Suppliers
When your AI supplier has a breach
A supplier's breach can still be yours to report. Establish quickly what of yours was affected, and do not wait for the supplier's final report.
Last reviewed against legislation.gov.uk, National Cyber Security Centre and OWASP GenAI Security Project. Sources
Whose duty
Controller and processor
The questions
Ask these first
The NCSC says leaders should be able to put the right security questions to their suppliers [3]. Start with these.
-
1
What data of ours was affected, and in which systems? -
2
Is the exposure closed, and how do you know? -
3
Were keys, tokens or credentials involved, and have they been replaced? -
4
Was our data kept or used beyond the service we bought? -
5
When will you send a written account?
What suppliers have said
Three examples
OpenAI
OpenAI said it sent the library's maintainers a patch and was getting in touch with affected users whose payment details were exposed [9].
Microsoft
Wiz said Microsoft invalidated the link two days after the report and later finished an internal investigation of possible impact [8].
None of these is a customer's own view of events, so ask for yours in writing.
Do not wait for the final report
Your target is measured from when you become aware [1]. Report in stages if you must; the law lets details follow without undue further delay [1].
Before it happens
Contract and checks
The NCSC's position is that the builders of AI products, not their users, should own the security results customers end up with [3]. Build that expectation into procurement: security contacts, notification timing, where data sits, and deletion. See the response plan.
Keep reading
Read next
Leaked keys
How to respond when API keys, secret keys or storage tokens linked to AI tools have leaked: what to revoke, what to check and how to prevent a repeat.
Read the guide
Exposed storage
How to respond to an open AI database, log store or storage account: closing access, finding what was reachable and checking for misuse.
Read the guide
Staff and AI tools
How to respond when staff have entered personal or confidential data into a public AI tool: scoping, supplier requests, reporting and what to change.
Read the guideHow CyPro can help
Need a hand working through this?
Finding out whether an incident reaches you is one job. Checking your own systems, tightening access and briefing the board are several more. CyPro's responders and consultants can take any of them on.
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Talk to a specialist
Worried this affects you?
When data has leaked through an AI tool, its logs or its storage, the early decisions shape what you must report and to whom. An incident response team helps you contain the exposure, establish what was involved and prepare your notifications.