Your organisation is deploying AI. But can you tell your board, with confidence, that those AI systems meet the same security standards as the rest of your infrastructure?
For most Australian organisations, the honest answer is no. AI systems have been adopted quickly – often through innovation teams, cloud-based tools, or third-party integrations – and they’ve largely bypassed the security governance that every other system must satisfy. The result is a growing gap between the security posture organisations believe they have and the one they actually have.
The Australian Signals Directorate (ASD) has published dedicated guidance on AI and machine learning supply chain risks, warning that pre-trained models, open-source datasets, and third-party AI components introduce vulnerabilities that conventional cybersecurity practices don’t fully address. The use of AI creates new risk. Can you prove those risks are being managed?
The ASD Essential Eight provides a practical framework for answering that question.
Why the Essential Eight Applies to AI
The Essential Eight is a set of prioritised mitigation strategies designed to protect organisations against common cyber threats. The eight strategies – Application Control, Patch Applications, Restrict Microsoft Office Macros, User Application Hardening, Restrict Administrative Privileges, Patch Operating Systems, Multi-factor Authentication, and Regular Backups – form the baseline for cybersecurity hygiene across Australian government and critical infrastructure.
These strategies were designed for traditional IT networks. AI systems don’t fit neatly into that mould. Models aren’t applications in the conventional sense. Training data isn’t a database you patch. Inference engines don’t behave like the servers your operations team already monitors.
But the principles behind each strategy translate directly. Application control becomes model verification. Patching becomes dependency scanning. Access restrictions become governance over who can promote a model to production. The challenge is that most organisations haven’t yet made the connection that the Essential Eight is relevant to AI.
That connection matters. When a board asks whether AI deployments comply with the organisation’s cybersecurity obligations, the Essential Eight provides a structured, recognised framework for demonstrating that compliance. Without it, the answer to “how secure is our AI?” remains a collection of assumptions rather than evidence.
Applying the Essential Eight to AI Deployments
The table below maps each Essential Eight strategy to its AI equivalent, with commonly used tools for each. These tools are selected for their widespread adoption and are offered in the spirit of transparency. They represent practical starting points, not endorsements. Every organisation’s requirements are different, and the right tooling depends on your specific environment, risk profile, and existing infrastructure.
| Essential Eight Strategy | AI Equivalent | Commonly Used Tools |
|---|---|---|
| Application Control | Model Signing and Verification – Ensure only verified, approved models run in production environments. | Sigstore (cosign) for cryptographic model signing; SLSA framework for provenance verification. |
| Patch Applications | Dependency Scanning for ML Pipelines – Scan machine learning libraries and frameworks for known vulnerabilities. | Snyk, GitHub Dependabot, Grype for continuous vulnerability scanning across ML dependencies. |
| Restrict Microsoft Office Macros | AI Output Filtering – Scan AI-generated code, scripts, and content for malicious or unintended logic before execution. | Guardrails AI, NVIDIA NeMo Guardrails for content filtering and output validation. |
| User Application Hardening | Inference Engine Isolation – Run AI models inside hardened, sandboxed containers to prevent model-based exploits from reaching host systems. | gVisor for kernel-level sandboxing; AppArmor for mandatory access controls; CIS Benchmarks for Docker container hardening. |
| Restrict Administrative Privileges | Role-Based Access for Model Registries – Control who can train, modify, approve, and deploy models to production. Limit the access and permissions granted to AI systems themselves. | MLflow role-based access controls; Hugging Face Enterprise access management. |
| Patch Operating Systems | Minimal Base Image Management – Use stripped-down, regularly updated container images to reduce the attack surface of AI deployment environments. | Chainguard Images and Wolfi for distroless, automatically updated base images. |
| Multi-factor Authentication | Hardware-Backed Authentication for AI Infrastructure – Protect access to model repositories, training pipelines, and deployment systems with phishing-resistant MFA. | YubiKey and FIDO2 protocols for hardware-backed authentication to registries and pipelines. |
| Regular Backups | Model Versioning and Immutable Storage – Maintain versioned copies of model weights, configurations, and training datasets in tamper-proof storage for disaster recovery. | DVC (Data Version Control) for model and dataset versioning; AWS S3 Object Lock for immutable storage. |
Supporting Technical Practices
Beyond the eight strategies, several practices strengthen your AI security posture across the full lifecycle:
Model provenance establishes a verifiable chain of custody for every model artifact, from training data through to the version running in production. Cryptographic signing (using tools like Sigstore) means your team can confirm that a deployed model is the exact version that was approved, and that it hasn’t been tampered with in transit or storage.
Data integrity validation protects against training data poisoning, one of the most significant AI-specific threats identified in ASD’s supply chain guidance. Implementing checksums and anomaly detection on training datasets (using frameworks like Great Expectations) helps detect unauthorised modifications before they corrupt model behaviour.
Inference sandboxing isolates running models from the broader infrastructure. If a model is compromised through adversarial inputs or embedded malicious code, sandboxing prevents that compromise from escalating to the host operating system or adjacent systems.
Supply chain transparency through a Software Bill of Materials (SBOM) gives your security team visibility into every component in your AI stack, every library, every framework version, and every sub-dependency. ASD’s guidance specifically recommends maintaining SBOMs for AI systems, and AI-specific extensions to existing SBOM standards are emerging to address the unique components of machine learning pipelines.
Beyond Testing: Why Validation Changes the Conversation
Most approaches to AI security focus on testing. Testing is essential – it identifies weaknesses, finds vulnerabilities, and reveals where things are broken. But testing alone answers only half the question your board is asking.
Testing tells you what’s wrong. Validation tells you what’s working.
That distinction matters more than it might seem. When a senior executive asks “Is our AI secure?”, they’re not asking whether anyone has looked for bugs recently. They’re asking whether there’s a systematic, ongoing process that proves – with evidence – that AI systems continue to operate as expected, within the boundaries the organisation has set.
Validation is end-to-end. It covers the entire lifecycle: the integrity of training data, the provenance of the model, the security of the deployment environment, the behaviour of the system in production, and the governance controls around who can change what. It doesn’t stop at deployment. It runs continuously, because AI systems change over time, through model drift, data updates, retraining cycles, and evolving threat landscapes.
Testing finds the gap. Validation proves there isn’t one.
This is the difference between hope and certainty. A test report says “we looked and didn’t find problems.” A validation framework says “here is the evidence that each control is in place and functioning, mapped to a recognised national standard, reviewed at defined intervals.” One is a point-in-time activity. The other is a governance mechanism that provides ongoing assurance.
When you connect validation to the Essential Eight, you give leadership something concrete: a structured, auditable record that your AI systems meet the same cybersecurity standards the organisation applies everywhere else. That record becomes the foundation for compliance reporting, risk committee discussions, and the confidence to scale AI adoption without scaling risk.
Where to Start
If you’re reading this and recognising that your organisation’s AI systems haven’t been through this lens, you’re in good company. The pace of AI adoption has outstripped security governance in most organisations. The gap exists and now is the time to close it.
Three practical steps to begin:
First, map what you have. Identify every AI system in your environment, including third-party tools, embedded AI features, and models running in cloud services. You can’t secure what you can’t see.
Second, assess against the Essential Eight. Use the mapping in this article as a starting framework. For each of the eight strategies, determine whether your AI systems have equivalent controls in place. Document the gaps.
Third, move from testing to validation. Establish a process that doesn’t just check for problems periodically, but continuously confirms that your AI systems are operating within their defined boundaries. Build the evidence base that your board needs to make informed decisions about AI risk.
The ASD has made it clear that AI systems carry supply chain risks that demand dedicated attention. They’ve also provided guidance on deploying AI systems securely that reinforces the need for ongoing monitoring, validation, and governance. The Essential Eight gives you the structure. Validation gives you the proof.
The organisations that get this right will be more secure, and be the ones that can deploy AI with confidence and demonstrate that confidence to the people who need to see it most.
References
Australian Signals Directorate. Artificial intelligence and machine learning: Supply chain risks and mitigations.
Australian Signals Directorate. Essential Eight.
Australian Signals Directorate et al. Deploying AI Systems Securely.