Information security in the age of AI:
what changes and what to protect

Information security still rests on three properties

The classic information security triad applies to models and agents. What changes is where each property can fail:

• Confidentiality: data reaches only those with permission. With AI, that includes the prompt, the answer and whatever is logged by the service that processed the call.
• Integrity: data and decisions do not change without authorisation. With agents, the threat includes an external instruction that alters the agent's behaviour and a tampered document retrieved as a source.
• Availability: a process that depends on an external model inherits that vendor's availability, usage limits and changes to its terms.

An agent introduces an intermediary that reads content from several origins, assembles a context and acts in other systems. Each step is a new point of control.

Generative AI brings risks that information security needs to name

The generative AI profile published by NIST in 2024 treats information security as one of the risks the technology creates or worsens. In a company's day-to-day work, six surfaces draw most of the attention:

• Prompt injection: an instruction hidden in a document, email or page the agent reads gets treated as an order, like a supplier email with a concealed request to forward the conversation to an outside address.
• Leakage through answers: a question about a project's budget brings back the salary of someone listed in the cost spreadsheet stored in the same folder.
• Exposure to third parties: content sent to an external service becomes subject to the vendor's retention terms and processing region.
• Data poisoning: a knowledge base page edited with a false procedure starts guiding answers as if it were a legitimate source.
• Supply chain: models, plugins and tool servers whose origin has not been assessed enter the environment with access to data and credentials.
• Agents with broad credentials: a token with write access to the ERP and to email turns a successful injection into an altered payment or a sent message.

Familiar information security controls still apply

Identity management gives each agent its own account. Least privilege limits each tool to the access the task requires. Segmentation keeps an agent under test from reaching production data.

Logging and monitoring remain the basis of any investigation. Vendor management now includes model and tool providers. The incident response plan gains scenarios such as revoking an agent's credential and reconstructing which answers it gave.

The LGPD still requires purpose, necessity and security measures when models process personal data, and every AI flow that touches personal data goes into the record of processing operations the controller keeps under LGPD art. 37, overseen by the DPO.

AI-specific controls deal with untrusted content and agent actions

Other controls exist because models process instructions and content in the same stream of text:

1. Separate instructions from untrusted data: external content comes in marked as data, and the agent's tools are restricted while it processes that content.
2. Filter by permission before the model: restricted data is dropped at the query to the source and never reaches the context.
3. Human review for higher-consequence actions: payments, external sends and deletions go through a person's approval.
4. Model vendor assessment: retention, use for training and processing region become part of the procurement process.
5. Adversarial testing: the security team tests the flows with manipulated content before production and at every model change.
6. A log of every query and answer: who asked, which sources were read, what came back and which action was taken.

The Company Brain reduces what leaves the perimeter and records every answer

The Company Brain connects CRM, ERP, helpdesk and documents once and organises that data into a knowledge graph, with a business ontology and a semantic layer. The data stores stay in the customer's environment, with no copy sent to the model provider.

For each question, the model receives over MCP only the minimal slice the answer requires, already filtered by the permission inherited from the source system. With a model running as an external service, that slice leaves the perimeter for that call and follows the vendor's terms. With a model on the company's own infrastructure, it stays inside as well.

Every answer cites the source system and record. For information security, this makes it possible to reconstruct an incident: who asked, which sources were read and with what permission.

No architecture removes the risk of prompt injection

Prompt injection remains an open problem. Known techniques lower the chance of success without guaranteeing a separation between instructions and content, and the most effective control limits what the agent does after reading external content.

The Company Brain also inherits the limits of its sources. A permission misconfigured at the source reaches the answer unchanged, and a tampered document stays tampered until someone fixes it. Information security with AI still requires a security team, periodic testing, access reviews and an incident response process.

Information security with AI starts with two inventories

The first lists the flows in which data leaves the perimeter, such as calls to external models, extensions and automations, with what data leaves, to which vendor and under what terms.

The second covers the credentials agents use: which accounts, with what scope, in which systems and with write or read-only permission. The flows that combine external content, sensitive data and a write credential are the first candidates for permission filtering, human review and a complete query log.