About
About this site
A sourced account of how prompts are used to attack AI tools, written for UK organisations by the consultants at CyPro Consulting Ltd.
Last reviewed against NCSC (UK), OWASP Gen AI Security Project and UK Government (DSIT). Sources
Publisher
Who runs it
The publisher is CyPro Consulting Ltd, which advises UK organisations on cyber security. Its consultants write for IT, security and business leaders who have AI tools in their organisation and need to judge how those tools could be misled.
Purpose
Why it exists
Talk about prompt injection tends to be loud and vague. This site collects what the NCSC, OWASP, the UK government and individual researchers have actually said, then turns it into decisions a UK organisation can make. Where the evidence runs out, the copy stops.
Accuracy
How facts are checked
Each claim points to a source, and the sources page lists every one with its publisher and date. When sources conflict or are silent, the page says so. The pages are revisited whenever a primary source changes, such as fresh NCSC advice, and the "last reviewed" date on the home page records the latest pass.
Contact
Getting in touch
Found a mistake, or know of a source we have missed? Send the team a note via the contact form, and keep confidential material out of it.
Keep reading
Read next
Am I exposed?
A checklist for UK organisations: which AI tools read outside content, hold private data or can act, and so could be manipulated by prompt injection.
Read the guide
Reduce the risk
The NCSC's four areas of advice for prompt injection, with practical limits on privileges, approvals and logging for UK organisations.
Read the guide
What it is
Prompt injection explained: how crafted input changes an AI model's behaviour, why it differs from SQL injection and what the NCSC advises.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Prompt injection cannot be patched away, so the useful question is how far a manipulated tool could reach. Testing your AI-connected systems the way an attacker would shows where the limits on data and actions need tightening.