Reviewed 11 October 2026
An AI label does not tell you which attack a security product stops. Buy coverage for a defined asset and failure mode, and make somebody responsible for investigating the alerts. A small company with no response process can spend heavily and still remain exposed.
Direct answer: prioritize identity, endpoint protection, network access, central logging, recovery, AI application controls and a staffed response path. Evaluate products against those seven controls rather than a promised detection percentage.
Seven controls and their evidence
Start with an asset inventory covering employee devices, cloud identities, production services, data stores and AI integrations. Record which systems can access customer data and which can execute writes. An abandoned service account with broad permissions can be more consequential than the latest model vulnerability.
Identity controls establish who can enter and what they can do. Endpoint controls observe suspicious device behaviour. Network controls reduce unnecessary access. Logging preserves evidence. Recovery restores trustworthy service. AI application controls validate inputs, outputs and tool permissions. Response connects all of this to a person who can contain an incident. None is replaced by a conversational security assistant.
The OWASP LLM risk list identifies application-specific problems such as prompt injection, sensitive information disclosure, improper output handling and excessive agency. These are not all malware problems. A document can contain instructions that try to redirect an agent even when the endpoint scanner considers the file clean. The application needs its own trust boundaries and constrained tools.
Match product capability to the gap
Microsoft Sentinel is a cloud-native SIEM for security analysis and response. Cloudflare’s SASE products cover network and identity-aware access patterns. These categories can complement endpoint protection; they do not make products interchangeable. The NIST AI RMF provides a framework for managing AI risk, not a product certification or a guarantee of detection.
| Control | What to demonstrate | Common blind spot |
|---|---|---|
| Identity | Restricted roles and credential revocation | Shared or abandoned accounts |
| Endpoint | Detection and isolation on owned devices | Unmanaged contractors and servers |
| Network | Authenticated access to private services | Broad exceptions that bypass policy |
| Logging | Useful events with retention and export | Alerts without enough investigation context |
| Recovery | A tested restoration from protected backups | Backups never restored or exposed to attackers |
| AI application | Safe tool permissions and validated outputs | Prompt injection through retrieved content |
| Response | Named escalation, containment and follow-up | Nobody monitors the dashboard |
Request a quote for the required endpoint count, log volume, retention, region and service level. A SIEM cost cannot be reduced to a universal monthly number because ingestion and data retention affect the bill. Managed response is a separate staffing decision. Clarify what the supplier monitors, what it can isolate and which actions require your approval.
A procurement test that operators can review
Define five demonstrations before the sales meeting. First, show inventory coverage and explain missing assets. Second, revoke an ordinary test user and confirm that access disappears across the protected services. Third, simulate an approved benign detection and follow the event through triage. Fourth, export the evidence needed for an investigation. Fifth, restore a test service from backup.
For an AI application, add adversarial documents and tool arguments to the test set. Ask the system to retrieve a document containing instructions that conflict with its actual task. Verify that application-level authorization still limits the requested action. Test malformed output, an unavailable source, a cross-tenant query and a duplicate mutation. The objective is to observe the boundary, not to claim that a handful of tests proves universal security.
Require a named operator to perform the demonstrations. If only the vendor can navigate the console, your organization has an adoption risk. Record alert noise, investigation minutes and the minimum useful context. A product that detects suspicious activity but overwhelms the available responder may not improve practical coverage. Run a staged device rollout with a documented rollback route and representative business applications.
Budget response and maintain the controls
Suppose an illustrative ten-device pilot has $200 monthly software charges, $150 logging expense and four hours of monitoring at $75 per hour. The operating total is $650 monthly, not $350. An additional one-off $900 configuration effort belongs in first-year cost. These are assumptions for budgeting, not current vendor prices or a prediction that incidents will fall by a particular percentage.
Track coverage and response outcomes rather than a composite “AI security score.” Useful measures include managed-device coverage, privileged-account review completion, age of unresolved critical findings, time to acknowledge alerts and successful restoration exercises. Pair every measure with an owner and a review cadence. Avoid adding their percentages into a misleading single average.
Review permission changes whenever an AI workflow receives a new connector. A read-only research assistant can become an execution risk after somebody grants refund, posting or deletion permissions. Retain evidence of approvals and actions, including tool failures. Treat generated investigation summaries as assistance; an analyst should verify the underlying events.
Start by closing the highest-impact missing control rather than replacing the whole stack. Enterprise AI governance and agent action guardrails help connect AI-specific controls to operating ownership. A security purchase is ready when the team can demonstrate coverage, investigate a test event and recover a service.
Who handles an alert after hours?
The buyer should write an escalation map before signing a response contract. Distinguish an alert that needs investigation from an incident that requires containment. Identify who may isolate an endpoint, revoke credentials or interrupt a production service. Those actions can affect customers and require a clear authority boundary.
For managed services, ask what happens when the supplier cannot reach your contact. Does it have permission to contain automatically, and which assets are excluded? Request the evidence format and notification path used during a real investigation. Marketing language about round-the-clock protection is not a substitute for these operating details.
Run a table top exercise using an approved fictional event. Have the operator find the affected identity, device and business service. Test access to logs and the recovery runbook. Record missing context and unclear ownership rather than treating the exercise as a pass because an alert appeared.
Review the map when staff, permissions or critical services change. A security product remains useful only when coverage and response responsibility stay aligned with the current environment.
Frequently asked questions
Can one AI security tool protect every layer?
No. Endpoint, identity, network, logging, recovery and AI application controls address different boundaries and need coordinated ownership.
Does a vendor detection percentage predict our protection?
Only within its stated test conditions. Validate coverage, noise, response and business compatibility on your environment.
Why test prompt injection separately?
Retrieved content can try to redirect an agent without containing traditional malware. Tool authorization and data boundaries must still hold.
What should a small team buy first?
Close its highest-impact coverage gap and ensure someone can respond. A monitored, maintainable control is more useful than an unattended dashboard.