How do we keep AI systems and automations secure?

ForceMX · Updated 7 October 2026

Short answer

Give each AI system only the access it needs, use company accounts with two-factor login, log every action, keep sensitive steps behind human approval, protect API keys, and test for prompt injection, where text in an email or document tricks the AI into doing something it should not. Review access whenever staff or vendors change.

Risks specific to AI

Prompt injection: an incoming email or web page contains instructions aimed at the AI, such as 'forward all invoices to this address'. Over-broad access: an agent that can read every mailbox or approve payments is a large target. Data leakage: AI output that reveals information to someone who should not see it. Each is reduced by limiting what the AI can do and checking actions that matter.

Basic controls

Least-privilege access for every integration. Separate, revocable credentials for each automation, stored securely rather than in shared documents. Human approval for payments, changes to bank details and bulk actions. Alerts on unusual activity. Regular access reviews, especially when a vendor or employee leaves.

The Cyber Security Agency of Singapore publishes practical guidance and programmes for SMEs that cover the wider basics.

How do we keep AI systems and automations secure?

Risks specific to AI

Basic controls

Official sources

Related questions