AI Security Glossary
Key terms and concepts in AI security, governance, and compliance — explained for practitioners.
Agent Communication Protocol (ACP)
Agent Communication Protocol (ACP) is a REST-based standard for AI agent interoperability. Learn how ACP relates to MCP, A2A, and enterprise AI governance.
Agentic AI Risk
Agentic AI risk is the category of security threats arising when autonomous AI systems act without direct human oversight. A complete guide.
AI Agent Security
AI agent security governs what autonomous AI systems can do, access, and act on at runtime. Learn the threat model, core controls, and how agent security differs from traditional application security.
AI Firewall
An AI firewall is a policy enforcement layer that controls what AI models can access, generate, and act on at runtime. Learn how AI firewalls work and why enterprises need them.
AI Governance
AI governance is the set of policies, controls, and audit mechanisms that define how organizations use AI responsibly and compliantly. A complete guide.
Authorised Representative (EU AI Act)
An Authorised Representative under the EU AI Act is an EU-based person mandated in writing by a non-EU provider to carry out obligations for its AI system.
Chief Information Security Officer (CISO)
A Chief Information Security Officer (CISO) is the executive accountable for an organization's security strategy. Learn the role, reporting lines, and AI governance duties.
Data Loss Prevention (DLP)
Data Loss Prevention (DLP) is a set of controls that detect and stop sensitive data from leaving an organization. Learn how DLP works, where it falls short for AI, and how AI-era data protection extends it.
Data Processing Agreement (DPA)
A Data Processing Agreement (DPA) is a GDPR-required contract between a controller and processor. Learn what a DPA must contain and why AI tools trigger one.
Data Protection Officer (DPO)
A Data Protection Officer (DPO) is an independent role required under GDPR to oversee data protection compliance. Learn the DPO's tasks, independence, and AI duties.
Deployer (EU AI Act)
A deployer under the EU AI Act is any organization using an AI system under its own authority. Learn the deployer's duties, how it differs from a provider, and more.
Digital Operational Resilience Act (DORA)
The Digital Operational Resilience Act (DORA) is an EU regulation that sets a unified ICT risk framework for the financial sector. Learn its pillars and AI scope.
Distributor (EU AI Act)
A Distributor under the EU AI Act is a supply-chain party — neither provider nor importer — that makes an AI system available on the EU market.
EU AI Act (Artificial Intelligence Act)
The EU AI Act is the EU's risk-based law for artificial intelligence. A plain-language summary of what it regulates, when it applies, and who must comply.
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is the EU law governing how personal data is processed. Learn its principles, rights, and what it means for AI.
Governance, Risk & Compliance (GRC)
Governance, Risk, and Compliance (GRC) is an integrated approach to directing an organization, managing risk, and meeting obligations. Learn how GRC works and why AI needs it.
GPAI (General-Purpose AI)
GPAI (general-purpose AI) in the EU AI Act: the Article 3(63) definition, Chapter V provider duties, systemic-risk models — and why GPAI is no risk tier.
HIPAA
HIPAA (the Health Insurance Portability and Accountability Act) sets US rules for protecting health data. Learn its Privacy and Security Rules, Business Associate requirements, and AI implications.
Human-in-the-Loop (HITL)
Human-in-the-Loop (HITL) is a design pattern where a human reviews, approves, or vetoes an AI system's actions before they take effect. Learn how HITL works.
Identity & Access Management (IAM)
Identity and Access Management (IAM) is the discipline of ensuring the right identities have the right access to the right resources. Learn how IAM works and why AI agents break it.
Importer (EU AI Act)
An Importer under the EU AI Act is an EU-based person that places on the market an AI system bearing a non-EU provider's name. Learn the role, test, and duties.
LLM Security
LLM security is the practice of protecting large language models from adversarial attacks, data leakage, and unauthorized access in production.
Mobile Device Management (MDM)
Mobile Device Management (MDM) lets organizations enroll, configure, secure, and remotely manage iOS and Android devices from a central console. Learn how MDM works and its AI limits.
Model Context Protocol (MCP)
Model Context Protocol (MCP) is an open standard for connecting AI models and agents to external tools and data. Learn how MCP works and its security implications.
NIST AI Risk Management Framework
The NIST AI Risk Management Framework (AI RMF) is a voluntary framework for managing AI risks and building trustworthy AI. Learn its four core functions and how to apply it.
Operator (EU AI Act)
An operator is the EU AI Act's umbrella term for any party in the AI value chain: provider, product manufacturer, deployer, authorised representative, importer, or distributor.
OWASP Top 10 for LLMs
The OWASP Top 10 for LLM Applications is a community-driven list of the most critical security risks in apps built on large language models. Learn the categories and mitigations.
Personally Identifiable Information (PII)
Personally Identifiable Information (PII) is any data that can identify a person directly or indirectly. Learn how PII differs from GDPR personal data and why it matters for AI.
Product Manufacturer (EU AI Act)
Under the EU AI Act, a product manufacturer that embeds a high-risk AI safety component in an own-branded product counts as the provider (Article 25(3)).
Prompt Injection
Prompt injection is an AI security attack where malicious instructions embedded in data cause an LLM to follow attacker commands instead of its system prompt. Learn how attacks work and how to defend against them.
Provider (EU AI Act)
A Provider under the EU AI Act develops an AI system or GPAI model and places it on the market under its own name. Learn the definition, test, and duties.
Retrieval-Augmented Generation (RAG)
Retrieval-Augmented Generation (RAG) grounds LLM answers in retrieved documents. Learn how the RAG pipeline works, how it differs from fine-tuning, and its security risks.
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM) aggregates and correlates logs across the IT estate for real-time alerting, investigation, and compliance.
Shadow AI
Shadow AI is the use of AI tools by employees without IT, security, or compliance approval. Learn what counts as shadow AI, why it is a risk, and how to govern it.
Single Sign-On (SSO)
Single Sign-On (SSO) lets users access many applications with one set of credentials via a central identity provider. Learn how SSO works, its risks, and its limits for AI.
SOC 2
SOC 2 is an attestation report on a service organization's controls against the AICPA Trust Services Criteria. Learn how SOC 2 applies to AI governance, Type I vs Type II, and why auditors now assess AI tools and controls.