Industries
AI for Information Security
AI changes information security in two directions at once. Attackers use it to scale phishing, voice fraud and reconnaissance, and organizations deploy AI systems that bring new attack surfaces: prompt injection, data leakage through assistants, poisoned training data and over-privileged agents.
The position
Most security programmes were designed around applications and infrastructure. An AI assistant connected to email, files and business systems behaves like a user with broad access and no fixed script, and the existing controls rarely describe it.
We help security teams extend their frameworks to cover AI systems, assess AI-specific risks, and govern the AI tooling the security function adopts for itself.
What is pressing
Four pressures specific to this sector.
01
AI as a new attack surface
Prompt injection, data exfiltration through model outputs and agents acting with excessive permissions are threats most control libraries have yet to name. They need owners, tests and monitoring of their own.
02
Data leaving through assistants
Staff paste contracts, code and customer records into public tools. The realistic control combines an approved alternative, clear rules and technical guardrails, rather than a ban alone.
03
Alignment with UAE standards
UAE information assurance standards, sector regimes such as ADHICS in Abu Dhabi health and the Dubai Electronic Security Center's requirements all predate generative AI. Mapping AI controls onto them avoids a parallel framework.
04
AI inside the SOC
Security teams are adopting AI for triage and investigation. Those tools need the same scrutiny the team would apply to any system with access to sensitive telemetry.
Where the divisions apply
Which divisions this sector uses, and in what order.
Listed most relevant first. Most organizations in this sector enter through the first and draw on the others later.
03
AI Audit
Prove the AI you already run does what you say it does.
Read the division02
AI Governance
Build your AI governance framework before regulation forces you to.
Read the division01
AI Strategy
Know where AI creates value in your organization before you spend on it.
Read the division06
Learning and Development
Send your board into an AI decision able to ask the right questions.
Read the divisionQuestions
What this sector asks first.
- Does ISO/IEC 27001 already cover AI?
- It covers the information around AI systems, not the behaviour of the models themselves. ISO/IEC 42001 and ISO/IEC 23894 add AI-specific management and risk guidance, and the two sets of controls are designed to sit together.
- Should we block public AI tools?
- Blocking alone tends to push usage onto personal devices. A sanctioned tool, a short acceptable-use rule and data-loss controls give security teams visibility as well as protection.
- Where should a security team start?
- With an inventory of AI systems and the data and permissions each one has, followed by a threat assessment of the highest-access ones. Agents and assistants connected to internal systems usually come first.