Controls
How to reduce the risk of prompt injection
No control stops every attack, so layer several. Those with the best evidence limit what a tricked tool can do rather than try to spot every hostile phrase.
Last reviewed against NCSC, OWASP GenAI Security Project and Microsoft Security Response Center. Sources
The controls
Seven from OWASP
Constrain behaviour
Give the model a defined role and limits in its system prompt, and tell it to ignore attempts to change its core instructions [2]. Treat that as a speed bump, not a lock.
Validate output with code
Define the expected output format and check it with deterministic code [2].
Filter, with care
Least privilege
Keep functions and API tokens in application code instead of giving them to the model [2].
Separate untrusted content
Adversarial testing
Run tests on a regular basis in which the model is handled like an untrusted user [2].
Detection
Useful, but second line
Microsoft uses Prompt Shields, a classifier that flags injection attempts at inference time [3]. It pairs this with measures that assume some attacks will succeed: data access controls, deterministic blocking of exfiltration techniques and user approval for sensitive actions [3]. Detection that is probabilistic should never be the only layer.
Operations
What to do after launch
The NCSC suggests keeping records of what the model was given and said, which tools ran and which APIs were hit, and points out that errors may show an attacker honing a technique [1]. Its secure AI guidelines place logging, monitoring and update management in the operation stage [7].
The plan for this quarter sets these in order. You can also read why filters on their own disappoint.
A buying test
Prefer suppliers who explain how they reduce injection risk, over those who say they stop it [1].
Keep reading
Read next
EchoLeak case
EchoLeak, CVE-2025-32711, was a zero-click prompt injection flaw in Microsoft 365 Copilot. What happened, what Microsoft did and what it teaches.
Read the guide
What is it?
What prompt injection means, in plain English: how text fed to an LLM can override its instructions, and why UK organisations should care.
Read the guide
Can it be fixed?
Can prompt injection be fixed? The NCSC and OpenAI both say probably not completely, so the aim is to cut likelihood and impact. What that means for you.
Read the guideHow CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
Prompt injection only shows up when someone tries it against your own tools. Penetration testing can probe the AI features you run or build, to see what a hostile instruction could reach.