Resources
Practical resources for AI security and governance
Guides, templates, and checklists written for the people who actually have to manage AI risk: IT and security leads, compliance officers, general counsel, and operators at organizations without a dedicated security team.
Guides and templates
Step-by-step methods you can use this week.
- How to audit AI permissionsA practical, step-by-step method for finding every AI tool and agent in your organization, mapping what each can read, write, send, and execute, and reducing access to what is actually needed.
- AI risk assessment templateA free, usable AI risk assessment template: organization-level governance questions, a per-system assessment table, a severity model, and a prioritization method you can use today.
- AI acceptable-use policy: what to includeWhat an effective AI acceptable-use policy covers — approved tools, data rules, agents, output review, disclosure, incidents — and how to roll it out so employees actually follow it.
- AI agent security checklistAn actionable security checklist for AI agents that send, write, delete, execute, or pay: identity, least privilege, approvals, prompt-injection defenses, logging, limits, and kill switches.
- Shadow AI discovery: find the AI tools employees already usePractical methods to discover unapproved AI tools and agents — OAuth grants, SSO logs, expenses, browser extensions, network data, code scanning, and surveys — and what to do with what you find.
- AI vendor risk review: questions to askA vendor review framework for AI tools: data use and training, retention, sub-processors, security posture, contracts (DPA, BAA), model behavior, agent capabilities, and exit.
- AI incident response planHow to extend your incident response plan for AI: common AI incident scenarios, detection, containment steps such as agent kill switches and credential revocation, notification considerations, and tabletop exercises.
- HIPAA and generative AI: a practical guideHow HIPAA applies when healthcare organizations use generative AI: when a BAA is required, minimum necessary, de-identification, workforce use, security rule safeguards, and a practical control checklist.
- Generative AI governance for law firmsHow law firms can adopt generative AI while protecting client confidences: professional duties, approved tools, confidentiality and privilege, supervision, client communication, billing, and a governance checklist.
- AI governance for small and mid-sized businessesA right-sized AI governance program for organizations without a dedicated security team: the five controls that matter most, a 90-day plan, and how to answer customer and insurer questions about AI.
AI tool security guides
What each tool can access, the real risks, and the controls to set.
- ChatGPTWhat ChatGPT can access in a business, the difference between consumer and business accounts, connector and agent risks, HIPAA considerations, and the controls security teams should put in place.
- ClaudeHow organizations use Anthropic's Claude, what it can access through projects, uploads, and connectors, the risks for law firms and regulated industries, and the controls to put in place.
- Microsoft CopilotWhy Microsoft 365 Copilot's biggest risk is existing permission sprawl, what Copilot can reach through Microsoft Graph, Copilot Studio agent risks, and the controls to deploy before and after rollout.
- GeminiHow Gemini reaches organizational data through Google Workspace, the difference between consumer, Workspace, and API use, prompt-injection exposure in email and documents, and recommended controls.
- PerplexitySecurity considerations for Perplexity's AI answer engine: what employees send to it, file uploads and connectors, agentic browsing and prompt injection, account types, and controls.
- GitHub CopilotSecurity considerations for GitHub Copilot completions, chat, IDE agent mode, and the Copilot coding agent: repository access, secrets exposure, prompt injection through issues and code, and governance controls.
- Claude CodeHow Claude Code reads files and runs commands, what that means for .env files, cloud credentials, and production access, permission modes, and the controls engineering teams should set.
- CursorSecurity considerations for the Cursor AI code editor: code sent to model providers, privacy settings, agent command execution and auto-run, rules files and prompt injection, and team controls.
Comparisons
How related approaches and frameworks fit together.
- FlashTower vs. a spreadsheet for AI riskAn honest comparison of managing AI risk in a spreadsheet versus FlashTower: when a spreadsheet is enough, where it breaks down, and what changes when you need scoring, evidence, and reporting.
- AI risk assessment vs. penetration testHow an AI risk assessment differs from a penetration test or AI red-team exercise, what each finds, when you need each, and how they fit together.
- AI governance vs. AI securityThe difference between AI governance and AI security, where they overlap, who owns each, and why effective programs treat them as one operating model.
- NIST AI RMF vs. ISO/IEC 42001How the NIST AI Risk Management Framework and ISO/IEC 42001:2023 differ in purpose, structure, and certification, and how organizations use them together.
Free tools, methodology, and help
- Free AI security toolsThe Free AI Risk Assessment, AI Policy Generator, industry readiness checks, and interactive checkers.
- FlashTower methodologyHow the deterministic risk engine scores findings.
- Help centerAnswers about the scan, scoring, reports, billing, and data.
- Insights and briefingsReviewed, sourced briefings on what changed in AI security and what to check.