ISO/IEC 27090: How Xtant.tech Helps Businesses Secure Their AI Systems

Consider your company has an AI assistant that reads incoming emails and summarises the attachments for your team, but one day a document arrives with a line of text buried in it, written for the assistant rather than for any employee. The assistant reads it, treats it as an instruction and starts behaving differently. Maybe it leaks something it shouldn’t or it just gives a wrong answer that nobody questions.

Your firewall saw nothing odd. Even with access policies holding strong, the weak spot reveals to be the AI itself as many security programmes were never built to look there.

That’s the problem ISO/IEC 27090 takes on. ISO published it in October 2026 as guidance on security threats that are specific to AI systems [1].

What the standard covers

It looks at an AI system across its whole life, including the data it learns from, the model, and the environment it runs in. ISO’s overview names threats such as poisoned training data, a model being copied through repeated queries, inputs crafted to fool it, attempts to work out whether a particular record was in the training set, and prompt injection [2].

None of this is far-fetched. Researchers found that 250 poisoned documents were enough to plant a backdoor in models from 600 million to 13 billion parameters, although it was a simple, low-stakes one [3]. OWASP ranks prompt injection first among LLM application risks [4], and NIST has catalogued the wider families of attack in detail [5].

It’s guidance, so there’s nothing to certify against, and it doesn’t replace what you already do. What it gives you is a sense of where AI-specific safeguards need to sit beside your existing controls.

Where ordinary security stops

Locking down the servers that host an AI tool is still necessary. The problem arises when it doesn’t tell you what the model learned from, what it can reach, or how it reacts to an input nobody planned for. To manage this issue, a company first needs to know which AI systems it runs, what data they can see, which other applications they talk to and what happens if one misbehaves.

ISO/IEC 27090 describes the threats by turning them into assessments, with controls and named owners being a separate job where plenty of teams get stuck.

Where Xtant.tech comes in

We work on that second part, in three stages.

Diagnose: You can’t manage a risk you haven’t spotted, and many companies don’t have a full list of the AI they use. Our assessment produces an AI Systems Registry, a Risk Exposure Report and a gap analysis against ISO/IEC 42001 [6]. Together they show which systems deserve a closer look first.

Design: Finding weak spots is half the work. The rest is policies, clear responsibilities and a sensible way to treat each risk. Our ISO/IEC 42001 and ISO/IEC 27001 consulting helps companies build AI management and information security practices that fit how they actually operate [6]. We can also prepare teams for an external audit, though we’re an independent consulting firm, not an accredited certification body.

Deploy: Our infrastructure security consulting covers security assessments, hardening and architecture reviews [6], which helps with the environments AI applications run in. Model-level problems like poisoned data or prompt injection could require dedicated testing and technical safeguards on top of that, so the controls we recommend depend on what the assessment says.

Keeping up

AI threats move faster than an annual review. Our AI Risk Observatory collects information on AI incidents, security advisories and regulatory developments, with filters for topics such as security, governance and ISO 42001 [7]. Used alongside regular risk assessments, it gives teams an up to date framework to check their safeguards against.

How the three standards fit

One way to picture it is ISO/IEC 27001 helping you manage information security, and ISO/IEC 42001 is how you manage AI responsibly across the organisation [8][9]. ISO/IEC 27090 supplies the AI-specific threats that sit between them. ISO’s own overview says it builds on 27001 and 27002 practice, and that security is one part of responsible AI management rather than the whole of it [2].

Where to start

Adopting AI safely takes more than hoping your existing safeguards will stretch far enough. You need to see your exposure, decide what to fix first, and turn that into controls somebody owns.

If you’d like to know where your organisation stands, book a free 30-minute scoping call at Xtant.tech and we’ll talk it through honestly.

Sources
[1] ISO, ISO/IEC 27090:2026, Cybersecurity, Artificial intelligence, Addressing security threats and compromises to AI systems: https://www.iso.org/standard/27090
[2] ISO, “ISO/IEC 27090 explained”: https://www.iso.org/insights/ISO-27090-explained
[3] Anthropic, UK AI Security Institute and Alan Turing Institute, “A small number of samples can poison LLMs of any size”: https://www.anthropic.com/research/small-samples-poison
[4] OWASP, LLM01 Prompt Injection: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
[5] NIST, AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations: https://csrc.nist.gov/pubs/ai/100/2/e2025/final
[6] Xtant.tech, AI Governance and Risk Consulting, services and delivery approach: https://xtant.tech/
[7] Xtant.tech, AI Risk Observatory: https://xtant.tech/observatory
[8] ISO/IEC 27001: https://www.iso.org/standard/27001
[9] ISO/IEC 42001:2023: https://www.iso.org/standard/42001