Материалы о безопасности и управлении ИИ

Статьи и видео Тима Крауча. Большинство из них разбирают первоисточник, например NIST, OWASP, ISO или Регламент ЕС об ИИ, и связывают его с доменами CISSP, с которыми работает команда безопасности. Для тех, кто принимает окончательное решение.

Статьи и видео публикуются на английском языке.

Подписаться в LinkedIn Подписаться на YouTube RSS-лента

Новое видео с текстовым обзором

The risk-based blueprint inside the EU AI Act

Europe didn't ban AI. It ranked the harm — and the high-risk band is where most real systems actually live.

25 авг. 2026 г.AI security

Смотреть видео

Все статьи и видео

20 материалов

Источник

Обзор новостей, 6 мин чтения

GPT-6.1 Terra makes computer-use automation cheaper—and governance more urgent

OpenAI’s GPT-6.1 Terra combines visual reasoning and computer use at lower API prices. The business opportunity is high-volume workflow automation, but the model’s capability and safety profile require deliberate boundaries.

31 окт. 2026 г.AI development, honestly

Обзор новостей, 5 мин чтения

GitHub now scans pull requests for AI-agent security failures

GitHub code scanning can now flag indirect prompt injection, sensitive-data exposure and excessive agency in AI applications. Here is what the preview covers and how to use it without mistaking a scanner for a security programme.

31 окт. 2026 г.AI security

Обзор новостей, 5 мин чтения

Claude Duet moves AI from answering prompts to watching the work

Anthropic’s Claude Duet is a proactive agent that monitors connected apps, works in the background and asks before consequential actions. The real change is operational, not conversational.

24 окт. 2026 г.AI development, honestly

Обзор новостей, 4 мин чтения

PHP2Shell: two critical PHP flaws require immediate patching

CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution in PHP web servers. Here is who is exposed, what to patch, and what to check next.

24 окт. 2026 г.EU security and compliance

Эссе, 4 мин чтения

An AI business case starts with the review work

A practical way to assess an AI workflow: count the checking, model adoption, include running costs, and distinguish useful capacity from money actually saved.

12 сент. 2026 г.AI development, honestly

Обзор стандарта, 2 мин чтения

ISO/IEC 42001 makes AI governance auditable

ISO/IEC 42001 does not prescribe seven named documents; it requires controlled evidence that AI risks, responsibilities, and decisions are managed.

28 авг. 2026 г.AI security

Обзор стандарта, 2 мин чтения

Secure AI agents by their traits, not their labels

The Cloud Security Alliance's trait-based approach maps agent behavior and architectural choices to concrete security risks and controls.

29 июл. 2026 г.AI security

Эссе, 4 мин чтения

Rebuilding globalsoftware.ai around the work

Why we tore down our own website and rebuilt it around what we actually do: services, products in progress, experiments, and a blog that brings our writing into one home.

10 июл. 2026 г.Lab notes

Эссе, 4 мин чтения

Why AI-assisted compliance review still needs a human signature

AI can read a marketing document against MiFID II requirements faster than any human. It still shouldn't be the one who approves it. That's a design principle, not a limitation.

10 июл. 2026 г.Building CompylotAI

Обзор стандарта, 2 мин чтения

The OWASP AI Exchange connects AI threats to controls

The OWASP AI Exchange provides a lifecycle map for moving from AI governance and threat analysis to testing, operations, and residual-risk decisions.

21 июн. 2026 г.AI security

Обзор стандарта, 2 мин чтения

Adversarial machine learning needs a common language

NIST's attack taxonomy helps security teams connect adversary goals, access, lifecycle stages, and mitigations across predictive and generative AI.

31 мая 2026 г.AI security

Обзор стандарта, 2 мин чтения

Red teaming generative AI is a lifecycle discipline

Microsoft's experience across 100 generative-AI products shows why testing must follow real system risks, not a generic attack checklist.

5 мая 2026 г.AI security

Обзор стандарта, 2 мин чтения

The OWASP LLM Top 10 is an application-security list

OWASP's 2025 list shows that securing an LLM application requires architecture, testing, and development controls around the model.

13 апр. 2026 г.AI security

Обзор стандарта, 2 мин чтения

The EU AI Act turns AI governance into an operating obligation

The EU AI Act is not only a legal classification scheme; it requires organizations to connect AI risk, data governance, oversight, and evidence.

28 мар. 2026 г.EU security and compliance

Обзор стандарта, 2 мин чтения

Managing generative-AI risk with the NIST profile

NIST's Generative AI Profile extends the AI RMF with concrete actions for governance, data provenance, testing, and incident disclosure.

6 мар. 2026 г.AI security

Обзор стандарта, 2 мин чтения

AI security is governance in action

BaFin's central point is simple: AI security has to cover the whole decision process, not just the model.

17 февр. 2026 г.AI security

Обзор стандарта, 2 мин чтения

Putting Google's Secure AI Framework into practice

Google's SAIF implementation guide turns six security principles into an organizational process for designing, deploying, and operating AI safely.

29 янв. 2026 г.AI security

Обзор стандарта, 2 мин чтения

Google SAIF: six elements for secure AI

Google's one-page SAIF summary provides a useful executive test for whether AI security covers architecture, operations, and business risk.

7 янв. 2026 г.AI security

Обзор стандарта, 2 мин чтения

NIST AI RMF: govern, map, measure, and manage

The NIST AI RMF gives organizations a lifecycle structure for connecting AI governance, assets, architecture, measurement, and risk treatment.

19 дек. 2025 г.AI security

Материалы о безопасности и управлении ИИ

The risk-based blueprint inside the EU AI Act

Все статьи и видео

GPT-6.1 Terra makes computer-use automation cheaper—and governance more urgent

GitHub now scans pull requests for AI-agent security failures

Claude Duet moves AI from answering prompts to watching the work

PHP2Shell: two critical PHP flaws require immediate patching

An AI business case starts with the review work

ISO/IEC 42001 makes AI governance auditable

The risk-based blueprint inside the EU AI Act

Secure AI agents by their traits, not their labels

Rebuilding globalsoftware.ai around the work

Why AI-assisted compliance review still needs a human signature

The OWASP AI Exchange connects AI threats to controls

Adversarial machine learning needs a common language

Red teaming generative AI is a lifecycle discipline

The OWASP LLM Top 10 is an application-security list

The EU AI Act turns AI governance into an operating obligation

Managing generative-AI risk with the NIST profile

AI security is governance in action

Putting Google's Secure AI Framework into practice

Google SAIF: six elements for secure AI

NIST AI RMF: govern, map, measure, and manage

Серии

AI security

EU security and compliance

Building CompylotAI

AI development, honestly

Lab notes

Получайте новые материалы сразу после публикации