AI changes both what we protect and how we protect it. Traditional, perimeter-centric tools like firewalls and classic network DLP were designed for predictable, deterministic systems and on-premises networks. AI and GenAI work differently:

• AI is data-centric: GenAI depends on the quality, lineage, classification, and protection of underlying data. That makes enterprise data more valuable to the business and more attractive to attackers.
• Traffic is encrypted and dynamic: AI traffic is often encrypted, and outputs change from request to request. Static, signature-based controls struggle to see or reliably detect risky behavior.
• Attackers are already using AI: Adversaries are using AI to increase the volume and quality of phishing, scams, and other attacks, and they are actively targeting AI applications and data.

Because of this, organizations are moving to a Zero Trust model that is asset- and data-centric rather than network-centric. In practice, that means:

• Verify explicitly: Continuously validate users, devices, and sessions using all relevant signals.
• Use least privilege access: Apply just-in-time and just-enough-access, with adaptive access policies.
• Assume breach: Design as if attackers can compromise identities, devices, apps, or infrastructure, and limit blast radius.

For AI specifically, this shift helps you:

• Protect AI applications and data wherever they live (cloud, SaaS, mobile, etc.).
• Integrate security early into AI projects instead of bolting it on later, when fixes are more expensive.
• Use AI itself to accelerate security operations, automation, and Zero Trust adoption.

In short, AI pushes security teams to reimagine their strategy around data, assets, and continuous verification, rather than relying on a static network perimeter.

Zero Trust gives you a practical framework to secure AI by focusing on assets and data instead of just the network. For AI initiatives, this plays out in several concrete ways:

1. Protect AI applications and data from the start

• Embed security experts into AI solution design and development, rather than reviewing only at the end.
• Favor SaaS and PaaS AI services where possible to avoid taking on unnecessary “build your own AI” risk.
• Apply data classification, encryption, and access controls directly to the data AI uses and produces.

2. Move from network-centric to data-centric controls

• Use identity-based access, sensitivity labels, and adaptive access policies to control who can see what in AI tools.
• Ensure AI applications respect existing permissions and labels so they don’t surface sensitive content to unauthorized users.
• Recognize that network controls alone cannot protect data on cloud services, mobile devices, or external AI platforms.

3. Use AI to accelerate Zero Trust

• Leverage GenAI to automate data discovery and classification across large data estates.
• Use AI to guide incident responders, summarize attack impact, and generate investigation reports.
• Generate secure-by-design automation (scripts, workflows) to reduce repetitive manual tasks and human error.

4. Address legacy gaps in data security and governance

• Update or create formal data classification policies and ensure they are consistently applied.
• Combine policy with technical controls in both data stores and AI applications.
• Use AI to identify unusual data movement patterns that may indicate insider risk, mistakes, or exfiltration.

By aligning AI projects with Zero Trust principles—verify explicitly, use least privilege, and assume breach—you create an environment where AI can safely drive productivity and innovation without exposing the organization to unmanaged data and security risks.

Securing AI is a shared responsibility between your organization and your AI provider, similar to cloud security. The split depends on how you consume AI:

1. IaaS (Infrastructure as a Service) – “Build your own model”

• The provider (e.g., Azure) secures the underlying infrastructure.
• Your responsibilities: model security, training data governance, application security, and how AI is used.

2. PaaS (Platform as a Service) – Using Azure AI and similar platforms

• The provider delivers AI capabilities with many embedded controls.
• Your responsibilities: securing the custom AI application you build on top, configuring controls, and governing usage and data.

3. SaaS (Software as a Service) – Managed AI services and Copilot-style tools

• The provider manages the AI service and its underlying platform.
• Your responsibilities: identity and access management, data you connect to the service, configuration, and user behavior.

Three practical focus areas

To operationalize this shared model, focus on three pillars inside your organization:

1. AI usage: User training, acceptable use policies, identity and access controls, and data governance.
2. AI applications: Secure design of plugins, integrations, and infrastructure; safety systems to prevent unintended disclosures.
3. AI platform: Understanding the provider’s controls for model safety, accountability, tuning, and training data governance, and aligning your controls with them.

In practice, this means you should:

• Document who owns which controls for each AI deployment type (IaaS, PaaS, SaaS).
• Plan security investments around that division of responsibility.
• Regularly review provider guidance (for example, Microsoft’s Responsible AI Standard) and map it to your internal standards.

This shared approach helps keep AI systems secure and resilient as threats and AI capabilities continue to evolve.