Map AI system trust boundaries and practice defensive analysis with permitted network logs and synthetic alerts. Build supervised incident-response workflows th
Last reviewed: 2026-10-03
AI security includes protecting models and their surrounding systems, as well as evaluating AI-assisted defensive workflows. Network traffic analysis can start with permitted packet captures and structured connection logs. Zeek is a passive analyzer that produces network records; those records provide evidence for investigation rather than automatic proof of malicious activity.
Automated incident response needs an explicit response policy and reliable evidence. Use synthetic alerts to practice enrichment, deduplication, and a proposed response, with human review before disruptive actions. NIST's incident-response guidance places preparation, detection, response, and recovery within ongoing risk management.
Start with the system's actual trust boundaries, data flows, and tool permissions. Use a threat model to decide which failures to investigate and how to limit their consequences.
Existing knowledge of identity, application security, logging, and incident response is relevant. Add bounded model and agent evaluations, and document where their failure modes differ from conventional software.