Why a generic IT playbook is not enough
When something goes wrong with a conventional application, the incident response playbook is well worn: isolate the host, rotate the credential, roll back to the last known-good build. Restore the system, and you have largely restored trust in it.
AI systems break that assumption quietly and completely. The same input can produce different outputs from one run to the next. The “vulnerable component” in a failing system might not be code at all—it could be a model weight, a prompt template, a retrieval index, or the scope of tools an agent is allowed to call. None of that maps cleanly onto “reboot the server.”
An organization that treats an AI incident like a standard IT incident may discover this mid-response: the rollback target was never defined, and the evidence needed to explain what happened was overwritten by the fix.
That gap—between what a generic incident-response plan assumes and what an AI system needs during a live incident—is the subject of the AI Security Incident Response Playbook.
What is different about an AI incident?
- Rollback has to move as a bundle. Reverting the model while the prompt template or retrieval index has drifted independently can reproduce the same failure. Model, prompt policy, retrieval state and configuration need coordinated, version-pinned recovery.
- Indirect prompt injection is not contained at the chat interface. When the attack path runs through retrieved documents or external content, suspending the user-facing application alone may leave the ingestion pipeline active.
- An agent’s credentials are a separate containment surface. Isolating the process without revoking applicable OAuth grants or API keys can leave access available.
- Evidence must be preserved before remediation starts. The remediation itself may destroy the forensic trail needed to establish scope and root cause.
A connected operating loop
The cheat sheet applies the ODA3 framework suite as connected operating components:
- Global AI Safety and Security Framework (GAISSF™) establishes governance, control and evidence expectations against which findings can be assessed.
- Unified AI Incident Framework (UAIF™) structures incident identification, classification, severity and evidence.
- AI Incident Response Framework (AI-IRF™) structures preparation, detection, containment, eradication, recovery and lessons learned.
The loop closes when confirmed findings inform control remediation and governance decisions—not merely when service is restored.
Inside the practitioner guide
The complete publication includes a phased incident-response runbook, triage decision tree, containment-selection guidance for indirect injection, retrieval poisoning, agent hijacking and supplier compromise, adaptable detection logic, and an audit-readiness checklist for demonstrating that the capability has been exercised.