The AI Security Review to Run Before Deployment

Run the review before the agent gets credentials, not after. Seven checks cover most of the risk: who owns the agent, what it is allowed to touch, how long its credentials live, where untrusted text can enter, what happens to its output, what gets logged, and who can stop it. None of that needs a security team. All of it has to exist in writing before the first production connection.

Almost nobody does it. IBM’s Cost of a Data Breach Report 2026, published 29 July 2026, found that only 38% of organisations require IT approval before an AI system is deployed, down from 45% a year earlier. Of the organisations that suffered an AI-related breach, 92% had no basic access controls on their AI models and data.

What is an AI security review?

An AI security review is a written check, completed before an AI system touches real data, covering who owns it, what it may access, how its permissions expire, how untrusted input is contained, how its output is handled, what it logs, and who can shut it off. It is a scoping exercise, not a penetration test. A competent operator can finish one in an afternoon.

Why the review keeps getting skipped

AI agents arrive through the business, not through IT. A marketing lead connects a tool to the CRM. An ops manager gives an assistant read access to the shared drive. Nobody files a ticket, so nobody reviews anything.

The IBM 2026 report measures the result. Shadow AI appeared in 43% of security incidents, up from 20% the previous year, at an average cost of USD 5.39 million per incident, and 21% of those incidents produced a regulatory fine. Sixty-eight percent of breached organisations had no AI governance policy capable of managing AI use or detecting shadow AI, up from 63%. Approval rates fell while deployment rose.

The seven checks to run before an agent touches production data

1. Name an owner, an approver and a stopper

Three names, written down, before anything connects. Who owns this agent, who approved its access, who monitors it, and who has the authority and the mechanism to stop it mid-run.

The joint guidance published 1 May 2026 by CISA, the NSA, Australia’s ACSC, the Canadian Centre for Cyber Security, NCSC New Zealand and NCSC UK, titled Careful Adoption of Agentic AI Services, puts this before every technical control. NCSC UK’s companion post of 15 May 2026 names the four things that change with agents: broader access, unpredictable behaviour, problems that are harder to spot, and behaviour that is challenging to explain. If you cannot monitor or contain what the agent does, it is not ready.

2. Give it the smallest permission set that does the job

The OWASP GenAI LLM Top 10 2026, published 4 August 2026, moved Excessive Agency from sixth place to third, its biggest climb. Excessive Agency means the agent was allowed to do more than its task required: write access where read would do, a whole database where one table was needed, a company inbox where a single alias would have worked.

Start from zero and add. A quoting agent needs the price list and the quote template. It does not need the payroll folder because both live on the same drive.

3. Make the credentials expire

Long-lived API keys are the default in most tooling and the wrong choice for an agent. Use short-lived, scoped tokens tied to the task, so a leaked credential dies on its own. In the IBM 2026 data, compromise of connected applications, APIs and plug-ins was a root cause in 27% of AI-related breaches, level with cloud misconfiguration.

4. Draw the line where untrusted text enters

Prompt injection sits at number one in the OWASP 2026 list. The mechanism is simple: any text the agent reads can contain instructions, and an agent that reads a customer email, a supplier PDF or a web page is reading text you did not write. IBM put the average cost of a breach involving prompt injection at USD 5.89 million, against a global average breach cost of USD 4.99 million.

Mark every input as trusted or untrusted before go-live. Untrusted input must not be able to reach a privileged action without a human in between.

5. Treat the agent’s output as untrusted too

Improper Output Handling is still on the OWASP 2026 list. If agent output is passed straight into a shell, a database query, an email send or a page render, then whoever controls the input controls those systems. Anthropic’s threat intelligence review of 3 June 2026, covering 832 banned accounts from March 2025 to March 2026, found attackers shifting AI use toward post-compromise stages, with the share of operations rated medium risk or higher rising from 33% in the first six months to 56% in the second.

6. Log every action so someone who was not there can read it

One line per action: what ran, when, on whose authority, what it changed. If your only record is a chat transcript, you cannot answer the questions an incident produces, and you cannot answer a regulator either. We covered the operational side of this in the guardrails that let agents run unattended.

7. Attack it yourself, then write the stop procedure

Spend an hour trying to make the agent do something it should not: feed it a hostile document, ask it to act outside its fence, see whether it refuses or complies. Only 25% of organisations in the IBM 2026 study run adversarial testing of their AI, and only 19% have their governance and security teams coordinating at all. Then write the two-line stop procedure: revoke this key, disable this job. Test that it works while nothing is wrong.

What it costs to skip the review

Average breach cost by AI incident type, from the IBM Cost of a Data Breach Report 2026 (602 organisations breached between March 2025 and February 2026):

AI incident type	Average breach cost	Against the USD 4.99M global average
Model inversion	USD 6.07M	+22%
Prompt injection	USD 5.89M	+18%
Cloud misconfiguration affecting AI	USD 5.25M	+5%
Malicious model	USD 4.94M	level
Connected apps, APIs and plug-ins	USD 4.37M	-12%
Insecure deployment	USD 4.34M	-13%

Source of the deployment also matters. Breaches were most common where AI came from open-source components or third-party SaaS, at 26% each, and least common for systems built in-house, at 15%. Your vendor list is part of your attack surface, which is why the review covers tools you bought as well as agents you built.

Do you need ISO 42001 to do this properly?

No. ISO/IEC 42001:2023 is a management system standard covering policy, roles, impact assessment and monitoring. It is voluntary, ISO does not certify anyone itself, and independent certification bodies do the auditing under ISO/IEC 42006:2025, published in 2025 to set what those auditors must be able to do. It is worth pursuing if your buyers ask for it. It is not the technical checklist.

For controls, the free public material is better. NIST’s AI Risk Management Framework organises the work into four functions, GOVERN, MAP, MEASURE and MANAGE, and NIST opened its SP 800-53 Control Overlays for Securing AI Systems with a concept paper on 14 August 2025, followed by an annotated discussion draft on 8 January 2026. Between that and the OWASP 2026 list, the control side is covered without a certification budget.

Compliance overlaps here too, since an AI system inventory is the first artefact both a security review and a regulator want. We mapped that side in which AI regulations actually apply to your business.

How we run this on our own fleet

Every agent in our group is registered before it runs. Each one has an identity, a named owner, a defined fence, and a run log. A tomte, our word for one production agent with one defined job, does not get credentials until those four things exist. In one measured 13-day stretch the fleet ran 5,450 times with zero failures, across 41 agents, and the reason is bookkeeping rather than luck. The full account is on our agent fleet page.

The same discipline is what an AI operations audit produces for a business that already has agents running: the inventory of what is deployed, what each one can reach, and which ones would fail the seven checks above. It is a $1,900 fixed price, ten working days, and the output is a build list rather than a strategy deck.

If you have agents in production and cannot name their owners, start there. Send us what you have in writing and we will reply within one business day with the list of what to check first. No call required. Start async.