Notifications
Clear all
Topic starter
02/08/2026 12:16 pm
TL;DR: Broad AI security advice can understate identity and access risk in agentic systems, according to Akto’s overview of AI security best practices spanning data poisoning, API protection, governance, monitoring and supply chain controls. The governance gap is now less about model quality alone and more about who or what can act inside the AI stack.
NHIMG editorial — based on content published by Akto: AI Security Best Practices: Protect Models, Data and AI Systems
Questions worth separating out
Q: How should security teams govern AI experimentation without slowing delivery?
A: Use lane-based governance.
Q: Why do AI systems create identity risk as well as model risk?
A: Because AI systems rarely act alone.
Q: What breaks when shadow AI is not discovered early?
A: Teams lose sight of which agents exist, what they can reach, and which credentials they use.
Practitioner guidance
- Implement scoped credentials for AI services Assign AI workloads the narrowest possible API keys, service accounts and tokens, then rotate and revoke them on a defined lifecycle.
- Register every AI integration in one inventory Create a single register for models, agents, plugins, retrieval sources and external APIs, including the identities each one uses.
- Validate inputs before they reach model or tools Apply schema validation, content filtering and tool permission checks at the API layer before prompts or documents reach the model.
What's in the full article
Akto's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step AI security best practices across data poisoning, governance, monitoring and API protection.
- Practical guidance on securing AI models, APIs and enterprise systems across the development lifecycle.
- Operational examples for testing, discovery and control validation in AI security programmes.
- The vendor's own framing of agentic AI guardrails and API security implementation details.
👉 Read Akto's blog on AI security best practices for models, APIs and enterprise systems →
AI security best practices: are your controls keeping up?
Explore further
02/08/2026 1:18 pm
AI security best practice is now an identity governance problem as much as a model security problem. The article is framed around data poisoning, monitoring and governance, but the practical risk surface sits in the identities that power AI systems. API keys, service accounts and delegated tokens can be the easiest route from a model to enterprise data. Practitioners should treat AI security as a combined model and identity control problem.
A question worth separating out:
Q: Should AI governance sit with security, IAM or the business?
A: It should be shared, with security setting control requirements, IAM managing identities and permissions, and the business owning approved use cases and risk acceptance. AI governance fails when it is treated as a side project because the controls span multiple teams. Clear ownership, access review and change control are the minimum coordination points.
👉 Read our full editorial: AI security best practices still leave agent identity gaps
