Security and safe use of tools
- Can I put official or unpublished information into public tools like ChatGPT? Contrasting
- Can I use Microsoft Copilot, Slack GPT, or similar embedded AI features at work?
- Are AI meeting transcription tools allowed? Contrasting
- Should I use a public AI API, a privately hosted model, or a managed platform? Contrasting
- What are the main security risks of using AI in government?
- How do I stop an AI system from leaking personal or sensitive data?
- How should I handle prompt injection and other generative AI-specific threats? Contrasting
- What is the difference between prompt injection and jailbreaking?
- Can I trust generative AI outputs, or do they hallucinate?
- What does NCSC say about securing AI across the life cycle?
- What is adversarial machine learning and why does it matter?
- What is data poisoning in an AI system?
- How should I threat-model an AI system?
- How should I handle importing third-party AI models or weights?
- What controls do I need when calling an external AI API?
- Which AI assets should I protect, including logs?
- Can attackers steal my model or training data through the API?
- Should AI products ship with secure-by-default settings?
- Is Secure by Design mandatory for government AI services? Contrasting
- What does Secure by Design expect for detect and respond?
- Who is the Government AI Security Team and when should I contact them?