How do security teams evaluate a new ai tool before deploying it internally

Reviewing Vendor Data Handling and Retention Practices

Security teams generally begin by reviewing a prospective AI tool vendor’s data handling and retention practices in detail, understanding exactly what data the tool collects, how long it’s retained, whether it’s used to train the vendor’s broader models, and what contractual protections exist around this data handling.

Testing for Known AI-Specific Vulnerability Classes

Beyond general data practices, security teams increasingly test new AI tools for susceptibility to known AI-specific vulnerability classes, particularly prompt injection, attempting to determine whether the tool can be manipulated into revealing information or taking actions it shouldn’t through carefully crafted adversarial input.

Assessing Required System Access Levels

A critical part of this evaluation involves assessing exactly what level of access the tool would need to existing company systems and data to function as intended, since a tool requiring broad, deep system access represents meaningfully greater security exposure than one operating with more narrowly scoped, limited access.

Why This Process Mirrors Traditional Vendor Security Review

This overall evaluation process generally mirrors the rigor security teams already apply to evaluating any other new software vendor, extending established vendor risk assessment practices to cover the additional, genuinely novel risk categories AI tools specifically introduce beyond what traditional software vendor evaluation typically covers.

Why Many Teams Apply Additional Scrutiny Specifically for AI Tools

Given these genuinely novel risk categories — data potentially feeding into model training, and vulnerability to attack techniques like prompt injection without a direct traditional-software equivalent — many security teams apply additional scrutiny specifically for AI tools beyond their standard vendor evaluation process.

Bottom Line

Security teams evaluate new AI tools by reviewing vendor data handling practices, testing for AI-specific vulnerabilities like prompt injection susceptibility, and assessing required system access levels, generally extending established vendor security review rigor to cover AI’s genuinely novel additional risk categories.

Go deeper

• How Do Companies Evaluate Enterprise AI Vendors?
• What happens when an ai vendor a business relies on discontinues the product?
• What Are the Best AI Tools for Code Review?