Insights zu KI-Sicherheit und KI-Governance

Artikel und Videos von Tim Crouch. Die meisten fassen eine Primärquelle wie NIST, OWASP, ISO oder den EU AI Act zusammen und ordnen sie den CISSP-Domänen zu, mit denen ein Sicherheitsteam arbeitet. Geschrieben für die Menschen, die am Ende freigeben müssen.

Artikel und Videos erscheinen auf Englisch.

Auf LinkedIn folgen Auf YouTube abonnieren RSS-Feed

Neuestes Video, mit schriftlicher Zusammenfassung

The risk-based blueprint inside the EU AI Act

Europe didn't ban AI. It ranked the harm — and the high-risk band is where most real systems actually live.

25. Aug. 2026AI security

Video ansehen

Alle Artikel und Videos

20 Beiträge

Quelle

News-Briefing, 6 Min. Lesezeit

GPT-6.1 Terra makes computer-use automation cheaper—and governance more urgent

OpenAI’s GPT-6.1 Terra combines visual reasoning and computer use at lower API prices. The business opportunity is high-volume workflow automation, but the model’s capability and safety profile require deliberate boundaries.

31. Okt. 2026AI development, honestly

News-Briefing, 5 Min. Lesezeit

GitHub now scans pull requests for AI-agent security failures

GitHub code scanning can now flag indirect prompt injection, sensitive-data exposure and excessive agency in AI applications. Here is what the preview covers and how to use it without mistaking a scanner for a security programme.

31. Okt. 2026AI security

News-Briefing, 5 Min. Lesezeit

Claude Duet moves AI from answering prompts to watching the work

Anthropic’s Claude Duet is a proactive agent that monitors connected apps, works in the background and asks before consequential actions. The real change is operational, not conversational.

24. Okt. 2026AI development, honestly

News-Briefing, 4 Min. Lesezeit

PHP2Shell: two critical PHP flaws require immediate patching

CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution in PHP web servers. Here is who is exposed, what to patch, and what to check next.

24. Okt. 2026EU security and compliance

Essay, 4 Min. Lesezeit

An AI business case starts with the review work

A practical way to assess an AI workflow: count the checking, model adoption, include running costs, and distinguish useful capacity from money actually saved.

12. Sept. 2026AI development, honestly

Framework-Zusammenfassung, 2 Min. Lesezeit

ISO/IEC 42001 makes AI governance auditable

ISO/IEC 42001 does not prescribe seven named documents; it requires controlled evidence that AI risks, responsibilities, and decisions are managed.

28. Aug. 2026AI security

Framework-Zusammenfassung, 2 Min. Lesezeit

Secure AI agents by their traits, not their labels

The Cloud Security Alliance's trait-based approach maps agent behavior and architectural choices to concrete security risks and controls.

29. Juli 2026AI security

Essay, 4 Min. Lesezeit

Rebuilding globalsoftware.ai around the work

Why we tore down our own website and rebuilt it around what we actually do: services, products in progress, experiments, and a blog that brings our writing into one home.

10. Juli 2026Lab notes

Essay, 4 Min. Lesezeit

Why AI-assisted compliance review still needs a human signature

AI can read a marketing document against MiFID II requirements faster than any human. It still shouldn't be the one who approves it. That's a design principle, not a limitation.

10. Juli 2026Building CompylotAI

Framework-Zusammenfassung, 2 Min. Lesezeit

The OWASP AI Exchange connects AI threats to controls

The OWASP AI Exchange provides a lifecycle map for moving from AI governance and threat analysis to testing, operations, and residual-risk decisions.

21. Juni 2026AI security

Framework-Zusammenfassung, 2 Min. Lesezeit

Adversarial machine learning needs a common language

NIST's attack taxonomy helps security teams connect adversary goals, access, lifecycle stages, and mitigations across predictive and generative AI.

31. Mai 2026AI security

Framework-Zusammenfassung, 2 Min. Lesezeit

Red teaming generative AI is a lifecycle discipline

Microsoft's experience across 100 generative-AI products shows why testing must follow real system risks, not a generic attack checklist.

5. Mai 2026AI security

Framework-Zusammenfassung, 2 Min. Lesezeit

The OWASP LLM Top 10 is an application-security list

OWASP's 2025 list shows that securing an LLM application requires architecture, testing, and development controls around the model.

13. Apr. 2026AI security

Framework-Zusammenfassung, 2 Min. Lesezeit

The EU AI Act turns AI governance into an operating obligation

The EU AI Act is not only a legal classification scheme; it requires organizations to connect AI risk, data governance, oversight, and evidence.

28. März 2026EU security and compliance

Framework-Zusammenfassung, 2 Min. Lesezeit

Managing generative-AI risk with the NIST profile

NIST's Generative AI Profile extends the AI RMF with concrete actions for governance, data provenance, testing, and incident disclosure.

6. März 2026AI security

Framework-Zusammenfassung, 2 Min. Lesezeit

AI security is governance in action

BaFin's central point is simple: AI security has to cover the whole decision process, not just the model.

17. Feb. 2026AI security

Framework-Zusammenfassung, 2 Min. Lesezeit

Putting Google's Secure AI Framework into practice

Google's SAIF implementation guide turns six security principles into an organizational process for designing, deploying, and operating AI safely.

29. Jan. 2026AI security

Framework-Zusammenfassung, 2 Min. Lesezeit

Google SAIF: six elements for secure AI

Google's one-page SAIF summary provides a useful executive test for whether AI security covers architecture, operations, and business risk.

7. Jan. 2026AI security

Framework-Zusammenfassung, 2 Min. Lesezeit

NIST AI RMF: govern, map, measure, and manage

The NIST AI RMF gives organizations a lifecycle structure for connecting AI governance, assets, architecture, measurement, and risk treatment.

19. Dez. 2025AI security

Insights zu KI-Sicherheit und KI-Governance

The risk-based blueprint inside the EU AI Act

Alle Artikel und Videos

GPT-6.1 Terra makes computer-use automation cheaper—and governance more urgent

GitHub now scans pull requests for AI-agent security failures

Claude Duet moves AI from answering prompts to watching the work

PHP2Shell: two critical PHP flaws require immediate patching

An AI business case starts with the review work

ISO/IEC 42001 makes AI governance auditable

The risk-based blueprint inside the EU AI Act

Secure AI agents by their traits, not their labels

Rebuilding globalsoftware.ai around the work

Why AI-assisted compliance review still needs a human signature

The OWASP AI Exchange connects AI threats to controls

Adversarial machine learning needs a common language

Red teaming generative AI is a lifecycle discipline

The OWASP LLM Top 10 is an application-security list

The EU AI Act turns AI governance into an operating obligation

Managing generative-AI risk with the NIST profile

AI security is governance in action

Putting Google's Secure AI Framework into practice

Google SAIF: six elements for secure AI

NIST AI RMF: govern, map, measure, and manage

Reihen

AI security

EU security and compliance

Building CompylotAI

AI development, honestly

Lab notes

Neue Beiträge direkt erhalten