Disclosed Data Exfiltration Vulnerabilities in RAG-Based Enterprise Products
Researchers discover how attackers exfiltrate data from enterprise AI without user interaction.
Marcus Abubakar-Osei
AI Procurement Security — Page 3
AI Copilot Vulnerabilities Disclosed in Microsoft Security Update Guides
Microsoft's AI assistants share four recurring vulnerability patterns across products.
Priya Nallasivan
System Prompt Confidentiality Leakage Disclosures in Commercial LLM Products
Researchers document how attackers extract secret instructions from AI chatbots.
Marcus Abubakar-Osei
Model Provenance Verification in Enterprise AI Product Assessments
AI models shift constantly through supply chains, making static vendor assessments obsolete.
Tomás Eguiguren
Weighting Attack Surface Criteria in AI Product Security Scorecards
Standard security scorecards miss AI's semantic attack surface entirely.
Marcus Abubakar-Osei
Evaluating AI Vendor SOC 2 Reports for AI-Specific Control Gaps
Standard SOC 2 reports miss critical AI-specific risks like model drift and hallucination.
Priya Nallasivan
Vendor AI Asset Inventory as a Pre-Procurement Security Requirement
Buyers must demand a complete AI asset inventory before signing any vendor contract.
Priya Nallasivan
Data Exfiltration Risk Scoring for LLM-Based Enterprise Products
A four-factor scoring model that TPRM teams can run repeatedly to assess LLM vendor risk.
Priya Nallasivan
Prompt Injection Resistance as an Enterprise AI Procurement Criterion
Organizations must make prompt injection resistance a hard requirement, not a checklist item.
Tomás Eguiguren
Notion AI Data Residency and Prompt Confidentiality Controls
Enterprise plans get zero-retention AI by default, others don't.
Marcus Abubakar-Osei
OpenAI API Enterprise Security Controls and Compliance Posture
OpenAI's security controls differ between API and ChatGPT Enterprise, requiring separate audits.
Marcus Abubakar-Osei
Workday AI Features Vendor Transparency and Security Disclosure Audit
Workday publishes AI governance docs, but independent verification remains incomplete.
Tomás Eguiguren