Your controls guard the app, not the model
Patching, access control and a firewall protect the system around your AI. None of them notice an input crafted so the model itself decides wrongly — and the model is the part making the decision.
Adversarial AI
Attackers stopped hacking your code. They started teaching your model.
Attacks on AI look nothing like attacks on software. They poison what a model learns, talk an assistant into acting, or copy your model out through its own answers — and none of it trips the controls you already run. These are the six domains we work in, and what we can take off your plate.
We test you against
29
named AI threats we work against
Six
domains, from training data to live agents
100%
of findings confirmed by a named human
portal.cyberlysecure.com/acme-health/ai-threats
Acme Health — AI threat model29 threats screened · six domains
Live- T06-T08Training data & model integrityNo backdoor
- T26-T29AI supply chain2 models unpinned
- T09-T16Live model & privacyExtraction viable
- T17-T25Assistants & agentsRe-testing
- DESIGNSecure by designIn the pipeline
Ranked high enough to act on now6 of 29
Mapped to ATLAS, NIST and OWASP
Threat library 29 named
Every finding proven by a person
The gap
Everything you already do stops at the model.
Your security programme is built for software: code, hosts, identities, networks. An AI system is software wrapped around something that learned its behaviour from data — and that part is defended by almost nothing you currently own.
What it learned from is attack surface
Change a fraction of the data a model learns from and you change what it does for good. No code is touched, no alert fires, and the damage is already baked in by the time it ships.
Your data science environment is production
It holds live data, pulls packages straight from the internet and loads model files that can execute code when opened. It is almost never secured like the production system it effectively is.
A model gives itself away by answering
With nothing but the API you published, someone can rebuild a working copy of your model, reconstruct what it was trained on, or work out whose records were in the training set.
The domains
Six domains, from the training data to the live agent.
Adversarial AI is not one discipline. It is six, and an attacker only has to be good at whichever one you neglected. Pick any of them to see what it covers and what it would give you.
Domain 1 of 6
Training data & model integrity
The most durable attack on an AI system does not happen at runtime. It happens while the model is still learning — and then waits quietly inside it until an attacker decides to pull the trigger.
What this domain covers
- Data poisoning that bends what your model does, including clean-label versions that never touch a label.
- Backdoors and hidden triggers, built to stay dormant until they meet a pattern only the attacker knows.
- Tampering with the model file itself — malicious layers, unsafe serialization, edited weights, hijacked behaviour.
What that gets you
- Know your model learned what you meant it to learn.
- Know nothing is sitting inside it waiting for a trigger.
- Evidence that the integrity of your training pipeline holds.
Before launchwhere the durable attacks land
Ask what this would look like for you Domain 2 of 6
The AI supply chain
Almost nobody trains from scratch. You start from someone else’s model, someone else’s dataset and a stack of packages nobody read — and you inherit everything that was ever done to them.
What this domain covers
- Pre-trained models, adapters and merges brought in from outside, and what transfer learning quietly carries across with them.
- Third-party datasets, and the poisoning that survives being reused by everyone downstream.
- ML packages, notebooks and model formats that can run code the moment something loads them.
What that gets you
- Know where every model and dataset you depend on came from.
- A bill of materials for your AI, not only your software.
- A safe route for bringing outside models in, instead of a ban nobody follows.
Inheritedrisk you did not create
Ask what this would look like for you Domain 3 of 6
Attacks on your live models
Once your model is serving traffic, an attacker needs neither your code nor your weights. They need your API and some patience: small, deliberate nudges to an input until your model is confidently, usefully wrong.
What this domain covers
- Evasion attacks that walk an input across your model’s decision boundary while still looking ordinary to a person.
- Adversarial patches that work in the physical world, and text attacks that flip a classifier’s mind on a sentence.
- Inputs engineered to be expensive, where your own inference bill is the payload.
What that gets you
- Know how your model behaves when somebody is actively trying to fool it.
- Know which decisions it gets wrong under pressure — before a customer finds out.
- Robustness you can point at, rather than assume.
Black boxyour published API is enough
Ask what this would look like for you Domain 4 of 6
Privacy, model theft & data extraction
Your model is intellectual property. Your training data is somebody’s personal information. Both can walk out through nothing more exotic than ordinary use of the interface you already published.
What this domain covers
- Model extraction — rebuilding a working copy of your model out of its own answers.
- Model inversion and training-data extraction — reconstructing what it was taught from.
- Membership and attribute inference — establishing whose records were in your training set, and what they said.
What that gets you
- Know what your model discloses before a competitor or a regulator does.
- Privacy protections chosen for what you actually hold, not for a checkbox.
- An answer ready for the question your counsel is going to ask.
No accessneeded beyond your own API
Ask what this would look like for you Domain 5 of 6
Generative AI, agents & deepfakes
An assistant reads a document and follows the instructions hidden inside it. An agent holding tools turns that into an action. And the person on the video call is not who your finance team believes it is.
What this domain covers
- Direct and indirect prompt injection, including payloads planted in the very documents your retrieval layer trusts most.
- Poisoned embeddings and fine-tuning data, and unsafe handling of whatever the model hands back.
- Excessive agency and agent hijacking — what happens the moment a talked-into answer becomes a taken action.
- Deepfakes and generated lures aimed squarely at your people, and detection that has to keep pace with them.
What that gets you
- Know your assistant cannot be talked into harming a customer.
- Know exactly what your agents can reach, and what they must never reach.
- People prepared for a lure that looks and sounds completely right.
Read = runfor an assistant holding tools
Secure AI & governance Domain 6 of 6
Secure by design & MLSecOps
Every domain above produces findings. This one is how they stop coming back: security in the AI life cycle from the first design conversation, rather than bolted on the week the audit lands.
What this domain covers
- Threat modeling your AI against a real library of named threats, not a generic checklist someone adapted.
- Risk-based prioritization, with every mitigation mapped to a control your organization already recognises.
- Security inside the ML pipeline itself — provenance for data and models, and an AI bill of materials.
- A programme that matures across identify, protect, detect, respond and recover.
What that gets you
- Security designed in, instead of discovered late and expensively.
- One threat model your engineers, your auditors and your board can all read.
- A way of working that keeps holding after we have gone.
Designed innot bolted on at the end
Ask what this would look like for you The threat map
Twenty-nine named threats. Not all of them are yours.
The industry has spent years turning a chaotic research field into a working library of named threats. That is the useful part: instead of arguing about what could happen, we start from what is known to happen, and find which of it your architecture is actually exposed to.
| Group | Named | What it targets | What sits in it |
|---|---|---|---|
| Traditional cyber threats | 5 | The system around your AI | Data leaks, tampering, malware, privilege escalation and denial of service — every one of them sharper here, because AI environments hold live data. |
| Adversarial AI attacks | 11 | The model itself | Data poisoning, backdoors, model tampering, model theft, evasion, reprogramming, extraction, inversion, membership and attribute inference, and model denial of service. |
| Generative AI & agents | 9 | Assistants, retrieval and autonomous agents | Direct and indirect prompt injection, data disclosure, insecure output handling, excessive agency, agent hijacking, training-data extraction, model replication and outright misuse. |
| Supply chain | 4 | Everything you brought in from outside | Compromised third-party models and datasets, vulnerable or malicious ML packages, and the development and hosting systems underneath them. |
From the library to your shortlistIllustrative — one assistant-and-retrieval application
Named threats in the working library29
Ones your architecture can be hit by17
Ranked high enough to act on now6
Closed by controls you already run4
That needed something genuinely new2
The point of a threat model is the narrowing. A list of everything that could go wrong is not a plan — and of the six worth acting on, four closed with controls this team already ran.
Expressed in the taxonomies your organization already uses
MITRE ATLASNIST AI 100-2OWASP AI ExchangeOWASP Top 10 for LLM ApplicationsNCSC & CISA — Secure AI System DevelopmentNIST Cybersecurity Framework
The threat groups and domains on this page follow the established adversarial-AI literature and the public taxonomies it consolidates: MITRE ATLAS, NIST AI 100-2 (Adversarial Machine Learning: A Taxonomy and Terminology), the OWASP AI Exchange, the OWASP Top 10 for LLM Applications, and the Guidelines for Secure AI System Development published jointly by the UK NCSC and the US CISA. Counts describe that shared threat library, not a CyberlySecure product.
What changes
Six things that stop being quietly true.
None of these are unusual. Most organizations shipping AI today have all six, because the tooling arrived years ahead of the security thinking around it.
A test that stopped at the app
Where most teams are
Your last assessment covered the web front end and never touched the model behind it.
Where we get you to
The model, its data, its pipeline and its agents all tested as first-class parts of the system.
Data taken on faith
Where most teams are
Training and retrieval data trusted because it came from somewhere that felt reputable.
Where we get you to
Provenance for what you depend on, and testing that looks for what was done to it.
Borrowed models, unknown history
Where most teams are
A pre-trained model pulled from a hub and shipped, along with whatever came with it.
Where we get you to
An AI bill of materials, and a safe route for bringing outside models in.
Assistants that trust what they read
Where most teams are
Any document, ticket or web page able to hand your assistant instructions.
Where we get you to
Injection, poisoned retrieval and agent reach tested the way an attacker would try them.
A model that answers too honestly
Where most teams are
No idea what your API reveals about your model or the people in its training data.
Where we get you to
Extraction, inversion and inference measured, with privacy protections chosen to match.
AI security nobody owned
Where most teams are
Security consulted after the model shipped, if it was consulted at all.
Where we get you to
Threat modeling from the design conversation on, and security built into the pipeline.
Working with you
And we help you build it, not just find it.
Half of this work is done to your systems. The other half is done with your team — because the question landing on your desk is not only “can this be attacked”, it is “what should we be building, and what should we refuse to build”.
Threat-model your AI properly
We map your real architecture against the library of named AI threats, rank them by what they would cost your business, and leave you a model your engineers and your auditors can both read.
Red-team the models and agents you ship
Adversarial testing of your assistants, your retrieval layer and your agents — repeated whenever the prompt, the model or the tools change, because any one of the three changes the answer.
Get the AI supply chain under control
Provenance for the models, datasets and packages you depend on, and an AI bill of materials you can put in front of a customer without flinching.
Keep private data private
Anonymization, differential privacy, federated approaches and encryption weighed against what you actually hold — so the data is protected without ruining the model that needs it.
Build security into the ML pipeline
The checks, provenance and gates that make the secure path the easy path for your teams, instead of a review they plan around.
Mature the programme
Where AI security belongs inside your enterprise security, who owns it, and what good looks like across identify, protect, detect, respond and recover.
Where it stops
The machines find candidates. A person finds the truth.
Anyone selling you a fully autonomous security programme is selling you confident guesses. A model that is wrong with conviction does not save your engineers time, it spends it — a day at a stretch, on something that was never there.
So we drew a line, and we would rather you knew exactly where it is before you hire us than afterwards.
How we work safely What a machine never does here
- No finding reaches you until a person has proven it is real.
- No model decides what your business cannot afford to lose — you do, and we listen.
- No black box: you see what was looked at, what was found, and why it matters.
- Nothing is touched that you have not authorized us to touch, in writing.
- Your data never trains third-party models, and it is destroyed when the work is done.
- Every report carries the name of the person who stands behind it.
Find out which of the twenty-nine actually apply to you.
Tell us what your AI touches and what it is allowed to do. You will talk to a tester, not a sales rep.