AI Security: risks, frameworks and first steps toward safer AI use.

The association’s role

The National Cybersecurity Association of Ukraine is a collaboration platform: an association of experts and market participants, not a service provider. In this area it supports standards for the safe adoption of AI, expert dialogue and the exchange of practice.

The idea is public-private collaboration: a conversation between public bodies, businesses, researchers and security practitioners about how to adopt artificial intelligence in a way that deserves trust. There is no formal partnership or public-private partnership contract behind this.

An expert council or working groups for this area are only proposed. For now this page is an explainer with sources, not the output of such groups.

What we mean by AI security

“AI security” is used for two different things. One is protecting AI systems from being broken or misused. The other is keeping people safe in a world where artificial intelligence has become an ordinary work tool. NIST’s generative AI profile names two linked information-security risks: these systems can lower the barrier to offensive cyber activity, and they widen the attack surface because they are themselves open to prompt injection (hidden instructions to the model) and data poisoning ¹.

For the National Cybersecurity Association of Ukraine, the second view comes first. The association does not protect models and is not responsible for anyone else’s systems. It cares about the customer, volunteer or patient whose data passes through them, and about shared reference points for the organisations responsible for keeping it safe.

This page is about the safe adoption of AI: tools your organisation buys and features it builds. AI used for defence and AI-enabled attacks are covered separately and briefly. There are no model-hacking walkthroughs or exploit steps here, on purpose.

How AI systems fail or get attacked

The most practical spine for talking about risk is the OWASP Top 10 for LLM Applications, 2025 edition ². Seven of its ten items are explained below in plain language. The other three (excessive agency, system prompt leakage, vector and embedding weaknesses) mostly concern builders and AI agents, and agents get their own section.

• Prompt injection. Instructions reach the model either directly from a user or hidden in a web page or file the model reads ³.
• Sensitive information disclosure. Personal, financial and health data, credentials and confidential business data can leak through the system ⁴.
• Supply chain. Weaknesses can sit in training data, models and the platforms they run on ⁵.
• Data and model poisoning. Someone tampers with pre-training, fine-tuning or embedding data ⁶.
• Improper output handling. Other systems trust the model’s output and use it without checking ⁷.
• Misinformation. The model produces false but credible-looking output ⁸.
• Unbounded consumption. Uncontrolled use of the model leads to outages and unexpected cost ⁹.

For readers who want more depth, MITRE ATLAS is a public knowledge base of adversary tactics and techniques aimed at AI systems ¹⁰. We link to it and do not reproduce its techniques. The OWASP list carries a 2025 label, so at every review we check whether a newer edition has replaced it.

Frameworks worth knowing

The NIST AI Risk Management Framework (AI RMF) is built around four functions: Govern, Map, Measure and Manage ¹². Version 1.0 is dated 26 January 2023 and the generative AI profile followed on 26 July 2024. NIST says AI RMF 1.0 is being revised ¹¹. The profile describes 12 risks, among them confabulation, data privacy, information integrity, information security, value chain and component integration, and human-AI configuration ¹.

The UK government’s Code of Practice for the Cyber Security of AI, published on 31 January 2025, sets out 13 principles across five lifecycle phases: secure design, development, deployment, maintenance and end of life. It is voluntary ¹³.

Several national agencies have also issued joint guidance: Deploying AI Systems Securely, of 15 April 2024 ¹⁴, and AI Data Security, of 22 May 2025, which covers data security and integrity across the AI lifecycle ¹⁵. On critical infrastructure, NIST published a concept note on 7 April 2026 for a trustworthy-AI profile for that sector ¹¹. The association gives no sector advice of its own yet.

AI agents: the fastest-growing risk

In this text, an AI agent (agentic AI) means a system that does not only answer but acts: it sends emails, changes files, makes purchases. OWASP calls the matching risk “excessive agency” and names three root causes: excessive functionality, excessive permissions and excessive autonomy ¹⁶.

The first joint guidance on careful adoption of agentic AI, released on 1 May 2026 by CISA, Australia’s ACSC and other partners, advises limiting access, starting with low-risk uses that involve no sensitive data, and including agents in the security model and risk assessments ¹⁷. Small and medium-sized businesses are among its stated audiences ¹⁸.

The UK NCSC (15 May 2026) advises thinking first, starting small, granting least privilege, using short-lived credentials, keeping human control and the ability to stop the system, and naming owners early ¹⁹. OWASP also published a separate Top 10 for Agentic Applications for 2026 on 9 December 2025 ²⁰.

Where a small organisation can start

A big budget is not needed to make a first move. Here are five steps, in an order you can take as a starting point:

1. 1Decide which data may go into AI tools, and write it down as a rule. The most sensitive categories are personal, financial and health data, credentials and confidential organisational information ⁴.
2. 2Find out which AI tools, models and platforms you use, and who maintains them ⁵.
3. 3Do not let other systems trust AI output blindly. Check it before it reaches an email, a database or a payment ⁷.
4. 4Give any agent the least access it needs, and require human approval for actions that cannot be undone ¹⁶.
5. 5Name an owner for each AI tool, and decide in advance how to switch it off ¹⁹.

Fuller checklists are in separate educational guides, one for small organisations and one for AI agents.

When something goes wrong

The UK code asks system operators to monitor how an AI system behaves and to have a way of communicating with the users it affects ¹³. The NCSC adds that incident response plans should cover agent failures, misuse and loss of control ¹⁹.

In Ukraine, an organisation can turn to CERT-UA, the government computer emergency response team. It works with technical data (logs, suspicious files), asks you to isolate the affected network first, and is not a punitive body ²¹. Individuals can start with the Cyber Police, which takes reports through a form on its website ²².

What the association does, and what it does not

The association publishes educational guides and explainers, each with a date, a version and a list of sources, and supports the exchange of experience among market participants. It does not run assessments, issue certificates, test AI systems or provide technical or legal services.