Reference · ai-security-program
Building an AI Security Program: From Policy to Implementation
Free Substack essay by Ron Fybish (CYBER WOW) setting out a five-stage AI security maturity model, a CISO/CIO/Chief-AI-Officer ownership split, layered shadow-AI discovery and a four-slide board report, with five diagrams.
More references
- [un]prompted 2026 slide archiveai-security-programCommunity GitHub archive of 49 slide decks from [un]prompted 2026, the AI Security Practitioner Conference (March 3-4, San Francisco), spanning AI governance, agent security, offensive AI and agent evaluation; no licence stated.
- AI Security Made Easy — Rob van der Veer (SANS AI Cybersecurity Summit 2025)ai-security-programSlide deck from the SANS AI Cybersecurity Summit 2025 by Rob van der Veer of the Software Improvement Group, framing six ways AI security differs from standard security plus the AI-specific threats and controls it names.
- AI Security Maturity Model (AISMM)ai-security-programCloud Security Alliance maturity model for an enterprise AI security program: 12 categories across three domains, five CMM levels and 120 KPI control objectives mapped to the AI Controls Matrix, plus a spreadsheet and poster.
- AI Security Maturity Model: A CISO Roadmapai-security-programVendor blog post from BeyondScale Technologies setting out a five-level AI security maturity model mapped to NIST AI RMF tiers and OWASP LLM Top 10 entries, with a five-question self-assessment and a per-level action plan.
- Board Defensible — CISO Next Genai-security-programSerialized AI governance field guide from Moriah Hara's CISO Next Gen: 12 monthly chapters pairing a board briefing with a team playbook, five metrics and a 30/90/365-day roadmap; 2 of 12 published, chapter 1 Varonis-sponsored.
- Enterprise AI Governance at Snowflake: Balancing Innovation & Riskai-security-program12-slide AI governance deck by Ragini Ramalingam, Director of Enterprise Security at Snowflake: a cross-functional steering committee, four visibility pathways, Enabled/Gated GenAI features, six coding-agent guardrails.