The RiskReview Blog
Practical perspectives on AI risk, security testing, compliance, and governance.
Stay Updated on AI Risk & Compliance
Get notified when we publish new insights on AI risk assessment, regulatory compliance, and security testing.
- Read
AI Governance · Regulation · Federal · State Law · Preemption
Trump's December 2025 Executive Order vs. State AI Laws: What Actually Gets Preempted?
Executive Order 14365 doesn't preempt state AI laws by itself. It sets in motion litigation, agency rulemaking, and funding leverage. Here's what's protected, what's in the crosshairs, and what remains unsettled.
- Read
Security · RAG · Vector Database · Embeddings · Privacy · LLM Security
Embedding Inversion Attacks: Why Your Vector Database Isn't as Safe as You Think
The assumption that vector embeddings are 'not human-readable' and therefore safe is wrong. Generative embedding inversion can reconstruct original text from vectors. What this means for RAG architectures storing sensitive documents.
- Read
AI Governance · Asset Inventory · Shadow AI · MCP · Risk Management
Building an AI Asset Inventory: Models, Agents, MCP Servers, Datasets, and Prompts You Don't Know About
IBM's data says 86% of organizations are blind to AI data flows. The first step in securing AI is knowing what you have. How to discover, classify, and continuously monitor every AI asset in your environment — including the ones your teams spun up without telling you.
- Read
NIST AI RMF · MITRE ATLAS · ISO 42001 · AI Governance · Threat Model
NIST AI RMF, MITRE ATLAS, and ISO 42001: Choosing the Right AI Security Framework for Your Threat Model
How NIST AI RMF, MITRE ATLAS, and ISO 42001 differ, where they overlap, and how to wire them into your existing program instead of starting over.
- Read
Impact Assessment · AI Governance · Compliance · Regulation
Algorithmic Impact Assessments Aren't Optional Anymore: Here's How to Actually Do One
Colorado, the EU AI Act, and multiple state laws now require documented impact assessments for high-risk AI systems. They must be living documents updated when systems change. A step-by-step guide to scoping, conducting, documenting, and maintaining AIAs that satisfy regulators without consuming your entire quarter.
- Read
Shadow AI · Security · Detection · CASB
Shadow AI Already Accounts for 20% of Enterprise Breaches: Here's How to Find It
IBM's 2025 data shows shadow AI incidents cost $670K more than standard breaches. Most knowledge workers use GenAI at work and bring their own tools. How to detect unsanctioned AI through CASB, SSO, network, and browser telemetry without becoming the team that blocks everything.
- Read
AI Policy · Governance · Enablement · ISACA
60% of Employees Use AI at Work: Only 18% Know Their Company Has a Policy
ISACA data shows adoption has outrun governance everywhere. Why discovery without enforcement fails, why enforcement without enablement creates more shadow AI, and how to close the gap with a phased program that starts with visibility and ends with structured enablement.
- Read
Security · Prompt Injection · LLM Security
Prompt Injection Attacks: Why Your AI Chatbot Is Probably Vulnerable
Prompt injection is the SQL injection of the AI era. We explain how these attacks work, why most defenses fail, and what a proper testing methodology looks like.
- Read
NIST AI RMF · EU AI Act · Compliance · AI Governance · Risk Management
NIST AI RMF vs. EU AI Act: Mapping Two Frameworks So You Don't Do the Work Twice
If you've started with NIST's voluntary framework, you're not starting from zero for the EU AI Act. A practical map of where the work overlaps, where it diverges, and what you still have to build.
- Read
Red Team · LLM Security · Prompt Injection · Adversarial Testing · OWASP
How to Red-Team an LLM Application: A Security Engineer's Guide to AI Adversarial Testing
Treating the LLM app as an attack surface: scoping, repeatable attack fixtures, prompt injection and tool-abuse tests, and turning findings into tickets. A practical guide for security engineers.