AI Gateway protects enterprise generative AI applications from prompt injection attacks

Overview

If organizations don’t use Prompt Shield protection, threat actors can exploit prompt injection vulnerabilities to compromise AI-powered workflows. Malicious users can craft adversarial inputs that manipulate large language models into ignoring system instructions, disclosing confidential data, or executing unintended actions like generating phishing content.

Without network-level prompt filtering:

• Direct prompt injection attacks can bypass application-layer safety mechanisms through sophisticated jailbreak techniques.
• Indirect prompt injection occurs when threat actors embed malicious instructions in external content that the AI processes.
• Each AI application must independently implement protection, creating inconsistent security postures and inadequate safeguards against new or custom AI deployments.

Remediation

• Enable the Internet Access traffic forwarding profile to route internet traffic through Global Secure Access.
• Configure TLS inspection settings and deploy the CA certificate to allow inspection of encrypted AI application traffic.
• Follow the steps in Protect enterprise generative AI applications with Prompt Shield to:
  • Create prompt policies to scan and block malicious prompts targeting generative AI applications.
  • Link prompt policies to security profiles to organize them for Conditional Access targeting.
  • Create Conditional Access policies to apply security profiles with prompt policies to users accessing internet resources.
• Install the Global Secure Access client on user devices to enable traffic acquisition.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Network, AI
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	AI and agents
Licence	Entra_Premium_Internet_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.