Chapter 05 · GenAI COMPASS Playbook, 2025
Your
game plan
You cannot write a fixed checklist for a threat that changes every quarter. You can build a loop that keeps working: look, understand, decide, move - then look again.
Four steps you keep repeating
Pick a step to see what it asks of you. Most teams are good at one of these and weak at the other three - usually strong on act, thin on observe.
Know what you run, and what is happening to it
You cannot secure a model nobody inventoried. This step is mostly paperwork, which is why it gets skipped.
- Inventory every model, tool, and MCP server in use - including the ones bought on a card
- Log prompts, tool calls, and outputs with a retention period you can defend
- Ask staff what they actually use, anonymously. The list will be longer
- Monitor for the aggregate patterns: volume, drift, unusual hours
Sign this step is broken: the first time you learn about an AI tool is in an incident report.
Turn noise into a ranked picture of risk
Threat intelligence, incident reports, and a model of your own exposure. Without this step, "act" is just buying tools.
- Map each system to the risks it actually carries - not the ones in fashion
- Score likelihood and impact together; either one alone misleads
- Track what attackers in your sector are doing, not what is trending globally
- Re-orient when the model changes, the tools change, or a peer is hit
Sign this step is broken: every risk is "high", so nothing is.
Choose the control, the owner, and the date
A decision is three nouns and a number. If any are missing, you have a discussion, not a decision.
- Name the control in concrete terms: "approval on payments", not "improve governance"
- Name one owner. Two owners is zero owners
- Name the date, and the date it will be retested
- Accept some risk explicitly, in writing, and review it on a schedule
Sign this step is broken: the same item appears on the risk register three quarters running.
Prevent, detect, respond - then observe again
The part everyone funds. It only works when the other three steps told you what to build and who to call.
- Prevent: least privilege, least agency, gated irreversible actions
- Detect: alert on behaviour, and make sure someone is on the other end
- Respond: a kill switch you have tested, and a person who can pull it
- Learn: every incident and near-miss feeds back into step one
Sign this step is broken: nobody knows who can turn it off.
If you only do one thing
The four threats below need different first moves. Pick the front you are actually on, do the one thing, and only then worry about the rest.
Vulnerability exploitation
Classic intrusion, accelerated by AI-assisted reconnaissance and tooling. Your exposure is the internet-facing surface plus whatever the model can reach.
One thing Patch the exposed service this week, and remove one capability the agent did not strictly need.
Deepfakes and impersonation
Cloned voices and faces aimed at the people with authority to move money. The loss lands on a person, not a server.
One thing Announce the callback rule and the code word in the next team meeting - and use them once.
Disinformation
Fabricated statements in your name, moving markets or trust. The damage is time-sensitive and reputation-shaped.
One thing Pre-write one holding statement and name who may publish it. Minutes decide this one.
Agentic AI failure
An agent acting within its permissions and still causing harm, at machine speed, across systems nobody connected.
One thing Put a human approval in front of the single most irreversible action it can take.
Score it, then decide
Likelihood times impact, one to five each. The arithmetic is deliberately simple - this is a teaching scale for a conversation, not .
The severity scorer
Likelihood × impactThree documents you need
Every plan eventually runs into the same three questions: who approved this, what is it allowed to do, and what happens when it goes wrong. Three short documents answer all three, and none of them need a lawyer to draft.
The register
Every AI system, its owner, its data sources, and its capability list. One page per system. If a system is not on the register, it does not go to production.
The acceptance policy
What staff may and may not paste into a tool, and which approved tool exists for each task. A ban without an alternative is a policy that creates shadow AI.
The one-page incident plan
Who declares, who switches off, who calls the bank, who speaks publicly, and what the first hour looks like. Rehearse it once, then date it.
Sources
- OWASP GenAI COMPASS Playbook (2025) - genai.owasp.org
- The loop is the OODA decision cycle, applied here to generative AI risk. The severity scale is a teaching device, not a standard.