Raw capture — raw/ai-security-framework-devsecops.md
url: https://www.preemptive.com/blog/ai-security-framework/ title: "How to Build an AI Security Framework for DevSecOps Teams" author: Michelle Pruitt date_fetched: 2026-07-18 date_published: 2026-07-16 site: PreEmptive
An AI security framework is a lifecycle-wide approach for managing risk in AI-enabled systems. It should span governance, model and third-party component risk, data and prompt security, application and binary protection, and runtime controls. References like NIST AI RMF, the EU AI Act, OWASP Top 10 for LLMs, MITRE ATLAS, and Google SAIF serve different purposes and are not interchangeable. For DevSecOps teams, the challenge is operationalizing these ideas through secure design, CI/CD enforcement, application hardening, and runtime-aware controls.
"An integrated approach designed to protect an organization from the range of risks associated with building, deploying, and operating AI-enabled systems." A mature framework should address governance, privacy, security, third-party risk, runtime behavior, and legal/regulatory obligations.
From an application security standpoint, it should protect "data, models, prompts, APIs, application code, dependencies, runtime behavior, and exposed binaries or client-side assets." AI security has evolved "from a narrow review activity" into "an ongoing engineering practice tied to development, release, and operations."
Traditional AppSec addresses code defects, exposed endpoints, and vulnerable dependencies. AI-enabled systems introduce risks like prompt injection, insecure output handling, supply chain issues in model development, and adversarial abuse that don't fit neatly into code-scanning workflows.
Attackers may poison training data, manipulate prompts, abuse model outputs, or extract information through repeated interaction. AI also accelerates both development and attack workflows, increasing pressure on engineering teams.
"SAST and SCA remain essential, but they do not fully address AI-specific risks such as prompt injection, insecure output handling, model misuse, or non-deterministic behavior."
Risk ownership should be clear: engineering teams own secure integration, API hardening, and delivery controls; security teams lead threat modeling, policy design, and monitoring; legal/compliance/privacy stakeholders determine acceptable use and regulatory alignment.
Teams should evaluate model provenance, vendor practices, update cadence, and known limitations before production use. Third-party AI services should be reviewed with the same seriousness as other supply chain dependencies.
If AI uses sensitive data, the framework should include controls for privacy, data minimization, encryption, and safe prompt handling. "Prompt injection and sensitive information disclosure are now established AI application risks."
Teams should identify where software functionality depends on AI and determine where application-layer protection is needed. For shipped applications, protections like obfuscation, anti-tamper measures, and hardening can reduce reverse engineering and abuse of embedded logic.
Teams should monitor for anomalous behavior, misuse, unsafe actions, and policy violations. High-consequence actions should be constrained, with human approval kept in the loop where needed.
Secure by Design: "Security is more effective when it is part of architecture and workflow design rather than something layered on after deployment."
Layered Defense: Because AI systems are complex and often non-deterministic, one control is rarely enough. Defense should combine governance, scanning, policy enforcement, and application protection.
Lifecycle Coverage: Controls should extend from design and build to deployment and operations — including model/data review early on, delivery-time checks, and runtime monitoring after release.
Workflow-Friendly Enforcement: "Security controls are more effective when embedded in CI/CD and developer workflows rather than relying on optional manual steps."
The article uses healthcare as an example sector where AI manages patient interactions, routes calls, and supports operational workflows. Data governance, privacy controls, and clear boundaries must be built in from the start. Successful deployments combine secure design with validation, testing, and ongoing monitoring.
Align scanning, testing, and protection through a feedback loop connecting AppSec findings, quality signals, and runtime data. Enforcement in CI/CD should be automatic, auditable, and repeatable. Teams should protect shipped code containing valuable business logic, and prioritize "high-value logic, sensitive workflows, regulated data paths, and externally accessible applications."
PreEmptive positions itself at the application-layer side of security for ".NET, MAUI, Java, Android/Kotlin, and JavaScript applications." Its products focus on code obfuscation, hardening, anti-tamper protection, and defenses against reverse engineering and dynamic analysis. These measures "make applications harder to reverse-engineer or manipulate, which matters when AI-enabled functionality or sensitive workflow logic is exposed in shipped software."
| Framework | Type | Scope | Regulatory Nature |
|---|---|---|---|
| NIST AI RMF | Governance | Broad AI risk management across the full lifecycle | Voluntary; no enforcement |
| EU AI Act | Regulatory | AI systems on EU market, tiered by risk | Legally binding; penalties up to €35M or 7% of global turnover |
| OWASP Top 10 for LLMs | Technical security | LLM application vulnerabilities | Non-regulatory; open-source |
| MITRE ATLAS | Threat knowledge base | Adversarial tactics for ML systems | Non-regulatory; threat intelligence |
| Google SAIF | Security framework | End-to-end secure AI development | Non-regulatory; industry guidance |
They are "complementary but not interchangeable."
Start with clear ownership and a realistic risk assessment mapping where AI is used. Define and apply controls across data, prompts, integrations, runtime behavior, and shipped binaries where applicable. Enforce measures in CI/CD whenever possible. Regularly review the framework to keep it current with models, workflows, and risks.
"AI security frameworks are most effective when they are built around practical controls, not just governance." The strongest strategies integrate design, AppSec, application protection, and DevSecOps execution into a single system.