AI and cyber security: what you need to know
This guidance from the National Cyber Security Centre is designed for managers, board members, and senior executives with non-technical backgrounds to help them understand the risks and benefits of using artificial intelligence tools. It outlines core definitions of AI and machine learning, details specific cyber security risks such as prompt injection and data poisoning, and provides practical questions leaders can ask technical staff to ensure secure AI integration. The document stresses that security must be a core requirement throughout the entire lifecycle of an AI system rather than an afterthought.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Managers, board members, and senior executives with non-technical backgrounds who need to understand AI risks and governance.
What the document contains
The document covers fundamental concepts of artificial intelligence and machine learning, prominent cyber security threats associated with generative AI and large language models (such as prompt injection and data poisoning), and leadership responsibilities for secure AI deployment. It also provides a list of strategic questions for executives to ask their technical staff.
It does not provide binding legal regulations, specific penalty enforcement mechanisms, or technical step-by-step programming code for securing AI models.
- Artificial intelligence tools offer significant benefits but introduce novel cyber security vulnerabilities that must be actively managed.
- Senior leaders and managers need to understand AI risks well enough to discuss them with technical staff and prioritize security.
- Generative AI and large language models are susceptible to specific threats such as prompt injection and data poisoning attacks.
- Organizations should adopt a 'secure by design' approach, integrating security into all AI projects and workflows from inception.
- The burden of using AI safely should not fall entirely on individual users or customers; developers must take responsibility for security outcomes.
· What is artificial intelligence? · How does AI work? · Why the widespread interest in AI? · What are the cyber security risks in using AI? · How can leaders help ensure that AI is developed securely? · Questions to ask about the security of your organisation’s AI systems · Further reading
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
3/5Clear responsibility for AI outcomes
That is, developers of AI models and systems should take responsibility for the security outcomes of their customers.
How can leaders help ensure that AI is developed securely?
screening score · 2026-10-23
Fairness
2/5Non-discrimination and equitable treatment
Data poisoning attacks occur when an attacker tampers with the data that an AI model is trained on to produce undesirable outcomes (both in terms of security and bias).
What are the cyber security risks in using AI?
screening score · 2026-10-23
Human Dignity
0/5Respect for the inherent worth of persons
screening score · 2026-10-23
Privacy
2/5Protection of personal data and private life
Cyber security is a necessary precondition for the safety, resilience, privacy, fairness, efficacy and reliability of AI systems.
Why the widespread interest in AI?
screening score · 2026-10-23
Transparency
2/5Openness about how AI systems work and are used
This involves AI tools that can produce different types of content, including text, images and video
What is artificial intelligence?
screening score · 2026-10-23
Enforcement
1/5Consequences and compliance mechanisms with real force
You should understand whether your organisation is legally compliant and adhering to established best practice when handling data related to these systems.
How can leaders help ensure that AI is developed securely?
screening score · 2026-10-23
Impact Assessment
2/5Required assessment of an AI system's risks/impacts before or during use
Leaders need to understand the consequences to the organisation if the integrity, availability or confidentiality of an AI- system were to be compromised.
How can leaders help ensure that AI is developed securely?
screening score · 2026-10-23