Secure AI
Security, privacy and governance training for teams that handle sensitive data
Contents
A training programme for teams that handle sensitive data and must use AI safely.
Your team has an AI assistant that reads documents, an agent with access to email, a search tool over the shared drive. It works well in the demo. Then someone pastes a client contract into a public chatbot, an agent follows an instruction hidden in a web page, a model's answer includes a name it should never have seen, and the auditor asks who approved all of it. You write a rule for that case. The next case breaks a different rule. Policies pile up and nobody remembers them.
This programme replaces that loop with one set of rules, agreed once.
What it covers
- Sets one rule per kind of data, not per tool. The same rule appears in the policy, in the training and in the access settings, so what people are told and what the system allows never disagree.
- Keeps the useful work going. Nothing stops for the team that follows the rules. Low-risk uses are cleared quickly; only what touches sensitive data gets extra review, approval or logging.
- Falls back to a process that already exists (your current approval and incident routes), never to a third parallel one.
- Separates the people lever (training, habits, who approves) from the system lever (access, logging, limits), so a careful team on a weak setup and a careless team on a strong one each get the right fix.
- Starts from your data. Instead of a generic checklist, the programme sorts what your team actually handles (client records, contracts, source code, personal data) into classes, and gives each class its own rules on where it may go and who may see it.
- Tests with exercises. Participants attack their own setup in a safe environment: planting a hidden instruction, asking for data they should not get, tracing who approved an action. A rule is only kept if the team can show it working.
The method
| Tier | Audience | Content |
|---|---|---|
| Full | Teams with regulated data, with group size and data tier agreed up front | everything: data classes, threat models, policies, incident drills, audit trail |
| Core | Teams with under a day to give | the policy modules run in full; the hands-on drills become take-home exercises instead |
| Base | Teams new to the subject | the written playbook: a clear checklist, example policies, one worked case per topic |
| Briefing | Larger groups who need awareness only | a short briefing, no drills |
| Deep | Regulated data, client contracts, audits and risk owners | every module, with live drills and a tabletop exercise |
The tier is chosen from the most sensitive data your team touches, then rounded to a format your calendar can carry. One decision, in one place.
Enrol
Executives
Two separate sessions. Then a follow-up, or simply describe the concern and we will place it.
Other formats
Any team that handles regulated data (health, finance, legal...) can book a call with us. We can also run the programme in-house.
Agenda
Once enrolled, bring a real situation. Each of these becomes a case in the session. We assess the risk first, name the policies and people involved, then agree actions and test them.
You can also take the programme one module at a time.
How a day goes
- Map. The team lists every AI tool in use, what each can read and do, who owns it and where its data goes, including tools nobody approved. Nothing is proposed before this map exists, and it is rechecked at the end.
- Agree. We name the teams and systems the plan will touch, one at a time, and wait for sign-off. We never redesign how a team works to fix a single leak.
- Apply in order. Data classes and owners first (no visible change), then access limits, then approvals, then logging and monitoring, then incident drills, then the audit trail.
- Review in bounded rounds. One full round across teams, fix everything it shows, one confirmation round, stop.
Tools
Examples use common situations: a shared chat assistant, an agent with email access, a document search tool. Every module starts from a principle first; the product names are replaceable. The exercises need only a browser.
Basis
Written for teams where one careless prompt or one over-permissive agent becomes a real incident. The case library keeps the failures behind each rule.
Get involved
Feedback is welcome, especially: scenarios from other sectors, questions your auditors ask, and results from your own teams that contradict what the programme teaches. Write to contact@arclight.im.
Contact
© Arclight