What is AI Security?

AI security is the practice of protecting AI systems, including models, training data, prompts, outputs, and the applications and APIs around them - from attack, misuse, and data exposure. It also covers using AI safely, so that models and agents can't be manipulated into leaking data or taking harmful actions.

AI security vs. traditional cybersecurity

How is AI security different from traditional cybersecurity?

Traditional cybersecurity protects networks, endpoints, applications, and data from known classes of attack, like malware, SQL injection, and DDoS attacks. AI security covers these needs but adds an additional layer of security concerns

Models are probabilistic, take natural-language input, and can be steered by the content they read, so the attack surface includes prompts, training data, and model behavior, not just code and infrastructure. This adds complexity to the existing security programs and strategies. 

Do traditional tools like WAFs and firewalls still matter for AI?

Yes. AI applications are still web applications and APIs, and they are vulnerable to injection, credential abuse, bots, and DDoS like any other service. Traditional controls remain the foundation, but additional measures are now necessary to adequately secure AI and against AI. 

What is the key technical difference?

In conventional software, code and data are separate, so inputs can be validated against a fixed format. In large language models (LLMs), instructions and data share one channel: plain language. A malicious instruction hidden in a web page, document, or email can be read as a command. 

Defenses must therefore inspect meaning and context, not just syntax.

What does AI security protect?

What assets does AI security cover?

Five main layers: the training and fine-tuning data, the model itself ( including its weights and configuration), the prompts and system instructions that steer it, the outputs it generates, and the applications, APIs, plugins, and agents that connect it to users and other systems.

Why does training data need protection?

Models learn from their data. If an attacker can alter it (data poisoning), the model can be given hidden biases or backdoors. If the data contains personal or proprietary information, the model can later reveal it. Securing data provenance, access, and integrity protects both accuracy and privacy.

Why protect the model?

Models are costly intellectual property. Attackers can try to steal one by querying it at scale and copying its behavior (model extraction), or probe it to learn what it was trained on. Access control and rate limiting reduce both risks.

What about users, brands, and downstream systems?

AI security also protects people and organizations from harmful output: leaked personal data, false statements made under your brand, or actions taken by an AI agent with excessive permissions, such as deleting records or sending payments.

Common AI security risks

What is prompt injection?

Prompt injection is an attack where crafted text makes a model ignore its instructions. It can be direct (a user types it) or indirect (hidden in a web page, file, or email the model reads). It is ranked first on the OWASP Top 10 for LLM Applications.

What is sensitive data leakage?

Models and the apps around them can expose personal data, credentials, or proprietary content, through memorized training data, over-broad retrieval from internal sources, or prompts and responses that are logged or shared carelessly.

What is data or model poisoning?

Attackers tamper with training data, fine-tuning data, or retrieval sources so the model learns or retrieves harmful content. Poisoned third-party models and datasets are a supply chain risk.

What is excessive agency?

AI agents that can call tools, APIs, or other systems may be tricked into misusing that access. The more permissions an agent holds, the more damage a successful manipulation can cause.

What other risks should teams plan for?

• Model theft and extraction: copying a model through high-volume querying.

• Abusive automation: bots and scrapers harvesting content, or flooding AI endpoints to drive up inference cost or cause outages (denial of wallet and denial of service).

• Insecure outputs: model responses passed unchecked into browsers, databases, or shells, enabling classic injection attacks.

• Supply chain weaknesses: vulnerable or malicious models, libraries, and plugins.

• Hallucination and misinformation: confident but false output relied upon for decisions.

AI security best practices

Where should a team start?

Inventory every AI system, model, data source, and third-party AI service in use, including unsanctioned "shadow AI"- you can't protect what you haven't found. Then rank each by the sensitivity of the data it touches and the actions it can take.

How do you defend against prompt injection?

No single control stops it. Combine layers: keep system instructions separate from user and retrieved content where possible, inspect inputs and outputs for manipulation attempts, treat all external content the model reads as untrusted, and require human approval for high-impact actions.

How should access be controlled?

Apply least privilege to users, applications, and especially AI agents. Give each agent only the tools and data it needs, use scoped, short-lived credentials, and keep API keys out of prompts and client code.

How do you protect data?

Classify data before it reaches a model, minimize and redact personal or confidential fields, vet training and retrieval sources, and control who can read prompt and response logs, since they often contain sensitive content.

How do you secure the surrounding application?

Protect AI endpoints like any critical API: authenticate callers, validate and rate-limit requests, filter bot traffic, and apply WAF and DDoS protection. Validate model output before passing it to browsers, databases, or other systems.

How do you keep security current?

Red-team models and agents before launch and regularly after, log and monitor AI traffic for anomalies, vet third-party models and libraries, and write an incident response plan covering AI-specific events. Frameworks such as the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework give a useful baseline.

How can Fastly help secure AI applications?

What does Fastly offer for AI security?

Fastly for AI applies security, access, and routing policies in the request path, at the edge, on the same platform that already delivers and protects web applications and APIs.

How does Fastly protect against prompt injection?

AI Firewall evaluates prompts in the request path and blocks LLM-based attacks, including prompt injection, before they reach the targeted model.

How does Fastly govern access to AI models?

AI Runtime Control routes model calls through a single endpoint across public and self-hosted providers. Virtual keys help protect underlying provider credentials, and teams get visibility into token spend, rate limiting, budget controls, and failover, while keeping their choice of models.

How does Fastly control what AI agents can do with APIs?

Fastly API Security enforces API contracts for agentic, agent-assisted, and conventional traffic. Teams can observe or block non-conforming requests service by service, which helps stop agents from calling unsupported operations, sending malformed requests, or acting outside defined API boundaries.

Which existing Fastly protections apply to AI applications?

AI applications are web applications and APIs too, so Fastly's proven protections still apply: Next-Gen WAF, Bot Management, DDoS Protection, ContentGuard, and API Discovery. Bot Management and ContentGuard also help control how external AI bots and scrapers access your content.

Do I have to change my code or move my models?

No. Fastly places controls in the request path rather than inside the model, so organizations keep their choice of models and infrastructure. Availability and packaging vary by product; talk to a Fastly expert for current details.

Where can I learn more?

Visit the Fastly AI hub or talk to an expert.