AI Security Architecture

Application and AI Security Architecture

Secure integration of AI, automation, and sensitive business workflows

The Problem

Organizations are adopting AI and LLM-based systems under pressure to move fast, but the same application security fundamentals still apply: trust boundaries, identity, authorization, data handling, logging, secure APIs, and operational controls. AI changes the shape of those risks because model inputs can behave like instructions, retrieved content can cross trust boundaries, and agents can invoke tools with real system impact.

The gap between “AI capability” and “secure integration” is where risk accumulates.

What I Do

I review and design security architectures for AI-integrated systems using an application-security lens: data flows, runtime behavior, APIs, mobile and platform assumptions, cryptographic protection, and evidence required by regulated teams.

When to Engage

This work is most useful when an AI capability is moving from experiment to production and the organization needs confidence before exposure increases:

An LLM, RAG, or agentic workflow will touch sensitive data, internal systems, regulated workflows, or customer-facing decisions
Security teams need a threat model that covers prompt injection, data leakage, tool misuse, model supply chain, and monitoring gaps
Architecture teams need defensible boundaries between AI components and trusted business systems
Compliance, privacy, or audit stakeholders need evidence that AI deployment risks have been identified and reduced

Threat Modeling for AI Systems

Structured threat analysis of LLM/ML pipelines (STRIDE, MITRE ATLAS, FAIR)
Adversarial input and prompt injection risk assessment
Data poisoning and model extraction attack surface mapping
Supply chain risk analysis for model dependencies and training data

Secure AI Integration Architecture

Isolation boundaries between AI components and trusted systems
Cryptographic protection of model assets, inference data, and API channels
Privilege separation and least-privilege enforcement for AI agents
Secure deployment patterns for on-premise and hybrid environments

Compliance-Aligned AI Deployment

Mapping AI system risks to existing compliance frameworks (NIST AI RMF, FIPS, PCI)
Audit trail and explainability architecture for regulated decision-making
Data governance design to satisfy privacy and retention requirements
Documentation to support certification and regulatory review

AI-Enhanced Security Operations

Automated threat analysis using MITRE ATT&CK and AI-driven classification
AI-assisted vulnerability triage and risk prioritization
Intelligent monitoring and anomaly detection architecture
Productivity and quality gains through AI-augmented security workflows

Relevant Experience

Bank of Canada — Mobile Security and Threat Analysis

Assessed mobile platform security for the CBDC initiative, contributed to threat modeling and risk assessment, and used OpenAI API in research on automated threat analysis. Implemented a non-custodial digital currency wallet proof of concept with key management, secure storage, transaction signing, application hardening, and runtime security posture monitoring.

Ciena — Security Engineering with AI-Assisted Workflows

Used AI-assisted development tools in security engineering work while modernizing cryptographic foundations, reviewing TLS/X.509 behavior, supporting FIPS 140-3 and Common Criteria activities, and remediating platform security issues.

Irdeto — Application Protection at Scale

Built application protection technologies for DRM and IoT products where adversarial reverse engineering, malformed inputs, trust-chain handling, runtime protection, and operational key management were central concerns.

Standards & Frameworks

Area	Standards
AI Security	NIST AI RMF, MITRE ATLAS, OWASP LLM risks
Threat Modeling	STRIDE, FAIR, MITRE ATT&CK, OWASP
Cryptography	FIPS 140-3, Common Criteria, NIST PQC
Payment & Mobile	PCI-MPoC, PCI-DSS, EMV, OWASP MASVS

Engagement Models

Architecture review — assess AI integration security for a new or existing system
Threat model — structured analysis of AI/ML attack surfaces with prioritized mitigations
Compliance mapping — align AI deployment with regulatory and certification requirements
Advisory retainer — ongoing technical guidance during design and implementation

Typical Deliverables

AI system trust-boundary diagram and data-flow review
Prompt injection, RAG, agent, and tool-invocation threat model
Prioritized control roadmap with quick wins and architectural changes
Logging, monitoring, and incident-response recommendations for AI-specific failure modes
Compliance mapping for NIST AI RMF, MITRE ATLAS, OWASP LLM risks, PCI, FIPS, or internal governance requirements

Contact me to discuss your AI security architecture needs.