01
Visibility & Policy
AI system inventory, model registry with version traceability, risk-based deployment approval, EU AI Act jurisdiction-based access restrictions.
Home | Consulting | Strategy | GOVERNANCE ADVISORY
AI introduces a new attack surface, not just another application.
Enforceable AI control boundaries, reduced model and regulatory risk, and scalable, compliant AI adoption — mapped to MITRE ATLAS, OWASP's LLM Top 10, and the NIST AI Risk Management Framework. Distinct from PHTN.ai's platform-level runtime controls.
Six control domains
02
Data & Knowledge Protection
Prompt ingress inspection for PII/PHI/IP, response egress scanning, vector database access segmentation, embedding encryption at rest.
03
Model & Pipeline Integrity
Dataset integrity verification, signed model artifacts, SBOM/MBOM dependency analysis, secured ML CI/CD workflows.
04
Runtime Defense
Token-level behavioral anomaly scoring, prompt injection signature detection, session isolation, automatic policy tightening.
05
Operational Resilience
Structured AI red teaming, adversarial robustness testing, bias and fairness threshold checks, version rollback.
06
Monitoring & Compliance
Observability, audit trails, shadow-AI detection, executive compliance reporting.
Two categories, two postures
01
Homegrown AI Applications
Full control over data, models, and runtime. Full control stack: posture management, data-loss prevention, AI gateway, MCP gateway, runtime protection, red team, observability.
02
External AI Applications
ChatGPT and third-party tools — limited control. Focus shifts to policy, approved-tool lists, and data protection: shadow-AI detection and block/redact enforcement.
Reference threat intelligence, not guesswork
Photon's AI governance practice is built against external, named standards — not a proprietary checklist.
MITRE ATLAS
Layer-based framework for agentic AI threat modeling
OWASP
LLM Top 10 — the industry-standard LLM risk taxonomy
NIST AI RMF
Risk Management Framework — Govern, Map, Measure, Manage
EU AI Act
Jurisdiction-based access restrictions built into policy enforcement
Evidence
Browser Extension Pilot
6,000+ logs in 20 days
Real-time data-loss prevention monitoring across public AI tool usage, rolled out as a production pilot.
MCP Gateway Integration
Six-layer protection
Agent permissions, data-in-motion blocking, instruction monitoring, response filtering, scope enforcement, and full lifecycle logging.
Global Professional Services Firm
Scaling AI adoption without a unified security framework created data-exposure and compliance-gap risk. A standardized AI security architecture review and control-domain rollout brought governance and oversight into one framework.