Google SAIF — The Secure AI Framework Every Security Team Needs

Mandiant’s M-Trends 2026 report — released this week — specifically recommends Google’s Secure AI Framework (SAIF) as the foundational approach for organisations trying to secure their AI deployments. SAIF is Google’s answer to the question every security team is asking: how do we build and deploy AI systems that don’t create the exact vulnerabilities we’re trying to defend against? My breakdown of the six SAIF principles, how they map to the real attack patterns documented in 2026, and how to apply them to your AI deployment starting today.

What You’ll Learn

What Google SAIF is and why M-Trends 2026 recommends it

The 6 SAIF core principles — explained in plain language with practical application

How each SAIF principle maps to specific 2026 AI attack patterns

A prioritised SAIF implementation checklist for security teams

How SAIF relates to OWASP LLM Top 10 and NIST AI RMF

⏱️ 12 min read

SAIF provides the governance layer for the technical controls I cover across the AI security series. The vulnerability-specific detail for each SAIF principle is in the OWASP AI Top 10. The attack patterns SAIF defends against are documented in the Agentic AI Security and AI Vulnerabilities guides.

What SAIF Is and Why It Matters Now

Google published the Secure AI Framework in 2023, and my honest assessment at the time was: this is the right framework but it will take a major incident to drive widespread adoption. My assessment in 2026: it has become significantly more relevant because the threat landscape it was designed to address has materialised. SAIF was forward-looking when published. The attacks it describes — supply chain compromise, training data poisoning, prompt injection at enterprise scale, model theft — are all documented in production environments as of M-Trends 2026. SAIF is no longer preparatory. It’s a response framework for threats that are already active.

SAIF — CONTEXT AND PURPOSE

# What SAIF is

A framework for building, deploying, and operating AI systems securely

Published by Google in June 2023, updated with 2024/2025 threat data

Six core principles covering the full AI lifecycle from development to operations

# Why M-Trends 2026 recommends it

M-Trends 2026: “organisations should adopt principles from the Google Secure AI Framework (SAIF)”

Context: Mandiant red teams now use AI-driven techniques including prompt injection in engagements

SAIF provides the behavioural baseline needed to detect the AI abuse Mandiant is documenting

# What SAIF is not

Not a compliance checklist — it’s a principles framework requiring interpretation

Not AI-vendor specific — applies to any organisation building or deploying AI

Not a replacement for OWASP LLM or NIST AI RMF — it complements both

The 6 Core SAIF Principles

My plain-language explanation of each principle, the specific security control it addresses, how I apply it in assessments, and the 2026 attack it directly defends against. The attack-to-principle mapping is the piece that makes SAIF actionable rather than abstract.

SAIF — 6 PRINCIPLES EXPLAINED

# Principle 1: Expand strong security foundations to the AI ecosystem

What it means: apply the same security practices to AI systems that you apply to other software

In practice: patch AI models, monitor AI infrastructure, apply RBAC to AI systems

2026 attack this addresses: AI infrastructure being used as attack pivot (PROMPTFLUX pattern)

# Principle 2: Extend detection and response to bring AI into existing threat monitoring

What it means: include AI systems in your SIEM, logging, and alerting infrastructure

In practice: log all AI model inputs/outputs, alert on anomalous prompt patterns

2026 attack this addresses: AI agent abuse in compromised environments

# Principle 3: Automate AI defences to keep pace with AI-enhanced threats

What it means: use AI defensively — the only speed match for AI attacks is automated AI defence

In practice: AI-assisted alert triage, automated model behaviour monitoring

2026 attack this addresses: CyberStrikeAI — 22-second lateral movement → human response too slow

# Principle 4: Harmonise platform-level controls

What it means: consistent security controls across all AI platforms and models in the organisation

In practice: centralised AI governance, approved platform list, standardised access controls

2026 attack this addresses: shadow AI deployments creating unmonitored attack surface

# Principle 5: Adapt controls to adjust mitigations and create faster feedback loops

What it means: AI threats evolve fast — security controls must adapt as quickly as threats

In practice: quarterly AI security review, monthly threat intelligence integration

2026 attack this addresses: new attack patterns (PROMPTFLUX) require rapid detection updates

# Principle 6: Contextualise AI risks in surrounding business processes

What it means: AI risk assessment must consider the business context, not just the technical layer

In practice: AI impact assessment — what does an AI system compromise mean for the business?

2026 attack this addresses: AI agent excessive agency (OWASP LLM08) causing business harm

EXERCISE — THINK LIKE A SECURITY ARCHITECT (15 MIN)

Apply SAIF to Your AI Deployment

Pick one AI system your organisation currently uses or is evaluating.
Score it against each SAIF principle (0 = not implemented, 1 = partial, 2 = fully implemented):

Principle 1 — Security foundations extended:
Is the AI system in your asset inventory?
Is it patched/updated on a defined schedule?
Does it have RBAC applied? Score: 0/1/2

Principle 2 — Detection and response:
Are AI system inputs/outputs logged?
Are anomalous prompts or behaviours alerted on?
Is the AI included in your SIEM? Score: 0/1/2

Principle 3 — Automated defences:
Can anomalous AI behaviour trigger automated response?
Is there AI-assisted monitoring of AI systems? Score: 0/1/2

Principle 4 — Platform-level controls:
Is this AI system on an approved platform list?
Are access controls consistent with other critical systems? Score: 0/1/2

Principle 5 — Adaptive controls:
When was the last security review of this AI system?
Is threat intelligence feeding into your AI security controls? Score: 0/1/2

Principle 6 — Business context:
Do you have an impact assessment for this AI system being compromised?
Are the business consequences of AI failure documented? Score: 0/1/2

Total: /12. Anything below 8 has significant gaps.
Write the 2 highest-priority improvements.

✅ Principle 2 (detection and response) is the most commonly scored 0 in my assessments. Organisations deploy AI systems without adding them to their SIEM or logging infrastructure — they monitor their web servers, their databases, and their endpoints, but their AI API calls are completely invisible to the security team. The fix is simple: route AI system API call logs to your SIEM and write one alert rule for anomalous prompt patterns. That alone moves Principle 2 from 0 to 1 in under an hour.

How SAIF Maps to 2026 Attacks

SAIF PRINCIPLE → 2026 ATTACK → SPECIFIC CONTROL

# PROMPTFLUX (AI malware using LLMs mid-execution)

SAIF Principle 2: extend detection → add LLM API egress monitoring

Control: alert on non-user-initiated LLM API calls from endpoints

# CyberStrikeAI (autonomous AI attack — 600+ firewalls)

SAIF Principle 3: automate defences → AI response speed matches AI attack speed

Control: automated blocking triggered by anomalous connection patterns

# ClawHavoc (MCP supply chain attack)

SAIF Principle 1: extend security foundations → vetting process for AI supply chain

Control: approved MCP server list, mandatory security review before deployment

# Vibe coding vulnerabilities

SAIF Principle 4: harmonise platform controls → CI/CD security gate for AI-generated code

Control: automated SAST + secret scanning on every PR from AI coding tools

SAIF Implementation Checklist

SAIF IMPLEMENTATION — PRIORITISED CHECKLIST

# Immediate (this week)

✅ Inventory: list every AI system deployed in your organisation

✅ Logging: ensure AI system API calls are being logged somewhere

✅ Policy: create an AI acceptable use policy if you don’t have one

# Short term (this month)

✅ Detection: add LLM API endpoints to egress monitoring

✅ Supply chain: establish approved AI tool and MCP server list

✅ Code security: implement CI/CD security gate for AI-generated code

# Medium term (this quarter)

✅ SIEM integration: AI systems included in security monitoring

✅ Impact assessment: document business impact of each AI system compromise

✅ Red team: include AI systems in your next penetration test scope

# SAIF scoring benchmark

0–4/12: Critical gaps — AI systems are unmonitored, unpatched, and uncontrolled

5–7/12: Significant gaps — basics in place but detection and response immature

8–10/12: Moderate posture — key controls present, adaptive capability building

11–12/12: Strong posture — full SAIF implementation, continuous improvement cycle

Most organisations I score: 3–5/12. The immediate gap is almost always Principle 2.

SAIF, OWASP, and NIST — How They Relate

My explanation of how the three major AI security frameworks relate — because I see confusion about overlap between them in every organisation I work with. They’re complementary, not competing.

THREE FRAMEWORKS — HOW THEY FIT TOGETHER

# Google SAIF — the operational governance layer

Level: organisation-wide principles for AI security programme

Use: strategic — what programme elements do we need?

Scope: full AI lifecycle from development to operations

# OWASP LLM Top 10 — the technical vulnerability layer

Level: specific technical vulnerabilities in LLM-based applications

Use: tactical — what specific vulnerabilities do we test for and defend against?

Scope: LLM application security assessment and development

# NIST AI RMF — the risk management layer

Level: risk management framework for AI system governance

Use: compliance and risk — how do we govern and document AI risk?

Scope: enterprise risk management, regulatory compliance, documentation

# My recommended stack

SAIF → what programme do we build?

OWASP LLM → what do we assess and how?

NIST AI RMF → how do we document and govern it?

SAIF Quick Wins — What You Can Do This Week

My distillation of SAIF into the specific actions that take under an hour and immediately improve your AI security posture. Every item below maps to a SAIF principle and addresses a gap I consistently find in organisations at the beginning of their AI security programme.

SAIF QUICK WINS — UNDER ONE HOUR EACH

# Principle 1 quick win: Add AI systems to your asset inventory

Action: open a spreadsheet — list every AI tool, API, and agent your org uses

Include: tool name, owner, data it accesses, permissions it has

Time: 30–60 minutes · Impact: baseline for every other SAIF activity

# Principle 2 quick win: Add LLM API endpoints to egress monitoring

Action: add api.openai.com, api.anthropic.com, generativelanguage.googleapis.com to SIEM watchlist

Alert: non-approved processes contacting these endpoints

Time: 20 minutes · Impact: PROMPTFLUX detection signal activated

# Principle 4 quick win: Create an approved AI tool list

Action: from your inventory, identify which tools are approved for business use

Document: data classification restrictions for each (what can be entered)

Time: 30 minutes · Impact: governance baseline, shadow AI addressed

Google SAIF — Key Points

M-Trends 2026 recommends SAIF as foundational approach for enterprise AI security

6 principles: extend security foundations, detection/response, automate defences, harmonise controls, adapt fast, contextualise business risk

Most commonly missing: Principle 2 (AI systems not in SIEM/logging) — fix in under an hour

Maps directly to 2026 attacks: PROMPTFLUX → P2, CyberStrikeAI → P3, ClawHavoc → P1

Framework stack: SAIF (programme) + OWASP LLM (assessment) + NIST AI RMF (governance)

SAIF — Start With the Inventory

The first step — list every AI system in your organisation, including the ones individual teams deployed without IT approval — takes 30 minutes and unlocks every other SAIF activity. Most security teams are surprised by how many AI tools are deployed that they didn’t know about. Once you have the inventory, apply the scoring exercise above and prioritise the gaps. In my SAIF implementation engagements, the inventory step consistently surfaces 2–3 AI systems the security team didn’t know existed. That’s the shadow AI problem Principle 4 addresses. For the technical vulnerability assessment layer, the OWASP AI Top 10 is the next framework to apply.

Quick Check

An organisation has deployed 12 AI systems across sales, HR, and engineering. All 12 are operational but none are included in the SIEM, none have anomaly alerts configured, and none are in the incident response playbooks. Which SAIF principle are they failing on, and what is the most immediate risk this creates?

Frequently Asked Questions

What is Google SAIF?

Google’s Secure AI Framework (SAIF) is a conceptual framework published by Google in 2023 for building and deploying AI systems securely. It comprises six core principles covering the full AI lifecycle: extending existing security foundations to AI, including AI in detection and response, automating AI defences, harmonising security controls across AI platforms, adapting controls as threats evolve, and contextualising AI risk within business processes. It was recommended in Mandiant’s M-Trends 2026 as the foundational approach for enterprise AI security.

How does SAIF relate to OWASP LLM Top 10?

SAIF is a governance and programme framework — it tells organisations what security programme elements they need. OWASP LLM Top 10 is a technical vulnerability framework — it tells security teams what specific vulnerabilities to test for and defend against in LLM applications. SAIF operates at the strategic level across all AI systems; OWASP LLM operates at the tactical level for LLM-based application security. Both should be implemented: SAIF for the programme, OWASP LLM for the assessment methodology.

Where do I start implementing SAIF?

Start with the inventory (Principle 1) — list every AI system deployed in your organisation. Most organisations find more than expected. Then address Principle 2 (detection) — add AI systems to your SIEM and configure anomaly alerts. These two steps take a day and address the most common critical gaps. The immediate checklist in this guide covers the full prioritised implementation sequence from this week through this quarter.

← Related

OWASP AI Security Top 10

→ Apply It

AI Red Teaming Guide 2026