single compromised configuration, unsafe connector, poisoned retrieval source or permissive instruction path can affect many users and many applications at once.
That is why practitioners should treat model inventory, approved use cases, access boundaries and content-handling rules as first-class controls. When model outputs influence business processes, the organisation also needs to understand how errors, hallucinations or manipulated responses will be detected and contained.
For a strong practical reference point, NIST AI 600-1 GenAI Profile is useful because it maps generative AI risks to governance, testing, provenance and incident handling decisions.
How foundation models should be evaluated in practice
Evaluation should start with the model’s role in the stack, not just its benchmark scores. Teams need to know whether the model is customer-facing, internal, tool-connected, retrieval-augmented or allowed to influence decisions, because each of those uses changes the security and governance burden.
It is also important to distinguish the base model from the surrounding system. Many failures blamed on the model are really failures of orchestration, permissions, prompt design, data sourcing or release governance.
For practitioners, the most useful lens is whether the foundation model is a reusable capability with defined boundaries, or an uncontrolled platform for rapid integration. The latter tends to create hidden dependency risk, inconsistent oversight and a larger blast radius when something goes wrong.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST AI RMF and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 42001:2023 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | GV.1 — Governance | Foundation models require AI governance, oversight and accountability decisions. |
| MAP.1 — Map Context and Impacts | Foundation models must be mapped by use case, context and downstream impact. | |
| MEASURE.2 — AI system measurement and analysis | Foundation model behaviour, robustness and misuse need measurable evaluation. | |
| Recommendation — Define model approval, ownership and review before reuse across tasks. Document where each model is deployed and what decisions it can affect. Test model behaviour for misuse, leakage and unreliable outputs before release. | ||
| ISO/IEC 42001:2023 | 8.2 — AI risk treatment | Foundation model programmes need risk treatment for deployment and reuse decisions. |
| Recommendation — Treat model reuse, access and oversight as managed AI risks. | ||
| NIST SP 800-53 Rev 5 | SA-15 — Development Process, Standards, and Tools | Foundation models are part of AI-enabled system development and controlled integration. |
| Recommendation — Require controlled development and integration practices for model-based systems. | ||
Related resources from NHI Mgmt Group
- What breaks when an AI security tool depends on a third-party foundation model?
- Who is accountable when agentic AI standards and conferences move under a neutral foundation model?
- How should security teams evaluate foundation model risk before using it in a generative AI application?
- Why do large open foundation models change the trade-offs for model selection in enterprise AI programs?