AI Security for Enterprises: Threats, Frameworks and a 32-Question Vendor Questionnaire

TL;DR

• AI security for enterprises is the set of controls that stop AI systems from leaking data, being manipulated through their inputs, or taking actions nobody approved. It covers the model, the data it reads, and the agents that act on its output.
• The threats are documented. The OWASP Top 10 for LLM Applications puts prompt injection first, followed by sensitive information disclosure. NIST's AI Risk Management Framework and its Generative AI Profile give you the governance structure.
• When you assess an AI vendor, the questions that separate strong from weak are about permissions, agent approvals and prompt injection, not about certifications alone. A usable 32-question AI security questionnaire is below.
• Sentra checks each source's permissions at query time, treats a failed check as no access, and requires a named person to approve before it acts. It holds SOC 2 Type II and ISO 27001.

What AI security means for enterprises

AI security is the practice of protecting AI systems, and the data and tools they can reach, from misuse, manipulation and leakage. Enterprise AI security covers three layers: the data an AI system reads and stores, the model and its inputs, and the actions AI agents take in company systems.

Traditional application security assumes code does what it was written to do. An LLM does what its input persuades it to do. That is why AI security needs controls a SOC 2 report alone does not test: permission checks on every retrieval, separation of trusted instructions from untrusted content, and human approval before an agent writes, sends or pays.

The AI security threats that matter

The OWASP Top 10 for LLM Applications (2025 edition) is the most widely used list of LLM security risks.

OWASP also published a separate Top 10 for Agentic Applications for 2026 in December 2025, covering autonomous agents that plan, use tools and act. If your vendor ships agents, ask which of those risks it addresses.

Prompt injection: the risk to test first

Prompt injection happens when input changes an LLM's behaviour in ways its operators did not intend. OWASP separates direct injection, where a user types the attack, from indirect injection, where the model reads a web page, file or email that carries hidden instructions (genai.owasp.org).

Indirect injection is the enterprise problem, because assistants now read inboxes and shared drives. In June 2025, researchers disclosed EchoLeak, a zero-click flaw in Microsoft 365 Copilot tracked as CVE-2025-32711 with a CVSS score of 9.3. Microsoft fixed it, and The Hacker News reported no evidence of exploitation in the wild (thehackernews.com). Microsoft now documents classifiers that detect jailbreaks and cross-prompt injection attacks before model execution (learn.microsoft.com).

No vendor can promise that injection never works, which is why AI agent security depends on limiting what an agent can do. OWASP's mitigations assume it sometimes will and limit the damage:

• Constrain the model's role and validate outputs with deterministic code.
• Filter inputs and outputs for sensitive content.
• Apply least privilege, and handle privileged functions in code rather than through the model.
• Require human approval for high-risk actions.
• Separate and label untrusted external content.
• Run regular adversarial testing.

The strongest of these is the approval step. An injected instruction that reaches an agent which cannot act without a named person's approval has nowhere to go.

AI data security and permissions

AI data security fails most often through permissions, not breaches. An assistant connected to a shared drive will answer from whatever it can read. If its index was built with a service account that sees everything, every employee effectively sees everything.

Three design choices decide whether an AI system leaks internally:

1. Where permissions are checked. Checking at query time, against the source system, is stronger than copying permissions once at indexing.

2. What happens on failure. If a permission service times out, a safe system denies access. An unsafe one falls back to showing the result.

3. Whose permissions an agent uses. An agent acting for a person should see only what that person can see, never a broader service identity.

Microsoft documents that Copilot only surfaces data a user has at least view permission for (learn.microsoft.com). Ask every vendor for the same statement in writing, and test it in the pilot with a restricted account. Our AI agent permissions guide has a test plan.

Frameworks to anchor your AI security program

• NIST AI Risk Management Framework. Released on 26 January 2023, the AI RMF organises AI risk work into four functions: Govern, Map, Measure and Manage (nist.gov). NIST says it is being revised.
• NIST AI 600-1, the Generative AI Profile. Published on 26 July 2024, it names twelve risks specific to or worsened by generative AI, including Information Security, Data Privacy, Confabulation and Value Chain and Component Integration (nvlpubs.nist.gov).
• OWASP Top 10 for LLM Applications and for Agentic Applications. Use these as the technical test list.
• SOC 2 and ISO 27001. SOC 2 reports cover the AICPA's Security, Availability, Processing Integrity, Confidentiality and Privacy criteria (aicpa-cima.com). They show that a vendor runs a controlled operation. They do not show that its AI resists prompt injection.
• ISO/IEC 42001. The 2023 standard for an AI management system (learn.microsoft.com). Some large vendors now certify against it.

AI security questionnaire: 32 questions for AI vendors

Send this AI security questionnaire with your standard security review. Score each answer: 0 for no or a vague answer, 1 for yes with documentation, 2 for yes with evidence such as a demo, report or contract clause. A vendor below 40 of 64 needs a closer look. Any 0 in permissions or agent actions is a stop.

Data handling

• Q1. Is any customer data, including prompts, outputs and feedback, used to train or improve models? Good answer: no by default, with the contract clause.
• Q2. What data does the product copy out of our systems, and what does it read in place? Good answer: a data flow diagram per connector.
• Q3. How is data encrypted at rest and in transit? Good answer: named algorithms and TLS versions.
• Q4. Can we use customer-managed encryption keys? Good answer: yes, with the key service named and the effect of revocation explained.

Permissions and access control

• Q5. Are source permissions checked at query time, synced, or both? Good answer: checked against the source for every request.
• Q6. What happens when a permission check fails or times out? Good answer: the user gets no access.
• Q7. Does the system index content with a service account that sees more than end users? Good answer: if so, results are filtered per user before the model sees them.
• Q8. Do you support SSO, SCIM and role-based admin? Good answer: yes, with deprovisioning timing stated.

Agent actions and approvals

• Q9. Which actions can agents take without human approval? Good answer: none that send, change or pay, unless we configure it.
• Q10. Who approves an action, and is that person named in the record? Good answer: a specific named approver per action.
• Q11. Whose permissions does an agent use when it acts? Good answer: the permissions of the person it acts for.
• Q12. Can we restrict agents to specific systems and actions? Good answer: per-agent allow lists that admins control.

Prompt injection defenses

• Q13. How do you separate trusted instructions from untrusted content such as emails and web pages? Good answer: content is labelled and isolated from instructions.
• Q14. Which injection detection controls run before the model executes? Good answer: named classifiers or filters, with known limits.
• Q15. How do you limit damage if an injection succeeds? Good answer: least privilege plus approval before actions.
• Q16. When did you last run adversarial testing, and by whom? Good answer: a date, a scope and a summary of findings.

Audit logs

• Q17. What is logged for each answer and action? Good answer: user, sources used, action, approver and time.
• Q18. Can we export logs to our SIEM? Good answer: yes, through an API or streaming integration.
• Q19. How long are audit logs kept, and can we set that? Good answer: configurable retention.

Deployment and data residency

• Q20. Which deployment options exist: multi-tenant, single-tenant, VPC in our cloud, on-prem, air-gapped? Good answer: a written list with what runs where.
• Q21. In which regions is data stored, and where does inference run? Good answer: both answered separately.
• Q22. Which components call outside our boundary in a VPC or on-prem deployment? Good answer: none, or a named list.

Certifications

• Q23. Which certifications cover the exact product and deployment we are buying? Good answer: SOC 2 Type II report and ISO 27001 certificate with scope.
• Q24. Do you map controls to the NIST AI RMF or OWASP Top 10 for LLM Applications? Good answer: a control mapping document.
• Q25. Do you hold or plan ISO/IEC 42001? Good answer: a clear status, not a vague roadmap.

Models and subprocessors

• Q26. Which model providers process our data, and under what terms? Good answer: named providers and their data terms.
• Q27. Can we choose or restrict the models used? Good answer: yes, with admin controls.
• Q28. Where is your full subprocessor list, and how are we notified of changes? Good answer: a published list and advance notice.

Retention and deletion

• Q29. How long are prompts and outputs retained? Good answer: a stated period, configurable down to zero where possible.
• Q30. How do we delete specific data, and how fast is it purged from backups? Good answer: a documented process with timelines.
• Q31. What happens to our data and derived context when we leave? Good answer: full export, then verified deletion.
• Q32. When a source document is deleted, does derived content disappear too? Good answer: yes, including indexes and memory.

Where Sentra fits in an AI security review

Sentra is the company intelligence and memory that assistants and agents draw on. That puts it in the path of the highest-risk questions above, and it is built to answer them directly.

On permissions, every answer and action respects each source's existing permissions, through query-time checks and synced access lists, and a failed check counts as no access. That answers Q5, Q6 and Q11. On agent actions, a named person approves before Sentra acts or sends anything, which answers Q9 and Q10 and caps the damage an injected instruction can do.

On deployment, Sentra runs in the cloud, an isolated VPC or air-gapped on-prem. It holds SOC 2 Type II and ISO 27001. It knows when each fact became true and when it stopped being true, which reduces the misinformation risk OWASP lists as LLM09, because stale facts are not served as current.

Sentra connects to ChatGPT, Claude, Copilot, Gemini and internal agents over REST and MCP. Each of those tools gets the same permissioned context, so your security team reviews one memory layer instead of one per assistant. For the related deployment questions, see our enterprise AI memory guide, and for unsanctioned tools, our page on shadow AI.

To walk through this questionnaire against Sentra with your security team, book a demo.

How to run an AI vendor assessment

1. Classify the use case. Read-only assistance, write access to systems, and customer-facing agents carry different risk. Set the bar per class.

2. Send the questionnaire first. Use the 32 questions above with your standard security review. Score them before any demo.

3. Test, do not trust. In the pilot, run a restricted-user test, plant a harmless injected instruction in a test document, and try to trigger an action without approval.

4. Map to a framework. Record results against NIST AI RMF functions and OWASP IDs so the assessment is repeatable.

5. Write the controls into the contract. Training exclusion, retention, residency, subprocessor notice and deletion on exit belong in the agreement.

6. Reassess on change. New models, new connectors and new agent permissions each reopen the review.

FAQ