A framework for securing AI in the enterprise

Darktrace’s December 2025 blog post argues that securing AI in the enterprise requires a lifecycle-focused framework that spans models, data and agents, rather than relying on traditional security silos. It outlines five risk categories aligned to distinct layers of the AI ecosystem: defending against misuse and emergent behaviours, monitoring and controlling AI in operation, protecting AI development and infrastructure, securing the AI supply chain, and strengthening readiness and oversight.

The piece emphasises that AI security cannot be reduced to model safety or perimeter controls alone, since a single AI interaction can involve identity misuse, data exposure, and supply chain risk within the same workflow. It also notes that AI adoption introduces governance and training needs, with recommendations for AI-aware reporting, red and purple team exercises, and ongoing staff development.

According to ISO/IEC 42001 and the NIST AI Risk Management Framework, mapping AI security efforts to recognised frameworks helps demonstrate maturity and align security with broader governance objectives. The post, authored by Brittany Woodsmall and Simon Fellows, further discusses how to frame the security conversation for boards and provides a downloadable full framework.