API Protection for AI Factories: The First Step to AI Security

Earlier in our AI factory series, we defined an AI factory as a massive storage, networking, and computing investment serving high-volume, high-performance training and inference requirements. Like traditional manufacturing plants, AI factories leverage pretrained AI models to transform raw data into intelligence. AI apps are simply the most modern of modern apps, heavily connected via APIs and highly distributed.

We start with the premise that an AI app is a modern app, with the same familiar challenges for delivery, security, and operation, and that AI models will radically increase the number of APIs in need of delivery and security. 

So, mission accomplished! We got this, right? We know how to securely deliver modern apps. We have well-established application security best practices and understand the intricacies for protecting APIs. We have solutions that provide comprehensive protection and consistent security across distributed environments.

Not so fast! Hang on to your GPTs as we briefly dive into the details.

While AI apps share the same risks and challenges as those for modern apps (both of which are essentially API-based systems), AI apps have specific implications—training, fine-tuning, inference, retrieval augmented generation (RAG), and insertion points into AI factories.

So yes, AI apps, like modern apps, have a highly distributed nature, create tool sprawl, and complicate efforts to maintain consistent visibility, uniform security policy enforcement, and universal remediation of threats across hybrid and multicloud architectures. In addition to grappling with this “ball of fire” of risk and complexity, defenders must contend with the random nature of human requests and the highly variable nature of AI-procured content that can lead to unpredictable AI responses, as well as considerations for data normalization, tokenization, embedding, and populating vector databases.

Bringing together data to AI factories creates a holistic and connected enterprise ecosystem, and the integration and interfaces between of all these moving parts requires a robust API security posture.

Protecting the APIs that are gateways into AI application functionalities and data exchanges from security risks is crucial. While the same vulnerability exploits, business logic attacks, abuse from bots, and denial-of-service (DoS) risks apply, there are additional considerations for new and modified insertion points within AI factories and risks to LLMs through natural language processing (NLP) interfaces, plugins, data connectors, and downstream services—during training, fine-tuning, inference, and RAG. Plus, known attacks like DoS have additional considerations; mitigations for volumetric DDoS and L7 application DoS do not completely offset the risks of model DoS. AI apps also have an explainability paradox, underscoring the importance of traceability to help offset hallucinations, bias, and disinformation.

And attackers are not sitting idle. Generative AI democratizes attacks and increases the sophistication of cybercriminal and nation state campaigns. LLM agents can now autonomously hack web apps and APIs—for example, performing tasks as complex as blind database schema extraction and SQL injections without needing to know the vulnerability beforehand.

While novel AI risks are generating a ton of buzz, the importance of API security for AI factories cannot be overstated. It is urgent. The increased API surface for AI apps is staggering. Every CISO needs to incorporate API security as part of AI governance programs, as a core mantra to any CISO survival guide should be “you can’t protect what you cannot see.” If you do not have an inventory of the interfaces behind your AI apps, you have an incomplete threat model and gaps in your security posture.

AI applications are dynamic, variable, and unpredictable. Safe adoption of AI apps requires greater emphasis on efficacy, robust policy creation, and automated operations. Inspection technologies will play a critical and evolving role in security.

For API Security within AI apps and ecosystems, in particular, organizations will need to offset the increased likelihood of unsafe usage of third-party APIs by architecting security for outbound API calls and related use cases, in addition to the inbound security controls that are largely in place. Bot management solutions cannot rely on “human” or “machine” identification alone, given the rise of inter-service and East-West traffic, for example, from RAG workflows. And since the supply chain of LLM applications can be vulnerable, and impact the integrity of training data, models, and deployment platforms (which are often sourced from third parties and can be manipulated through tampering or poisoning attacks), security controls need to be implemented everywhere—in the data center, across clouds, at the edge, and from code, through testing, into production.  

AI Gateway technology will play a key role in helping security and risk teams mitigate risks to LLMs such as prompt injection and sensitive information disclosure, but the first step in the AI security journey begins with securing APIs that connect AI apps and AI ecosystems by making security intrinsic throughout the AI app lifecycle.