Securing AI in the Defense Industrial Base – Part 1 – The AI Risk Landscape

Part 1 of 3 | October 2026 

By Michael Crane, Principal Cloud Solution Architect (Security); Kelly Lunghamer, Senior Solution Engineer (Security); Brooke Robinson, Security Specialist; and Sarah Vyzas, Security Specialist 

Defense Industrial Base (DIB) organizations are adopting AI chat assistants, generative AI services, custom models, and autonomous agents at a rapid pace, all while protecting Controlled Unclassified Information (CUI) and meeting NIST SP 800-171 and CMMC requirements. This three-part series offers a practical framework for securing AI in Microsoft 365 Government (GCC High) environments, built on three priorities: Discover & Observe, Secure, and Govern. Part 1 sets the foundation. It explains why AI security matters in the DIB, maps the current AI risk landscape across usage, applications, platforms, and agents, and describes the investigation and audit evidence organizations can rely on today. 

Overview 

Purpose 

Defense Industrial Base (DIB) organizations are rapidly adopting AI chat assistants, generative AI services, custom models, and autonomous agents to improve productivity and accelerate mission outcomes. At the same time, security teams must continue to protect Controlled Unclassified Information (CUI), intellectual property, export-controlled data, and critical business systems while meeting requirements like NIST SP 800-171 and the Cybersecurity Maturity Model Certification (CMMC). 

National policy reinforces the need for DIB organizations to pair AI adoption with security and operational resilience. In July 2025, the White House released Winning the AI Race: America's AI Action Plan, which identifies accelerating innovation, building AI infrastructure, and leading in international diplomacy and security as national priorities.¹ For DIB organizations, the practical implication is not a separate compliance framework; it is the need to adopt AI in a way that protects sensitive data, strengthens cyber resilience, preserves supply-chain and mission assurance, and maintains accountability for AI-enabled decisions and actions. 

This series is intended for security leaders, architects, and practitioners responsible for enabling AI within Microsoft 365 Government (GCC High) environments. It provides a practical framework built around three priorities: 

• Observe & Discover AI – understand what AI capabilities exist, who owns them, what data they access, and how they are being used. 

• Secure AI – apply identity, data protection, workload security, and monitoring controls to AI interactions and agents. 

• Govern AI – establish lifecycle management, accountability, policy guardrails, and auditability as AI capabilities expand. 

The objective is not to create a separate AI security program. Instead, this series demonstrates how organizations can extend existing cybersecurity and Zero Trust practices to AI systems and agents using capabilities available today in GCC High. The faster organizations establish visibility, apply baseline controls, and operationalize governance – the faster they can enable approved AI adoption while reducing unmanaged AI risk. 

For simplicity, the term “AI” is used throughout this series and aligns with the definition of an AI system in the NIST Artificial Intelligence Risk Management Framework (AI RMF): “an engineered or machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, or decisions influencing real or virtual environments.”² 

Situation 

As AI capabilities become embedded in business processes, DIB security teams must extend existing cybersecurity practices to systems that consume data, invoke tools, and act on behalf of users. The challenge is not a lack of security controls, but understanding how familiar concerns – identity, access, data protection, monitoring, and governance – apply to AI interactions, applications, and agents. 

The challenge is compounded by the fact that AI security remains an emerging discipline. Unlike endpoint, network, or cloud security, the industry has not yet converged on a universally accepted model, operational framework, or benchmark for securing AI systems end-to-end. 

Despite not having a unique model, the controls needed to secure AI ultimately map back to the foundations of Zero Trust architecture. As a useful starting base, CISA developed the Zero Trust Maturity Model that breaks down ZT into pillars of Identity, Devices, Networks, Applications & Workloads, and Data layered by Visibility and Analytics, Automation and Orchestration, and Governance.³ 

Figure 1: CISA Zero Trust Maturity Model Pillars

This Maturity Model can be adapted to apply these same pillars and layers to AI; AI systems interact with identities, devices, networks, applications, workloads, and data while introducing additional governance, visibility, and monitoring requirements. AI and agent governance should therefore be viewed as an extension of established cybersecurity practices – not a parallel security program. 

Figure 2: CISA Zero Trust Maturity Model Pillars updated with AI Considerations

Functionally, an AI agent operates as a non-human actor within the enterprise. It accesses data, invokes tools, performs actions, and influences business processes. Like any other enterprise workload, an agent requires an accountable owner, defined permissions, governance boundaries, monitoring, and an auditable record of activity. Most AI security concerns are therefore extensions of existing disciplines including identity governance, data protection, application security, insider risk management, and security operations. 

AI adoption often exposes weaknesses that already exist in identity governance, data classification, access management, and visibility. Organizations with mature Zero Trust practices are therefore better positioned to securely adopt AI, while gaps in these foundational areas may become more consequential as AI adoption expands. 

NIST's AI Risk Management Framework provides a common vocabulary and a practical risk-management structure for AI systems². Its four functions are: 

• Govern 

• Map 

• Measure 

• Manage 

These four functions complement the Zero Trust foundations described above by helping organizations identify AI use cases, assess risk, implement controls, monitor outcomes, and adjust safeguards over time. This series applies those functions through the practical sequence of discovering AI use, securing AI interactions, and governing AI capabilities and agents throughout their lifecycle. 

Figure 3: NIST AI RMF Core Mapped to Microsoft Approach 

Current DIB AI Risks 

This post shares the perspective of Larry English in Forbes that many of the security challenges exposed by AI are not new, but reflect existing weaknesses in governance, access controls, permissions, and data management that AI can amplify.⁴ For DIB organizations, the consequence is significant because AI systems increasingly interact with CUI, export-controlled data, intellectual property, operational processes, and mission-critical systems. 

Current AI risks can be understood across three layers: AI usage, AI applications, and AI platforms. This post adopts a layered AI-risk perspective adapted from Richard Diver's Guardians of AI, which distinguishes between user interaction risks, application-level risks, and platform-level risks.⁵ 

Most security programs today primarily focus on AI usage, such as restricting access to consumer AI services. However, effective AI security requires controls across all three layers. 

Table 1: AI Risk Layers with Threat (adapted from Richard Diver, Guardians of AI)⁴ 

 

While each layer presents distinct security concerns, the layers are interconnected. A prompt injection attack against an AI application may ultimately expose sensitive data. A compromised AI platform may impact every application built upon it. Likewise, unmanaged user behavior can bypass otherwise effective technical controls. Organizations should therefore avoid treating AI security as a single problem and instead address risks across the full AI lifecycle. 

NIST's Generative AI Profile identifies generative-AI-specific risks, including confabulation, harmful content, information integrity, privacy, and misuse.⁶ MITRE ATLAS complements this perspective by cataloging adversarial tactics and techniques that target AI-enabled systems⁷. Together, these sources reinforce that DIB controls must address not only conventional data and identity exposure, but also prompt injection, poisoned context or retrieval sources, excessive agency, and misuse of AI-enabled tools. 

Microsoft's 2026 Digital Defense Report reinforces these concerns with observed activity against generative AI agents.⁸ The report identifies prompt and intent manipulation, sensitive data exposure, identity and privilege compromise, excessive agency, and operational-integrity failures as key agent risk areas. For DIB organizations, this reinforces the need to treat agents as governed non-human identities whose data access, tool use, permissions, configuration changes, and actions must be visible, attributable, and controllable. 

The OWASP Agentic Security Initiative (ASI) further highlights how autonomous and semi-autonomous agents further expand this risk landscape⁹. Unlike traditional applications, agents can access data, invoke tools, interact with external systems, and take actions on behalf of users. As a result, compromise of an agent may extend beyond information exposure to operational impact. For DIB organizations, the outcome may include unauthorized disclosure of CUI, export-control violations, contractual reporting obligations, supply-chain risk, or mission degradation. 

Table 2: Agentic AI Attack Surface Areas and Control Considerations⁸ 

Note: Control availability varies by Microsoft cloud environment. DIB organizations should validate GCC High availability, authorization boundaries, and product roadmap status before treating any capability identified as ‘Future’ as an operational control. 

Industry efforts such as the OWASP Agentic Security Initiative, the Agent Control Standard (ACS), and Microsoft's Agent Governance Toolkit (AGT) are helping establish common approaches for agent identity, runtime control, policy enforcement, and observability⁸. While these frameworks continue to mature, a consistent pattern is emerging: The most significant AI risks remain rooted in identity, access, data governance, monitoring, and lifecycle management. The encouraging takeaway for DIB organizations is that these are familiar problems. Industry crosswalks continue to demonstrate that many recommended AI safeguards can be implemented today using the same identity, data protection, governance, and security operations capabilities organizations already rely on elsewhere in the enterprise. 

DFIR, GRC, and Audit Evidence 

Agent-specific security capabilities can improve visibility and control as they become available in GCC High, but their absence does not prevent organizations from building a defensible investigation and governance capability today. DIB organizations can extend existing Zero Trust telemetry across identity, data, endpoints, workloads, and security operations to investigate AI-related activity, validate control operation, and preserve evidence for compliance and incident response. The objective is to correlate who initiated an action, which identity or workload performed it, what data or connector was involved, what policy applied, what action occurred, and how the organization contained or remediated the event. Existing evidence sources include Microsoft Entra audit logs, Microsoft Purview auditing, endpoint and network telemetry from Microsoft Defender, Microsoft Defender XDR advanced hunting, workload and application logs, and Microsoft Sentinel for cross-source correlation, investigation, retention, and response. 

Table 3: Cross-cutting DFIR, GRC, and Audit Evidence for AI in GCC High

Note: Specific event coverage, retention, connector availability, and automation features vary by licensing, product configuration, and government-cloud service availability. Organizations should validate required telemetry in their own GCC High tenant, configure retention deliberately, and test their ability to collect and correlate evidence during an AI incident exercise. 

No single telemetry source captures the full AI event chain. Microsoft Defender for Endpoint supplies host and endpoint security evidence; Azure Activity Log supplies management-plane evidence; Microsoft Foundry diagnostic logs supply service and runtime evidence; and the AI application must emit approved application, agent, connector, and retrieval metadata to provide end-to-end traceability. Organizations should intentionally scope prompt and response logging because retaining sensitive CUI or export-controlled content can create an additional protected data repository. 

Organizations do not need to wait for a dedicated AI security product category to emerge. They can begin today by extending Zero Trust principles to AI systems and agents, applying the same foundational disciplines already used to secure users, applications, devices, and data. This principle forms the basis for Discover & Observe, Secure, and Govern recommendations that follow. 

What's next 

Part 1 established why AI security matters in the DIB, how the risk landscape spans AI usage, applications, platforms, and agents, and why existing telemetry already provides a defensible evidence foundation. Part 2 turns from risk to response. It describes Microsoft's approach to securing AI, including how Zero Trust extends to AI systems and agents, lessons learned from Microsoft Digital's own internal deployment, the six pillars of agent governance, and the AI shared responsibility model. It then moves into practical guidance for the Discover & Observe and Secure priorities, mapped to the capabilities available in GCC High today, so security teams can act on the risks described here. 

References 

1. The White House, Winning the AI Race: America's AI Action Plan, July 2025. https://www.whitehouse.gov/releases/2025/07/white-house-unveils-americas-ai-action-plan/ 

1. National Institute of Standards and Technology (NIST), Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023. https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10 

1. Cybersecurity and Infrastructure Security Agency (CISA), Zero Trust Maturity Model Version 2.0, April 2023. https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf 

1. English, Larry. “AI Agents Aren't Creating Security Problems. They're Revealing Them,” Forbes, August 24, 2026. https://www.forbes.com/sites/larryenglish/2026/08/24/ai-agents-arent-creating-security-problems-theyre-revealing-them/ 

1. Diver, Richard. Guardians of AI: Building Innovation with Safety and Security. Independently published, 2024. 

1. NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, July 2024. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf 

1. MITRE, MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems). https://atlas.mitre.org/ 

1. Microsoft. Microsoft Digital Defense Report 2026. October 1, 2026. https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/ 

1. OWASP Foundation, OWASP Agentic Security Initiative (ASI). https://genai.owasp.org/initiatives/agentic-security-initiative/