AI and cloud security glossary

Short, plain-English definitions of terms you will meet when adopting AI securely. Where a term comes from a standard or an official source, we link to it.

Not legal advice. Definitions here are for orientation. Where a legal definition matters, read the source text.

A

Agentic AI / AI agent. An AI system that can plan and take actions on its own, such as browsing, sending messages, running code or calling other tools, rather than only answering questions. The more it can do, the more a mistake or an attack can cost. See the NCSC's guidance on agentic AI.

AI Act (EU). Regulation (EU) 2024/1689, the European Union's law on AI. It takes a risk-based approach, with different duties for providers and deployers. Official text.

AI literacy. The skills and knowledge staff need to use AI sensibly and understand its risks. The EU AI Act includes AI literacy provisions, which began to apply on 2 February 2025.

AI management system (AIMS). The set of policies, processes and responsibilities an organisation uses to manage AI responsibly. ISO/IEC 42001 is the international standard for it.

Acceptable use policy (AUP). A short document setting out what staff may and may not do with a system, here AI tools. See our AI acceptable use policy template.

C

Controller / processor. Terms from data protection law. A controller decides why and how personal data is processed. A processor handles it on the controller's behalf. Which one an AI supplier is affects your contracts and duties. See the ICO.

Cyber Essentials. A UK government-backed scheme setting out basic technical controls. See the NCSC page.

Cloud shared responsibility. The split of security duties between a cloud provider and its customer. Providers secure the underlying platform. Customers are generally responsible for their own accounts, access, data and configuration.

D

Data classification. Sorting information by sensitivity (for example public, internal, confidential, restricted) so that rules can be set for each level, including what may be put into an AI tool.

Data leakage. Sensitive information ending up somewhere it should not, such as pasted into a public AI tool, or sent out by a tricked AI agent.

Data poisoning. Corrupting the data used to train or inform an AI system so that it behaves in a way the attacker wants. See OWASP LLM04.

Deepfake. Synthetic audio, image or video, made with AI, that falsely shows a person saying or doing something. Used in fraud and disinformation.

Deployer. In the EU AI Act, an organisation that uses an AI system under its own authority (as distinct from the provider that builds it).

E

ETSI EN 304 223. A European standard setting baseline cyber security requirements for AI models and systems, announced by ETSI on 14 January 2026. It builds on the UK AI Cyber Security Code of Practice. ETSI announcement.

Excessive agency. When an AI system is given more power, access or autonomy than it needs, so a mistake or attack causes more harm. OWASP LLM06.

F

Foundation model / general-purpose AI model. A large model trained on broad data that can be adapted to many tasks. The EU AI Act has specific rules for general-purpose AI models, which began to apply on 2 August 2025.

G

Generative AI. AI that creates new content, such as text, images, code or audio, from a prompt.

Guardrails. Controls placed around an AI system to limit what it will accept or do. Useful, but not a complete defence on their own. See the NCSC on prompt injection.

H

Hallucination. When an AI system produces confident output that is false or invented. A reason to verify AI output before relying on it.

Human in the loop / on the loop. Levels of human oversight of an AI system. In the loop: a person approves actions. On the loop: a person supervises and can intervene. The NCSC asks organisations to choose the level deliberately and to be able to stop an agent quickly.

I

Incident response. The planned way an organisation detects, contains, investigates, recovers from and learns from a security incident. See our AI incident response mini-playbook.

ISO/IEC 42001. The international standard for AI management systems, published in December 2023. ISO.

J

Jailbreak. An attempt to make an AI system ignore its safety rules, usually through the way a request is worded. Related to prompt injection, but aimed at the model's own restrictions rather than at hijacking an application.

L

LLM (large language model). The type of AI model behind most chat assistants. It predicts text and can be connected to tools.

Least privilege. Giving a person, system or AI agent only the access it needs for its task, and no more.

M

MCP (Model Context Protocol). An open protocol for connecting AI assistants to tools and data sources. Each connected server widens what a tricked assistant could reach, so connect only those you trust and review their permissions.

MITRE ATLAS. A knowledge base of tactics, techniques and case studies for attacks on AI-enabled systems. ATLAS.

Multi-factor authentication (MFA). Signing in with more than a password, such as an app prompt, a security key or a passkey. The NCSC calls the two-step version 2-step verification (2SV).

N

NCSC. The UK's National Cyber Security Centre, part of GCHQ. It publishes the guidance referenced throughout this toolkit. ncsc.gov.uk.

NIST AI RMF. The US National Institute of Standards and Technology's voluntary AI Risk Management Framework, released as version 1.0 on 26 January 2023. NIST.

O

OWASP Top 10 for LLM Applications. A widely used list of the top risks for applications built on LLMs, from prompt injection to unbounded consumption. OWASP.

P

Passkey. A phishing-resistant way to sign in using your device's unlock method instead of a password.

Phishing. Messages (email, text, calls, adverts) designed to trick you into giving up information or money. AI can make them more convincing. See the NCSC.

Prompt. The text or instructions you give an AI system.

Prompt injection. Instructions hidden in content that an AI reads (a web page, email, document or code file) which the AI follows as if you had given them. OWASP LLM01 and the NCSC.

Provider. In the EU AI Act, the organisation that develops an AI system or has it developed and places it on the market under its own name.

R

Red teaming. Deliberately attacking your own system to find weaknesses before real attackers do. For AI, it includes trying prompt injection and misuse.

RAG (retrieval-augmented generation). A design where an AI looks up your documents before answering. It needs access controls on the document store, or the AI may reveal documents the user should not see.

S

Sandbox. A restricted environment in which software, including an AI agent, can run with limited access to files, networks and credentials.

Shadow AI / shadow IT. AI tools or other technology used in an organisation without approval or oversight. See the NCSC on shadow IT.

Supply chain attack. An attack that compromises something you rely on, such as a software package, a container image or a supplier, in order to reach you. See the October 2026 LiteLLM compromise.

System prompt. The hidden instructions a developer gives an AI application. They should never contain secrets. OWASP LLM07.

T

Threat model. A structured way of asking what you are protecting, who might attack it, and how.

Training data. The data a model learns from. A key question for suppliers is whether your inputs are used for training.

U

UK AI Cyber Security Code of Practice. Baseline cyber security principles for AI systems published by the UK government's Department for Science, Innovation and Technology, with an implementation guide. GOV.UK.

V

Voice cloning. Using AI to copy a person's voice from a short sample. Used in scams that pretend to be a relative or colleague. See our personal protection guide.

Vulnerability management. Finding, prioritising and fixing weaknesses in software and configuration.

Z

Zero trust. A security approach that does not trust a user, device or network by default and checks each request. Often used for administrator access to cloud systems.