Book
Securing & Governing AI
The attack surface that is genuinely new, the risks that are old in new clothes, model risk, what audit evidence looks like, the frameworks, and how to be the function that enables.
Assumes AI from First Principles. Read that one first if any of it is unfamiliar.
CHAPTER 8
Prompt injection, and why it is genuinely new
The one AI risk with no equivalent in the security canon. Most explanations of it are wrong.
CHAPTER 9
What is old wearing new clothes
Most of the AI risk register is your existing risk register. Knowing which is which saves enormous effort.
CHAPTER 10
Data governance — the actual hard problem
Not glamorous, and the source of most real AI incidents to date.
CHAPTER 11
Model risk management
Banking has governed consequential models for a decade. Most of it transfers directly.
CHAPTER 12
Auditing an AI system — what evidence looks like
Read this if you have been asked to audit something nobody can quite explain.
CHAPTER 13
The frameworks — NIST, ISO 42001, EU AI Act
What each is for, which you need, and how not to waste a year.
CHAPTER 14
Being the function that enables
The argument this whole book is for.