Human Trust to AI Crown Jewels Toolkit

Five steps to protect your business

Know what you have.Systems, AI tools, sensitive data and what each supplier can access.

Protect priority accounts.Passkeys or MFA on email, finance and admin. Remove access nobody needs.

Approve your AI tools.Define the data each may receive. Ask vendors where it's stored and whether it's used for training.

Train each team on its real risks.Short, regular, behaviour-based training built around each department's day. Not a yearly checkbox.

Test recovery.Restore from backup and run a short incident scenario.

Give each step an owner and a review date.

Tools and leadership actions by topic

02People and social engineering

Defenders and IT

DMARC reporting (or EasyDMARC)
Microsoft Defender for Office 365
Google Workspace phishing and malware protection
Number matching for MFA prompts, to stop MFA fatigue

CxOs and management

CyberCat role-based training (finance, HR, executives, sales, IT)
Payment verification written into finance policy
Report incidents: ASD 24/7 hotline 1300 CYBER1 (1300 292 371)
Report cybercrime: ReportCyber

03Identity is the new perimeter

Defenders and IT

Microsoft Entra Conditional Access and ID Protection
FIDO2 security keys or passkeys
Bitwarden (or 1Password Business)
Windows LAPS for local admin passwords

CxOs and management

Joiner, mover and leaver process triggered by HR
Quarterly access review signed off by an executive
Privileged account register

04Attack surface and suppliers

Defenders and IT

Shodan Monitor (and Censys)
Microsoft Defender for Cloud Apps (shadow IT and AI discovery)
Intune or another mobile device management tool
GitHub secret scanning with push protection

CxOs and management

Supplier register with a risk rating
Contract clauses: breach notice, data location, right to audit
Suppliers and outsourcers must report incidents to you

05AI is accelerating attacks

Defenders and IT

Action1 (patching, first 200 endpoints free)
Microsoft Intune
CISA Known Exploited Vulnerabilities (patch priority)
Dependabot or Renovate
Socket (malicious package checks)

CxOs and management

Monthly patch compliance report: % of internet-facing systems within target
Review policy for AI-written code

06Your AI is a crown jewel

Defenders and IT

Microsoft Purview sensitivity labels
Microsoft Purview DSPM for AI
Secrets manager (Bitwarden Secrets Manager or Azure Key Vault)
Scoped permissions for AI agents

CxOs and management

Data classification policy
AI register (National AI Centre template)
ISO/IEC 42001 (AI management system)

07How AI systems get attacked

Defenders and IT

OWASP Top 10 for LLM Applications
MITRE ATLAS
promptfoo or garak (attack testing)
API keys, rate limits and logging on AI endpoints

CxOs and management

ISO/IEC 27090 (security threats to AI systems)
AI vendor questions: where is our data stored, and is it used for training?

08What goes in, what comes out

Defenders and IT

LiteLLM (open source gateway, Presidio PII masking)
Cloudflare AI Gateway
Microsoft Purview DLP
Browser or endpoint controls for public AI websites

CxOs and management

Guidance for AI Adoption (policy and register templates)
Approved AI tools list
A route for reporting AI incidents
A person verifies important AI output before it is used

09Protect, prepare and practise

Defenders and IT

Wazuh (free monitoring for unexpected change)
Microsoft Defender for Business
Cloudflare Zero Trust (or Tailscale)
AI gateway logs for prompts, outputs and unusual behaviour
Separate development, testing and production, including AI models

CxOs and management

Monthly cyber report with five metrics: MFA coverage, patch compliance, restore success, phishing reports, incidents
Incident response plan with a reporting tree
Ransomware payment reporting: turnover over $3M, report to ASD within 72 hours
Privacy Act and Notifiable Data Breaches scheme
ASD Exercise in a Box

Dell products and services that may assist

Grouped by NIST Cybersecurity Framework function.

Cybersecurity & Zero Trust Advisory IdentifyAssess vulnerabilities and build a roadmap to Zero Trust.

Vulnerability Management Services IdentifyRegular scanning, prioritised findings and monthly reporting.

Dell Data Protection Solutions ProtectBackup and recovery across on-premises and multicloud.

PowerProtect Data Domain ProtectBackup appliances built for cyber resilience and fast recovery.

PowerProtect Data Manager ProtectAutomated discovery and protection of your workloads.

Managed Detection and Response Detect24x7 security operations: monitoring, threat hunting and response.

CyberSense DetectAnalytics that check vault data for signs of ransomware corruption.

Incident Response and Recovery RespondForensics, threat removal and recovery after an attack.

PowerProtect Cyber Recovery RecoverCritical data held in an isolated cyber vault and restored after an attack.

Cyber Recovery Services RecoverConsulting to design and run a cyber recovery strategy.

AI governance standards

ISO/IEC 42001:2023AI management system. Sets up governance, risk assessment and accountability for how your organisation develops or uses AI. Certifiable, and structured like ISO/IEC 27001.

ISO/IEC 27090:2026Addressing security threats and compromises to AI systems, including attacks such as data poisoning and prompt injection. Published October 2026. Guidance, not certifiable.

ISO standards are paid documents. Start with the free Guidance for AI Adoption, then use these to formalise.

Free Australian guidance and support

ASD Small Business HubThe practical starting point for small business: handbook, AI guidance and Exercise in a Box.

ASD EssentialsASD's wider framework, replacing the Essential Eight over time. Written mainly for larger organisations.

IDCARESmall business cyber resilience service, linked from the ASD hub.

From Human Trust to AI Crown Jewels: tools and actions

Five steps to protect your business

Take a PAWS

Tools and leadership actions by topic

02People and social engineering

03Identity is the new perimeter

04Attack surface and suppliers

05AI is accelerating attacks

06Your AI is a crown jewel

07How AI systems get attacked

08What goes in, what comes out

09Protect, prepare and practise

Dell products and services that may assist

AI governance standards

Free Australian guidance and support