Mastering IDOR: Finding Broken Access Control Behind Predictable IDs and UUIDs

A crosswalk is not evidence. What artifact actually satisfies each NIST AI RMF function, which subcategories a penetration test answers, and why aligned, certified and tested are three different states.

Policy says inventory your AI, but few define the artifact. What the G7 minimum elements actually require, which fields you can re-derive and which are only prose, and five ways to validate an AI-BOM instead of filing it.

“Test the customer-facing AI assistant” is one sentence, and the whole engagement will be argued from it. The seven surfaces an AI penetration test scope must name, what belongs in the rules of engagement, and what a finding must carry.

There is no AI-specific SOC 2 and no AI trust services category. What there is, is an existing criterion your AI system quietly stopped satisfying. Where AI systems land in the common criteria, why the carve-out matters, and what evidence over a period means when prompts change weekly.

Article 15 sets an outcome and names no test, but Annex IV asks for dated, signed test reports covering pre-determined changes. What that report has to contain, who owes it, and why the December 2027 date is the window in which the evidence gets generated.

An MCP server is an API with an unusually trusting client and an unusually powerful backend. Testing it means exposure and transport, three authorization attempts against a stated MUST NOT, the advertised tool surface, and what the server sends back — almost all of it without a model in the loop.

Forty prompt-injection payloads, none successful, risk low — and six weeks later the agent refunds the same customer twice. The unit of an agent test is the action, not the answer. Four phases, five channels, and why findings carry a rate instead of a checkmark.

Most AI risk registers collapse “untested” and “tested and failing” into the same amber, which inverts the priority a defender should have. Why a proven failure is a bounded, demonstrated path, why an unknown still deserves respect, and how a state field fixes the ranking.

Governance asks whether a control exists. Assurance proves it works. Why an AI security assessment built on questionnaires tells you almost nothing, and what evidence looks like.

Prompt Injection Testing explained: learn types, examples, attacks, and defenses for LLM security, including fuzzing, jailbreaks, and mitigation strategies.

Learn why cyber insurance and compliance must work together in 2026, covering financial, legal, and operational risks and how ioSentrix improves insurability.

Learn how to build a compliance-ready security program in 2026 using continuous risk management, cloud security, threat modeling, and SOC 2-aligned controls.