Topic starter
24/07/2026 4:09 pm
TL;DR: Databricks AI Security Framework is presented as a way to turn AI risk into operational controls, with Noma Security arguing that 62 risks across the AI lifecycle need continuous discovery, prioritisation, monitoring, and standards mapping, according to Noma Security. The central shift is that AI security now has to treat models, RAG pipelines, and agents as mutable attack surfaces rather than static applications.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “Ten steps to secure ai with Noma Security and the databricks ai security framework (dasf)”.
Key questions
Q: What breaks when AI security is handled only at launch time?
A: Controls go stale as the system changes.
Q: Why do RAG pipelines increase AI governance risk?
A: RAG creates a live retrieval path into enterprise content, so the model can surface information that was never intended for broad disclosure.
Q: How can teams tell whether AI oversharing controls are actually working?
A: They should measure whether realistic prompts produce restricted answers, redactions, or blocks when policy should apply.
Practitioner guidance
- Map the full AI deployment surface Inventory models, datasets, retrieval layers, APIs, tool connections, and agent pathways before approval so hidden data flows do not escape governance.
- Embed AI controls into delivery workflows Put review gates, validation checks, and exception handling directly into CI/CD and model-serving pipelines so security does not rely on a separate manual process.
- Prioritise controls by AI lifecycle risk Rank exposure by likelihood and impact across training, deployment, inference, and update stages, then address the highest-risk failure modes first.
Bottom line: AI security breaks down when organisations assume a model is safe after the first review and do not govern what changes later.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:14 pm
AI security has moved from model design to operational governance. The article’s central lesson is that a static risk review cannot protect a system that learns, drifts, and changes integrations after launch. Security teams need lifecycle controls that cover discovery, deployment, monitoring, and retirement, or the control model will lag the system it is meant to govern.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: Which frameworks should organisations align AI compliance to?
A: For most programmes, NIST AI RMF, NIST Cybersecurity Framework, and zero trust principles provide the broadest control alignment. Organisations in regulated sectors should add the relevant sector rules, then map AI governance, runtime controls, and data protection to the specific risks each framework covers.
👉 Read our full editorial: DASF shows why AI security must move from theory to operations