GenAI COMPASS Playbook · 2025
The
Playbook
Knowing the risks isn't enough - you need a repeatable method to stay ahead as AI keeps changing. COMPASS is 's four-step way of doing exactly that.
Four simple steps: Observe, Orient, Decide, Act. Then do it again.
Observe · Orient · Decide · Act
The OODA loop, borrowed from the fighter pilot, applied to the machine. Because in the fast-changing world of generative AI, the side that cycles faster wins.
See the Attack Surface
Build a structured view of your AI-related threats. Map every deployment - cloud, on-premises, hybrid - and every profile: the adversary using AI against you, your own Copilots and Geminis, and your custom agents.
Find Your Bearing
Align what you see with known vulnerabilities, real-world incidents, and threat intelligence. Map each flaw to a CWE and score it. Ask the red-team questions. Understand where you stand.
Choose Your Course
Map threats to defenses and mitigations. Decide what to fix, what to monitor, and what to accept - based on your risk appetite, not your fear.
Steer, Then Re-Steer
Turn findings into an actionable, owned, time-boxed roadmap - then loop back and observe again. It is a cycle, not a destination.
The Four Threat Profiles
COMPASS organizes the attack surface into profiles - because the threats you face from the outside are not the same as the ones you breed on the inside.
I
Profile 1 · External Threats
The Adversary Outside
“Attackers using AI against your company.”
+
The Adversary Outside
“Attackers using AI against your company.”
What it is
Adversarial use of AI against your organization - attack acceleration, identity compromise, and fraud at machine scale.
What to watch for
- Deepfakes for executive impersonation and vishing
- AI-powered credential stuffing and password cracking
- AI-augmented spear-phishing and BEC
- Invoice forgery and payment redirection
- Automated disinformation and influence operations
How to fix it
- Update fraud detection for deepfakes
- Monitor brand and sentiment
- Harden authentication (phishing-resistant MFA)
II
Profile 2a · Internal Adoption
The Neglect Within
“Risks from your own team using AI without guardrails.”
+
The Neglect Within
“Risks from your own team using AI without guardrails.”
What it is
Risks from your own AI use - shadow AI, absent governance, and unmanaged model risk.
What to watch for
- No AI governance board or ownership
- Shadow AI deployed by business units
- Overprivileged service accounts and non-human identities
- No input/output logging for GenAI
- No rollback plan if the AI fails or is compromised
How to fix it
- Central model registry and audit trail
- AI lifecycle metrics and risk ranking
- Incident playbooks for AI-specific threats
III
Profile 2b · Copilot & Gemini
The Assistant With Too Many Keys
“Your office AI assistant can surface data it shouldn't.”
+
The Assistant With Too Many Keys
“Your office AI assistant can surface data it shouldn't.”
What it is
Enterprise assistants surface data users have access to - but should not. Overprivileged access becomes a search engine for secrets.
What to watch for
- Overprovisioned access exposed by advanced search
- Immature or missing data classification
- Unmanaged AI service accounts
- Risky default settings, content sprawl
How to fix it
- Least privilege before enabling the assistant
- Tiered sensitivity labeling, enforced
- Govern non-human identities
IV
Profile 2c · Agentic Projects
The Autonomy You Handed Over
“Your own AI agent acting beyond what you meant it to do.”
+
The Autonomy You Handed Over
“Your own AI agent acting beyond what you meant it to do.”
What it is
Agentic and generative projects introduce autonomy, tool misuse, and emergent behavior without oversight.
What to watch for
- Agents initiating harmful or unauthorized actions
- Tool misuse via prompt injection or manipulated context
- No secondary validation of AI outputs
- One compromised agent disrupting entire workflows
- No traceability or cryptographic logs of decisions
How to fix it
- Least agency and least privilege for every tool
- Human-in-the-loop for irreversible actions
- Sandbox, segment, and bound blast radius
Speaking the Industry's Language
To fix an AI vulnerability you must first name it. COMPASS maps each AI weakness to the industry's shared taxonomy - CWE and CVSS - so an LLM flaw is scored and tracked like any other software defect.
Common Weakness IDs (CWE)
- Prompt injection → CWE-77 Command Injection
- Jailbreak → CWE-707 Improper Neutralization
- Code injection → CWE-94
- Output escaping failure → CWE-116
- Training-data poisoning → CWE-20 / CWE-494
- Unvalidated LLM prompting → CWE-1427
How Bad Can It Get?
A zero-shot prompt injection allowing model override can score CVSS 8.6-9.8 (High-Critical) - a remote, low-complexity, no-auth attack with high integrity impact. COMPASS then folds that into a simple 5-point impact/likelihood scale, erring high when unsure.
"The Nuclear AI Disaster" - document the worst-case AI scenario your organization could face. That single scenario becomes the anchor for every control you build.
Five Steps to Start Today
Confirm legal and regulatory compliance obligations are up to date for AI.
Update fraud detection - invoicing, money movement, and hiring - to detect and mitigate deepfakes.
Update the incident response plan to include AI incidents, including a disinformation strategy.
Review third-party partners and add AI-specific questions to your vendor assessments.
Write an AI policy, or update the Acceptable Use Policy, so company data stays out of unapproved tools.