ms-ai-architect/skills/ms-ai-security/SKILL.md

name	description
ms-ai-security	Security assessment, cost estimation, OWASP LLM Top 10 mitigations, performance optimization for AI on Microsoft stack. Deterministic 6x5 security scoring, P10/P50/P90 cost confidence intervals, FinOps practices. Triggers on: "security assessment for AI", "AI threat modeling", "cost estimation for Azure AI", "FinOps for AI workloads", "OWASP LLM", "kostnadsestimat for AI-løsning".

INSTRUKSJON: Denne skillen dekker kvantitative vurderingsaktiviteter med deterministiske scoringsmodeller. Bruk rammeverket systematisk — ikke hopp over dimensjoner eller anta scorer. Alle vurderinger skal produsere konkrete, etterprøvbare resultater med tallverdier.

Sikkerhets- og kostnadsvurdering for Microsoft AI

Strukturerte metoder for tre vurderingsaktiviteter:

1. Sikkerhetsvurdering — Deterministisk 6x5 sikkerhetsscoring med OWASP LLM Top 10-mapping
2. Kostnadsestimering — TCO-beregning med P10/P50/P90 konfidensintervaller og FinOps-praksis
3. Ytelsesgjennomgang — Latency-optimalisering, skalering og benchmarking

Primære agenter: security-assessment-agent, cost-estimation-agent

---

1. Sikkerhetsrammeverk

6-dimensjons sikkerhetsmodell

To assess security, score each of the six dimensions independently on a 1-5 scale:

Dimensjon	Dekker
Identity & Access Control	Entra ID, Managed Identities, RBAC, API-nøkkelrotasjon, JIT-tilgang
Network Security	Private Endpoints, VNet, NSG, Azure Firewall, DNS, utgående trafikk
Data Protection	Kryptering (rest/transit), Key Vault, data residency, PII-maskering, backup
Content Safety & AI Security	Content Safety-filtre, prompt injection-forsvar, jailbreak, output-validering, STRIDE-AI
Compliance & Governance	AI Act-klassifisering, GDPR/Schrems II, Purview, Digdir/NSM, DPIA
Monitoring & Incident Response	Azure Monitor, token-bruk, anomalideteksjon, audit logging, alerting

Scoringmodell (1-5)

Score	Nivå	Kriterium
1	Kritisk	Ingen kontroller. Umiddelbar risiko.
2	Utilstrekkelig	Grunnleggende kontroller med vesentlige hull. Kun PoC/sandbox.
3	Akseptabel	Sentrale kontroller på plass. Minimum for lav-risiko produksjon.
4	God	Robuste, automatiserte kontroller med overvåking. Sensitiv data OK.
5	Utmerket	State-of-the-art. Zero Trust. Defense in depth. Høy-risiko AI Act OK.

Vektet scoring

Apply weights based on workload type, then calculate: Samlet score = Sum(dimensjon_score x vekt). De kanoniske vektene (Standard-profil) og de to arbeidsbelastnings-variantene (eksternt eksponert, persondata-intensiv) ligger i rubrikkfila — references/ai-security-engineering/security-scoring-rubrics-6x5.md — slik at scoringen holdes konsistent med security-assessment-agent. Ikke dupliser vekttallene her.

Risikoklassifisering

Etter at samlet score er beregnet, klassifiser løsningen i risikokategori med anbefalt handling. De kanoniske terskelverdiene (samlet score → risikokategori, inkludert «Uakseptabel»-kategorien) ligger i samme rubrikkfil som vektene — references/ai-security-engineering/security-scoring-rubrics-6x5.md — slik at klassifiseringen holdes konsistent med security-assessment-agent. Ikke dupliser terskeltallene her.

For fullstendige rubrikker med eksempler per dimensjon og score, see references/ai-security-engineering/security-scoring-rubrics-6x5.md and references/ai-security-engineering/ai-security-scoring-framework.md.

OWASP LLM Top 10 (2025)

Map each threat to the solution under assessment. Use the reference files for detailed mitigation patterns.

ID	Threat	Key Microsoft Mitigation	Reference
LLM01	Prompt Injection	Content Safety Prompt Shields, system message hardening, Groundedness Detection	prompt-injection-defense-patterns.md
LLM02	Sensitive Information Disclosure	PII-filter, Purview DLP, output-filtrering	data-leakage-prevention-ai.md, pii-detection-norwegian-context.md
LLM03	Supply Chain Vulnerabilities	AI Foundry curated models, signed models, DLP for connectors	supply-chain-security-ai-models.md
LLM04	Data and Model Poisoning	Azure ML data lineage, isolated fine-tuning, Purview validation	owasp-llm-top10-azure-mitigations.md
LLM05	Improper Output Handling	Grounding Detection API, Content Safety output-filtre, Structured Outputs	output-validation-grounding-verification.md
LLM06	Excessive Agency	Copilot Studio scoped tools, RBAC per project, human-in-the-loop, budget caps	owasp-llm-top10-azure-mitigations.md
LLM07	System Prompt Leakage	Metaprompt patterns, Prompt Shields, output monitoring	jailbreak-prevention-production.md
LLM08	Vector and Embedding Weaknesses	AI Search managed identities, index-level security filters, Private Endpoints	owasp-llm-top10-azure-mitigations.md
LLM09	Misinformation	RAG grounding, Groundedness Detection, citation patterns, confidence scoring	owasp-llm-top10-azure-mitigations.md
LLM10	Unbounded Consumption	Rate limits, token budgets, PTU for capacity, Cost Management alerts	—

All reference files are in references/ai-security-engineering/. LLM04/06/08/09 deler den konsoliderte filen references/ai-security-engineering/owasp-llm-top10-azure-mitigations.md; LLM10 dekkes av rate-limit-/kostnadsfiler.

Kjøretids-trusseldeteksjon for AI-endepunkter dekkes av references/ai-security-engineering/defender-threat-protection-ai-services.md (Defender for Cloud AI threat protection). Release-status, agent-dekning og regionstilgjengelighet — inkludert begrensningen for Azure Government — er dokumentert i ref-fila; verifiser mot den før du oppgir status.

Azure AI-spesifikke sikkerhetskontroller

For detailed per-service security controls tables, see references/ai-security-engineering/secure-model-deployment-hardening.md and references/ai-security-engineering/zero-trust-ai-services.md. Key services covered:

• Azure OpenAI Service — Content Filtering, Abuse Monitoring, VNet/Private Endpoints, Managed Identity, CMK
• Azure AI Search — Managed Identities, index-level security filters, encryption, Private Endpoints
• Copilot Studio — Entra ID auth, Power Platform DLP, generative AI guardrails, environment isolation
• Microsoft Foundry — Project isolation, granular RBAC, Private Endpoints, curated model catalog, tracing

---

2. Kostnadsestimering

P10/P50/P90 konfidensintervaller

Provide all estimates with three scenarios — P10 (lavt volum / minimumskostnad), P50 (forventet/median), P90 (høyt volum / worst-case budsjettering). De kanoniske usikkerhetsfaktorene beregnes per komponent (ikke som én flat multiplikator) og eies av references/cost-optimization/deterministic-cost-calculation-model.md §3 — bruk faktorene derfra, slik at estimatet er konsistent med cost-estimation-agent (som har modellen som OBLIGATORISK kilde). Verify current prices via microsoft_docs_search before calculating.

Always present both USD and NOK (add 3-5% currency buffer for NOK).

TCO-komponenter

Calculate for 1, 12, and 36 months. Present Budget/Recommended/Premium alternatives.

Komponent	Inkluderer	Eksempler
Lisenser	Software per bruker/org	M365 Copilot, Copilot Studio, Power Platform
Compute	AI-inferens, hosting	Azure OpenAI tokens, App Service, Functions
Storage	Datalagring	AI Search indekser, Blob Storage, Cosmos DB
Networking	Dataoverføring	Egress, Private Link, Application Gateway
Support	Microsoft Support	Unified/Premier Support
Drift	Internt personell	Utviklere, MLOps, sikkerhetsteam

See references/cost-optimization/deterministic-cost-calculation-model.md and references/cost-optimization/budget-forecasting-ai-projects.md for full calculation methodology.

FinOps for AI

Apply these optimization strategies and refer to detailed guidance in references:

• Token-optimalisering: Shorter prompts, context window management, model tiering (bruk en rimeligere modell for enkle oppgaver), prompt caching. See references/cost-optimization/token-counting-optimization.md and references/cost-optimization/model-selection-price-performance.md for gjeldende modellvalg.
• PTU vs Pay-As-You-Go: PTU for stable, høyt-volum-arbeidsbelastninger (over et break-even-punkt for utnyttelse), PAYG for variable. Konkret break-even-terskel er pris-avhengig og ligger i ref-fila. See references/cost-optimization/ptu-vs-paygo-economics.md.
• Caching: Semantic caching, prompt caching, RAG result caching. See references/cost-optimization/semantic-caching-patterns.md.
• Right-sizing: Start with lowest SKU, monitor 2-4 weeks, consider SLMs for specialized tasks. See references/cost-optimization/model-selection-price-performance.md.

---

3. Ytelse og skalerbarhet

Optimize latency, throughput, and scalability for AI workloads. Konkrete tall — latens-reduksjon, caching-rabatt og batch-prising — er volatile og ligger i ref-filene; oppgi dem aldri fra hukommelsen. Key strategies:

• Regional deployment in Norway East / West Europe to reduce latency. See references/performance-scalability/latency-optimization-azure-openai.md.
• Streaming responses to reduce perceived latency for interactive use. See references/performance-scalability/streaming-response-patterns.md.
• Prompt caching for repeated prompt prefixes to cut both cost and latency. See references/performance-scalability/prompt-caching-performance.md.
• Batch API for non-interactive workloads at reduced price. See references/cost-optimization/request-batching-aggregation.md.
• Auto-scaling patterns: Horizontal scaling (App Service/AKS), load balancing (APIM/Traffic Manager), queue-based buffering (Service Bus+Functions), PTU+PAYG hybrid
• Rate limit management: TPM/RPM quotas, exponential backoff with jitter, multi-deployment, APIM for centralized throttling
• Load testing: Establish baseline, simulate peak traffic, identify breaking points, long-running soak tests

For detailed implementation guidance, see specific files in references/performance-scalability/:

• references/performance-scalability/latency-optimization-azure-openai.md — Latency tuning
• references/performance-scalability/auto-scaling-ai-infrastructure.md — Scaling patterns
• references/performance-scalability/rate-limit-management.md — TPM/RPM quota management
• references/performance-scalability/load-testing-ai-services.md — Load testing methodology
• references/performance-scalability/gpu-compute-sizing.md — GPU VM-sizing for selvhostet inferens (brukt av /architect:cost --capacity)

---

4. Referansekatalog

Eide referanser

Katalog	Filer	Innhold
references/ai-security-engineering/	22	Forsvar, testing, scoring, hendelseshåndtering, Zero Trust, STRIDE-AI, prompt injection, content safety, OWASP LLM-tiltak, Defender AI threat protection
references/cost-optimization/	22	Kostnadsmodellering, FinOps, token-optimalisering, PTU/PAYG, caching, right-sizing, SLM-økonomi
references/performance-scalability/	18	Latency, skalering, streaming, batch API, rate limits, benchmarking, GPU-dimensjonering

Kryss-referanser

• Compliance/governance: skills/ms-ai-governance/references/responsible-ai/ (AI Act, bias, etikk) and references/norwegian-public-sector-governance/ (Digdir, NSM, Schrems II, DPIA)
• Arkitektur: skills/ms-ai-advisor/references/architecture/ (sikkerhetssoner, arkitekturmønstre, offentlig sektor-sjekkliste)

---

5. MCP-verktøy

Behov	Verktøy	Bruk
Sikkerhetsdokumentasjon	microsoft_docs_search	Verifiser kontroller, sjekk oppdateringer
Fullstendig veiledning	microsoft_docs_fetch	Security baselines, konfigurasjonsguider
Kodeeksempler	microsoft_code_sample_search	SDK for Content Safety, RBAC, Key Vault

Never trust the knowledge base blindly for prices and feature availability — verify via MCP tools.

---

6. Arbeidsprosess

Sikkerhetsvurdering

1. Map the solution's AI components and data flows
2. Score each of the 6 dimensions using rubrics from references
3. Calculate weighted risk score with appropriate weight profile
4. Map OWASP LLM Top 10 threats to the solution
5. Document findings with concrete remediation recommendations, prioritized by risk and cost

Kostnadsestimering

1. Identify all Azure services in the solution
2. Estimate consumption per service (tokens, storage, traffic)
3. Fetch current prices via MCP tools
4. Calculate P10/P50/P90 per component, sum to TCO for 1/12/36 months
5. Present Budget/Recommended/Premium alternatives with FinOps opportunities

Ytelsesgjennomgang

1. Define performance requirements (latency, throughput, availability)
2. Identify bottlenecks and recommend optimizations from reference catalog
3. Estimate performance impact and propose monitoring/benchmarking setup