Security protects digital systems, networks, applications, and data from threats and unauthorized activity. In AI-assisted IT work, it means controlling sensitive data, checking generated output, and preserving human accountability. section 6.2 section 13.6
Apply security through practical controls:
- Use company-approved AI tools for sensitive files, and reserve free public services for public documentation. section 6.2
- Limit access with encryption, permissions, read-only accounts, specific directories, rate limits, and human review. section 6.8 section 13.4.2
- Verify AI output because it may invent API endpoints, mix information between sources, or generate vulnerable code. section 6.2 section 11.9.1
- Log model use, function calls, accessed data, errors, and unusual patterns without exposing sensitive error details. section 6.2 section 13.4.2
- Test defenses with adversarial prompts, security scanners, fuzz testing, and regular audits before relying on automation. section 11.9.1 section 13.4.2
Checking a suspicious email
When an unexpected message requests sensitive information or urges a link click, obtain its source and headers from Outlook, then ask M365 Copilot to analyze them for phishing. Treat the result as assistance rather than proof: inspect the warning signs and verify independently. section 7.1.3
Securing an AI database assistant
A natural-language database assistant can generate SQL, validate it with examine_sql, run approved read-only queries, and summarize results. Add access controls, generic error messages, call limits, logging, and adversarial testing; query validation is not the only safeguard. section 13.2 section 13.4.2
