AI security and SASE glossary

Definitions are where most security conversations quietly go wrong: two people use the same word for different things and only discover it after the budget is spent. Each entry below is written to stand completely on its own, so it survives being quoted out of context.

Compiled by Robin Johns, Worldwide AI Subject Matter Expert at Cato Networks and author of two books on SASE — known across the industry as “The SASE Guy”.

Artificial intelligence

Artificial intelligence (AI)

Software that performs tasks normally requiring human judgement — recognising patterns, generating language, making predictions or taking decisions — by learning statistical structure from data rather than by following rules written out in advance.

Large language model (LLM)

A model trained on very large volumes of text to predict likely continuations, which produces the ability to answer, summarise, translate and write code. An LLM has no separate channel for instructions and data: everything it reads is one stream of text, which is the root cause of prompt injection. Read more →

Generative AI

AI that produces new content — text, images, audio, video or code — rather than only classifying or scoring existing content.

Agentic AI

AI systems that plan, call tools and take actions towards a goal with limited human intervention, rather than only producing text. The security consequence is that an agent holds real capability, so it needs the controls given to a privileged service account. Read more →

AI agent

A system built around a model that can invoke tools — APIs, databases, browsers, shells — to accomplish a task. Its blast radius is defined by the tools it holds and the credentials behind them, not by the model. Read more →

Retrieval-augmented generation (RAG)

A pattern where a model retrieves relevant documents from a corpus and uses them as context when answering, instead of relying only on training data. It improves accuracy and currency, and introduces two risks: retrieved content is untrusted input, and the retrieval layer must honour the asking user’s permissions rather than a service account’s.

Embedding

A numeric vector representing the meaning of a piece of text, image or audio, so that similar items sit close together in vector space. Embeddings power retrieval in RAG systems, and the index that stores them inherits the sensitivity of whatever was embedded.

Vector database

A store optimised for similarity search over embeddings. In an enterprise AI deployment it usually holds a copy of internal documents, which makes it a data-classification problem that teams frequently overlook.

Fine-tuning

Further training of an existing model on domain-specific data to adapt its behaviour. Fine-tuned weights from an unverified source are a supply-chain risk, and data used for fine-tuning can sometimes be extracted from the resulting model.

Prompt engineering

The practice of structuring the instructions given to a model to get reliable results. Useful for quality; not a security control, because instructions in a prompt can be overridden by instructions in the content the model later reads.

System prompt

The standing instructions given to a model before user input, setting role, tone and constraints. It should never be treated as confidential or as a security boundary — system prompts leak, and can be argued with.

Hallucination

Confidently stated model output that is not grounded in fact or in the provided source material. It is a property of how the model generates text, not a bug to be patched, which is why grounding, citation and human review matter more than picking a "more accurate" model.

Model context protocol (MCP)

An open protocol for connecting models to external tools and data sources through a standard interface. It makes capability easy to add, which is exactly why each connected server deserves the scrutiny of a third-party integration rather than of a plug-in.

Inference

The act of running a trained model to produce output. Because inference is metered and billed, an unauthenticated or unthrottled endpoint is a cost exposure as well as an availability one.

Guardrails

Filters and policies applied around a model to constrain inputs and outputs. Guardrails reduce the rate of bad outcomes; they do not bound them, and should never be the only thing between a model and a production system.

AI security

AI security

The practice of protecting AI systems, the data they consume and produce, and the organisation that depends on them. It spans three distinct problems — securing AI you build, securing the AI your people use, and defending against attackers who use AI — which are routinely conflated. Read more →

Prompt injection

An attack that places hostile instructions in text a model processes, causing it to ignore its intended behaviour. There is no complete fix, because a model reads instructions and data as the same stream of text. The practical defence is containment rather than prevention. Read more →

Indirect prompt injection

Prompt injection where the hostile instructions are hidden in content the model retrieves — a web page, PDF, support ticket, calendar invite or code comment — rather than typed by the user. The user never sees the attack, which makes it far more dangerous than the direct form. Read more →

Jailbreak

A prompt crafted to bypass a model’s safety training or system instructions. Jailbreak families appear continuously, which is why AI assurance has to be continuous rather than a one-off gate before launch.

Shadow AI

The use of AI tools inside an organisation without approval, oversight or security review — the AI-era equivalent of shadow IT. It is the most common finding in a first AI security assessment, and blanket blocking reliably makes it worse by pushing usage onto personal devices. Read more →

Excessive agency

Granting an AI agent more capability, permission or autonomy than its task requires. The failure mode is rarely a rogue model; it is a confused one acting with permissions far wider than it needed. Read more →

Data poisoning

Deliberate corruption of the data a model trains on, is fine-tuned on, or retrieves from, in order to change its behaviour. A retrieval corpus an attacker can write to is the most accessible version of this in enterprise deployments.

Model extraction

Reconstructing a proprietary model’s behaviour or parameters by querying it systematically. Chiefly a concern for organisations exposing their own models.

Insecure output handling

Treating model output as trusted input to something else — a shell, a SQL statement, a browser, a downstream API. A classic injection bug in new clothing, and the most avoidable item on any AI vulnerability list.

Unbounded consumption

Also called denial of wallet. Exhausting the compute or budget behind an AI service through unthrottled or unauthenticated requests, affecting cost as much as availability.

AI red teaming

Adversarial testing of an AI system — jailbreaks, injection, data extraction, guardrail bypass, misuse — to find failure modes before an attacker does. Unlike a penetration test it cannot be one-off, because model versions, prompts and corpora all change without notice.

AI bill of materials (AI-BOM)

An inventory of the models, weights, datasets, embeddings, plug-ins and services that make up an AI system. Few organisations maintain one, which is why supply-chain questions about AI are usually unanswerable.

OWASP Top 10 for LLM Applications

The most widely used public taxonomy of vulnerabilities specific to large language model applications, covering prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. Best used as a test plan, not a policy.

NIST AI Risk Management Framework (AI RMF)

A voluntary US framework for managing AI risk, organised around four functions: Govern, Map, Measure and Manage. The most practical structure for a programme being built from nothing. Read more →

ISO/IEC 42001

The certifiable international standard for AI management systems. Useful when governance must be demonstrated to customers, auditors or procurement rather than only internally. Read more →

EU AI Act

European regulation that classifies AI systems by risk tier and imposes obligations accordingly, phasing in over several years and reaching general-purpose AI models and high-risk systems. Classification work depends on an AI system inventory most organisations do not yet have. Read more →

SASE and network security

SASE (Secure Access Service Edge)

A cloud-delivered architecture that converges wide-area networking and network security into a single service applied at the edge closest to the user. Pronounced "sassy"; introduced by Gartner in 2019. Its defining principle is that security policy follows identity rather than network location. Read more →

SSE (Security Service Edge)

The security half of SASE — ZTNA, Secure Web Gateway, CASB, and usually FWaaS and DLP — delivered from the cloud, without the networking half. Introduced by Gartner in 2021. In short: SASE = SSE + SD-WAN. Read more →

Single-vendor SASE

Networking and security delivered from one converged platform with a single policy engine and a single log, rather than a separate SD-WAN and SSE stitched together. Gartner has published a dedicated Magic Quadrant for it since 2023. Read more →

ZTNA (Zero Trust Network Access)

Access control that grants a verified user access to one specific application and nothing else, keeps applications invisible until authorised, and re-evaluates identity, device posture and risk continuously. The access-control implementation of Zero Trust. Read more →

Zero Trust

A security model that removes implicit trust from network position. Nothing is trusted because of where it connects from; every request is authenticated, authorised and continuously evaluated. The engineering translation is that network position must stop being a credential. Read more →

SWG (Secure Web Gateway)

Inspects and filters web traffic, enforcing acceptable use and blocking malicious destinations. In an AI context it is the component that first reveals which AI services users are actually reaching.

CASB (Cloud Access Security Broker)

Discovers and governs SaaS application usage, including unsanctioned services. The usual mechanism for discovering shadow IT, and now shadow AI. Read more →

FWaaS (Firewall as a Service)

Cloud-delivered next-generation firewalling and segmentation for all traffic, removing the need for a firewall appliance at each site or edge.

DLP (Data Loss Prevention)

Inspects content in motion to stop sensitive data leaving the organisation. For AI, it needs to understand AI-shaped interactions — prompts, pasted content, file uploads and API calls — not just email and file transfer.

SD-WAN

Software-defined wide-area networking: policy-driven, optimised transport from sites to applications, typically replacing MPLS and branch routers. SD-WAN alone is not SASE; it is the network layer SASE converges with security.

MPLS

Multiprotocol Label Switching: the private carrier circuits that traditionally connected branch offices to a central data centre. Predictable but expensive and slow to change, and the thing whose renewal dates usually pace a SASE migration.

Lateral movement

An attacker expanding access from an initial foothold to other systems on the same network. It is the specific outcome ZTNA is designed to remove, and the reason one stolen VPN credential so often becomes a full incident. Read more →

Device posture

The security state of the device making a request — patch level, disk encryption, endpoint protection, jailbreak status. A signal Zero Trust systems evaluate alongside identity, continuously rather than only at connection time.

Least privilege

Granting only the access required to perform a task, and no more. Applies unchanged to AI agents, where it should be scoped per tool rather than per agent. Read more →

Egress control

Restricting where systems may send traffic. For AI agents an egress allow-list is one of the few controls that still works after a model has been successfully manipulated.

Backhaul

Routing traffic from a user or branch back to a central data centre for inspection before it reaches its destination. The practice SASE exists to eliminate: when the application is in the cloud and the user is at home, backhaul adds latency and cost without adding safety. Read more →