Short answer: from four places. The free primary sources (OWASP, MITRE ATLAS, NIST, and the NCSC/CISA guidelines), one hour attacking a model yourself, your own proxy logs, and then a security-specific executive course if you need the governance and vendor-evaluation layer on top. Most CISOs start with the course and skip the other three. That order is backwards.
The reason is that executive AI content is easy to nod along to. “Prompt injection is the top LLM risk” sounds right in a slide deck and means very little until you have watched a model hand over a secret it was told to protect. The three exercises below take an afternoon and change how you read every vendor pitch afterward.
Exercise 1: Find out what AI your users already use
Before you learn anything about AI threats, find out where your data is already going. Pull 30 days of web proxy logs (Zscaler, Netskope, Palo Alto, Squid, whatever you run) and count traffic to the major model providers. A security analyst can do this in pandas in ten minutes:
import pandas as pd
AI_HOSTS = {
"api.openai.com", "chatgpt.com", "api.anthropic.com", "claude.ai",
"generativelanguage.googleapis.com", "gemini.google.com",
"api.mistral.ai", "api.deepseek.com", "huggingface.co",
}
df = pd.read_csv("proxy_30d.csv", usecols=["user", "dept", "dest_host", "bytes_out"])
ai = df[df["dest_host"].isin(AI_HOSTS)]
summary = (
ai.groupby(["dept", "dest_host"])
.agg(users=("user", "nunique"), mb_out=("bytes_out", lambda b: b.sum() / 1e6))
.sort_values("mb_out", ascending=False)
)
print(summary.head(15))Sort by bytes_out, not by request count. Request count tells you who asks questions. Upload volume tells you who pastes contracts, source code, and customer records into a chat window. That is LLM02:2025 Sensitive Information Disclosure in the OWASP list, and it is the AI risk you almost certainly already have.
The api.* hosts deserve a second look. Traffic there means someone wrote code against a model API, which usually means an API key sitting in a repository or a CI variable that nobody in security approved. That table is the start of your AI asset inventory, and it is a better first artifact than any policy.
Exercise 2: Break a model yourself
Spend one hour on a prompt injection lab. We built the AI Training Dojo for practitioners, but it works for executives because the feedback is immediate: a model, a hidden secret, and a system prompt telling it not to reveal the secret. It is free at ai.gtkcyber.com.
Start with “Leak the System Prompt” on Easy. Then try the same approach on Medium, where our labs add keyword filters, and on Hard, where several preprocessing defenses stack up. You will probably get Easy in a few minutes. You may get stuck on Hard, and the Dojo lets you reveal the system prompt for half the points so you can see what stopped you.
Three things land in that hour that do not land from reading:
- A system prompt is not a control. Instructions to the model are text, and attacker input is also text. OWASP lists System Prompt Leakage as LLM07 for this reason.
- Filters stop specific strings, not intent. Rephrasing, role-play, and encoding get past keyword lists. MITRE ATLAS catalogs this as AML.T0051 LLM Prompt Injection, with indirect injection through retrieved content as its own sub-technique.
- Results are probabilistic. The same prompt works on one attempt and fails on the next. When your red team reports a finding, ask for the success rate over many trials, not a single screenshot.
The title of my Black Hat 2025 talk, “Input Is All You Need,” is the short version: the model will treat whatever reaches its input as instructions, so the security question is what can reach its input and what it is allowed to do afterward.
Exercise 3: Read one standard end to end, not five summaries
Pick one primary source and read the whole thing instead of a vendor’s summary of all of them. For a CISO, the best single document is NIST AI 600-1, the Generative AI Profile of the NIST AI RMF. It lists 12 risks specific to generative AI and attaches suggested actions to each, organized under the RMF’s Govern, Map, Measure, and Manage functions. Read it with your current risk register open and mark which of the 12 have no owner.
If you want a second one, the Guidelines for Secure AI System Development published by the UK NCSC and CISA in November 2023 is short and organized around the lifecycle (design, development, deployment, operation). It maps cleanly onto the SDLC controls your AppSec team already runs. MITRE ATLAS is the reference you hand to your red team; you need to know it exists and what a technique ID looks like, not memorize it.
Where executive training fits
After those three exercises, a course is worth more because you can connect what the instructor says to your own proxy table and your own failed prompt. The things a good security-specific executive course adds that self-study does not:
- Vendor evaluation. How to question a capability claim, what evaluation data to ask for, and how to run a proof of concept that produces evidence.
- Governance mapped to your program. How NIST AI RMF, ISO/IEC 42001, and the EU AI Act fit together. Our AI governance training post covers that stack in detail.
- A peer group. Other security leaders working through the same approvals, budgets, and board questions.
Watch for one gap when comparing options. Many executive AI programs are built for general business leaders: productivity, adoption strategy, and ethics across industries. They are useful for that. They rarely cover the attack surface, and a CISO’s job is the attack surface.
When this advice does not apply
If your organization only consumes AI through SaaS features (Copilot in Office, an AI assistant inside your ticketing system) and builds nothing on model APIs, Exercise 2 matters less than contract review: data retention, training use, and tenant isolation terms. Skip the lab and spend the hour with procurement. And if Exercise 1 turns up nothing, check that your proxy actually decrypts and logs those hosts before you conclude nobody uses AI.
GTK Cyber teaches the executive layer in A Cyber Executive’s Guide for Artificial Intelligence, which ran at Black Hat USA 2026 and is available as a private session for a leadership team through an executive briefing. The Dojo is free whether or not you take it.