How to Use This Handbook

A guide for security practitioners on navigating the AI Sec Handbook - how articles are structured, what the depth labels mean, and where to start based on your deployment model.

Last reviewed: August 18, 2026

Use this handbook in two ways: start with the security task in front of you, or open the relevant vendor page when you already know the product. From there, use the control matrix and checklist to turn guidance into owned, testable controls.

Use 7.4 The vendor-neutral control matrix as the source of truth for deployment models and control applicability. What is AI Security? explains the access, execution, autonomy, and evidence dimensions that change risk.

1. Start with the task in front of you

Situation	Start here	Then do this
Rolling out an AI product	7. Rollout & Operations	Confirm identity, data protection, runtime boundaries, and evidence paths before widening access.
Assessing an existing deployment	7.4 The vendor-neutral control matrix and 7.3 The security team checklist	Use 6.1 The audit gap, to test whether the expected evidence actually exists.
Approving a connector, MCP server, skill, or plugin	2. Supply Chain & Extensibility	Apply 2.7 The supply-chain review workflow before enablement.
Enabling a tool or workflow that can take actions	3. Runtime, Sandbox & Autonomy	Complete 5.7 Threat modeling AI systems and article 5.1 prompt-injection testing in 5. Threats & Adversarial.
Handling sensitive or regulated data	4. Data Protection & Residency	Check the applicable obligations in Governance & Frameworks.
Investigating an AI security incident	5. Threats & Adversarial	Start with 5.6 Incident response for AI systems, then use 6.6 Evidence by surface and investigation paths in 6. Observability, Audit & Evidence.
Reviewing a specific AI product	Open By AI Vendor in the sidebar	Use the vendor page to find its relevant handbook controls and product-specific gaps.

2. Turn guidance into evidence

A control is not complete because a setting exists. Use the same workflow for each control:

1. Identify the applicable control in the control matrix.
2. Assign a named owner for implementation and review.
3. Configure and test the control using the relevant handbook article.
4. Record evidence, including the configuration, test result, log source, and any approved exception.
5. Reassess after a significant product update, a newly enabled capability, or an incident.

3. Use vendor pages for implementation detail

The handbook articles define the required security outcome and explain why it matters. The By AI Vendor pages show where a vendor exposes the relevant settings, which products or plans they cover, and where gaps remain. Start with a vendor page when you already know the product, then return to the handbook articles for the cross-vendor control standard.

Related handbook guidance

• AI Security Handbook
• Security Team Checklist
• 7.4 The vendor-neutral control matrix
• Governance & Frameworks
• Glossary