Enterprise AI assistant selections are often decided on model quality and licence price, while the questions that decide security exposure, such as what the assistant can read, where data goes and who controls connectors, are answered after rollout. A general-purpose assistant with connectors to mail, files, chat and business systems becomes a new path to almost every data store you own, acting with each user's delegated access. This vendor-neutral guide gives security, privacy, IT and procurement teams the requirements, evaluation criteria, vendor questions, red flags and a proof of concept plan for choosing an enterprise assistant or GenAI platform. It does not compare named products and does not repeat deployment hardening, which is in the Enterprise AI Copilot Security Guide. Coding tools have their own AI Coding Assistant Buyer's Guide.
Key takeaways
- Connectors are the real attack surface. The assistant inherits whatever its connectors can reach, so admin control over which connectors exist, who can add them and what scopes they hold outweighs most model features.
- Data terms must be contractual for your tier. Retention, training use, sub-processors, residency and the handling of uploaded files need to be in the agreement, not only on a trust page.
- Identity integration decides control. SSO, SCIM, group-based policy and fast deprovisioning are what let you enforce who uses which features.
- Audit logs are a selection criterion. If you cannot export who asked what, which sources were retrieved and which actions ran, you cannot investigate a leak or answer a regulator.
- Test with hostile content. A proof of concept should plant instructions in mail and documents, because zero-click data theft through assistants has been shown against several major platforms.
Define requirements
Agree these internally, with named owners, before any vendor demo.
- Use cases: chat only; chat grounded in enterprise data; actions such as sending mail, creating documents or updating records; custom agents built by business users; API access for internal applications. Each step adds data reach and action risk.
- Data scope: which repositories may be connected, which classifications are excluded, and whether permissions in those repositories are clean enough to expose through search. Oversharing that was invisible becomes one question away.
- Deployment and residency: vendor-hosted SaaS, inside your cloud tenant, or private models; regions required for data at rest and for processing.
- Identity: SSO with your identity provider, SCIM provisioning, conditional access, group-based feature assignment, and how custom agents and API keys are owned. See the Agent Identity and Access Guide.
- Compliance: the assurance you need from suppliers (SOC 2 Type II, ISO/IEC 27001, ISO/IEC 42001 for AI management), data protection agreements, records retention and eDiscovery.
- Risk framework: map requirements to the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) and its Generative AI Profile, NIST AI 600-1, whose risk list includes data privacy, information security, intellectual property and value chain and component integration.
Capability areas
| Area | What good looks like | Why it matters |
|---|---|---|
| Data use and retention | No training on customer prompts, files or outputs by default; configurable retention, including short or zero retention options; named sub-processors; residency options | Every prompt and grounded answer moves enterprise data to the provider |
| Connector governance | Admin allow list of connectors and MCP servers; per-connector scopes; user consent controls; ability to block user-added connectors | Connectors define what an injected or misused assistant can reach (OWASP LLM06:2025 Excessive Agency) |
| Permission-aware retrieval | Answers honour source system permissions at query time; sensitivity labels respected; ability to exclude sites or repositories | Stops the assistant exposing data the user should not see. See the Permission-Aware RAG Guide |
| Action controls | Confirmation before sending mail, posting or writing to external recipients; per-action admin toggles | Write tools are an exfiltration channel |
| Output safety | Control over image rendering, link handling and unfurling in responses; prompt injection detection on retrieved content | Rendered images and links have carried stolen data in public research |
| Identity and admin | SSO, SCIM, roles with least privilege for admins, group policy, ownership and expiry for custom agents and API keys | Leavers, contractors and orphaned agents must lose access promptly |
| Audit and eDiscovery | Logs of prompts, responses, retrieved sources, connector use and admin changes; SIEM export; retention and legal hold | Investigation, insider risk and regulatory requests |
| DLP integration | Classification-aware blocking of sensitive data in prompts and responses; integration with your existing DLP | See the Generative AI Data Loss Prevention Guide |
| Vendor assurance | Current independent reports covering the AI service, vulnerability disclosure programme, published security advisories for AI features | Many AI flaws are fixed server-side and announced only in advisories |
Evaluation criteria
| Criterion | Weight | Evidence to request | Pass threshold |
|---|---|---|---|
| Contracted data use and retention | High | DPA, product terms for your tier, sub-processor list | No training on your data without opt-in; written retention limit; residency met |
| Central connector control | High | Admin console demo | Admins can block any connector or MCP server and users cannot add unapproved ones |
| Permission trimming | High | Test with a restricted document | A user without access gets no content from it in any answer |
| Audit depth and export | High | Sample records, SIEM integration docs | User, prompt, sources, actions and timestamps per interaction, exportable |
| Resistance to injected content | High | Your own test in the proof of concept | No data leaves through images, links or actions from planted instructions |
| Action confirmation | Medium | Demo of external send | External writes require explicit user approval |
| SSO, SCIM and deprovisioning | Medium | Integration docs, leaver test | Access and sessions end within your leaver SLA |
| DLP and label integration | Medium | Policy demo | Labelled data is blocked or redacted as your policy states |
| Independent assurance | Medium | SOC 2 Type II, ISO/IEC 27001 certificate scope, ISO/IEC 42001 if claimed | Reports and scope cover the AI service you are buying |
| Custom agent governance | Depends on use case | Admin documentation | Agents have owners, approval workflow, scoped access and can be disabled centrally |
Smaller organisations can usually accept vendor-hosted terms with strong contract language and focus on connector control and audit. Large or regulated organisations should expect to negotiate retention and residency, require SIEM export and eDiscovery, and run a longer proof of concept with legal and privacy sign-off.
Questions to ask vendors
- For our plan tier, is any prompt, file, output or connector data used to train or evaluate models, and where is that written in the contract?
- How long are prompts, responses, uploaded files and logs retained, in which regions, and by which sub-processors?
- Which connectors and MCP servers can administrators allow or block, and can users add their own?
- Does retrieval enforce source permissions at query time, and how are sensitivity labels honoured?
- Which actions can the assistant take on a user's behalf, and which require explicit confirmation? Can we disable each one?
- How do you defend against instructions planted in email, documents or web content, and how do you prevent data leaving through rendered images, links or unfurls?
- What exactly is logged for each interaction, how long, and how do we export it to our SIEM and eDiscovery tools?
- Which independent assurance reports cover this AI service, and what is out of scope?
- How are custom agents, their credentials and API keys owned, reviewed and revoked?
- How do you notify customers about AI-specific vulnerabilities that you fix server-side?
Red flags
- Training and retention commitments exist only on a web page the vendor can change, or differ between consumer and business tiers without clear terms.
- Users can connect their own third-party apps or MCP servers and administrators cannot block them.
- Audit logs record seat usage but not prompts, retrieved sources or actions.
- The vendor cannot describe controls on image rendering and link handling. EchoLeak 2025 and ForcedLeak 2025 both used rendered content to carry data out.
- Assurance reports exist but do not include the AI service in scope.
- Custom agents can be shared organisation-wide without owner, approval or expiry.
- No published process for AI security advisories. See Zero Click AI Agent Exploits.
Proof of concept
- Set success criteria from the evaluation table with owners in security, privacy, legal, IT and the business.
- Use a test tenant or a scoped pilot group with representative but non-critical data, and apply your intended admin policy before users start.
- Run a permissions test: place restricted and labelled documents and confirm pilot users cannot retrieve them through any prompt.
- Run hostile content tests: send mail and share documents with planted instructions and benign canary URLs you control; record whether any data reaches them through images, links, unfurls or actions.
- Test connector control: try to add an unapproved connector as a user and confirm it is blocked.
- Verify audit: reconstruct one full session, including sources and actions, from exported logs in your SIEM.
- Test lifecycle: remove a pilot user and a custom agent and confirm access ends within your SLA.
- Review the contract against what you observed and record exceptions before wider rollout.
How NHI Mgmt Group can help
We provide independent market analysis, RFP strategy and evaluation support for agentic AI and non-human identity programmes, including the connectors, tokens and agent identities that enterprise assistants depend on. Browse vendors in our NHI and AI products directory or contact us about independent evaluation support.
Related NHI Mgmt Group resources: Enterprise AI Copilot Security Guide · Generative AI Data Loss Prevention Guide · Zero Click AI Agent Exploits · AI Agent Identity Security Buyer's Guide