The scale of the problem in Spain is concrete: according to Accenture's "State of Cybersecurity Resilience 2025" report, 95 % of Spanish organisations are not adequately prepared to protect their AI-enabled systems, and 84 % lack the essential data security practices needed to protect their pipelines and infrastructure. INCIBE recorded 122,223 cybersecurity incidents in 2025, 26 % more than the previous year, a trend that shows no sign of easing.
The new front in corporate cybersecurity
Artificial intelligence has become a strategic pillar for companies in every sector. From virtual assistants to predictive analytics or industrial maintenance, AI is transforming the way businesses are run. But alongside these opportunities, new attack surfaces have also emerged that traditional security frameworks were not designed to cover.
AI models are not invulnerable. Like any technological system, they can be the target of attacks designed to manipulate their responses, extract confidential information or compromise the trust placed in an organisation. Protecting against these threats is essential so that AI is not only powerful, but secure and reliable.
Main types of threat in the age of AI
The OWASP Top 10 for LLM Applications 2025 is the reference framework that lists the most critical risks for applications built on language models. These are the most relevant threats for enterprise environments.
Prompt injection (LLM01:2025). It is the most critical risk according to OWASP and occurs when an attacker introduces malicious instructions through the user's own inputs or through external content the model processes (documents, emails, websites). The model can be manipulated into disobeying its security policies, revealing confidential information or performing unintended actions. In autonomous agent systems, the consequences can include sending emails, modifying databases or triggering unauthorised business processes.
Data poisoning (LLM04:2025). This consists of manipulating the data used to train or feed a model in order to bias its results or introduce hidden behaviours. An attacker can insert false information into training datasets or into the knowledge bases the model consults, systematically altering the system's output.
Excessive agency (LLM06:2025). This occurs when an AI system has capabilities, permissions or autonomy beyond what its function requires. The risk is not only that the model makes a mistake, but that this mistake has permission to create, delete, send, approve or modify data. A manipulation via prompt injection in an agent with excessive agency can have serious operational consequences.
Model extraction. Through multiple systematic interactions, an attacker can reconstruct a model's internal knowledge and copy it, which constitutes theft of intellectual property. This threat is especially relevant for organisations that have invested in models trained on proprietary data.
Adversarial evasion. This consists of manipulating inputs (text, images, numerical data) with minimal variations designed to deceive the model, leading it to produce incorrect or dangerous responses. Adversarial attacks are hard to detect because the modifications are usually imperceptible to a human observer.
Sensitive data exfiltration (sensitive information disclosure, LLM02:2025). If the model has access to internal information, an attacker can force it to reveal confidential data through seemingly harmless questions. According to Check Point data for late 2025, 1 in 27 requests to generative AI tools in enterprise environments posed a high risk of sensitive data leakage.
Attacks on the model supply chain (supply chain, LLM03:2025). AI applications depend on third-party components: base models, datasets, libraries, orchestration frameworks, vector databases and APIs. A compromised component at any point in that chain can affect the security of the whole system. This threat is particularly hard to detect because the vulnerable component may appear completely legitimate.
Attacks on infrastructure. Model access APIs, deployment environments and data pipelines are also attack vectors. Compromising the infrastructure can allow access to the models, manipulation of inputs or service disruption before they reach the model.
Why are these threats especially dangerous?
Their danger has four dimensions that set them apart from traditional cyberattacks. The manipulations are hidden in seemingly normal interactions, which makes them very hard to detect with conventional security tools. A data leak or an assistant that responds with incorrect data can seriously damage the trust of customers and partners, with a reputational impact that is hard to reverse. The exposure of sensitive data can lead to penalties under the GDPR and, since August 2025, under the new EU AI Act obligations for providers of general-purpose models. Finally, the scale of the damage is greater than in traditional attacks: a compromised agent can act on thousands of interactions before the incident is detected.
Specific defences for AI environments
In the face of these risks, the answer is not to slow down AI adoption but to deploy a cybersecurity strategy designed specifically for these environments. These are the key measures.
Data governance and control. Ensure that training and query datasets are clean, audited and verified. Use anonymisation techniques to protect sensitive information. Maintain a complete inventory of the AI systems in use, something that 76 % of Spanish SMEs have not documented according to 2026 data from Wolters Kluwer and BBVA Research.
Prompt and input validation. Implement filters that detect and block prompt injection attempts, both direct (in the user's prompt) and indirect (in documents or content the model processes). Define clear policies on what kind of information can be consulted through AI.
Principle of least privilege and agency control. Explicitly limit the tools and permissions each AI agent has access to. Require human confirmation for sensitive or irreversible actions. This measure directly mitigates the risk of excessive agency (LLM06:2025).
Traceability and auditing. Record what data the model consults and how it generates its responses. Establish security logs that make it possible to identify attack patterns and respond quickly. In regulated environments, this traceability is also an EU AI Act requirement for high-risk systems.
Infrastructure security. Protect APIs and model access with robust authentication. Apply encryption in transit and at rest. Zero Trust architectures are the most established trend in Spanish organisations in 2026, according to Cosmikal's analysis of the cybersecurity landscape in Spain, precisely because they eliminate the direct exposure of services to the internet.
Model resilience. Train systems with adversarial examples so they learn to recognise manipulation attempts. Periodically review known vulnerabilities, especially those related to third-party models that form part of the supply chain.
Human oversight. Establish a human in the loop for critical processes. The most sensitive decisions should not rest solely with AI, a requirement also set out in the EU AI Act for high-risk systems.
The current regulatory framework: EU AI Act and GDPR
European regulation adds a layer of mandatory requirements to these security measures. The EU AI Act (Regulation EU 2024/1689) has been in force since 1 August 2024 and establishes phased obligations. The prohibitions on AI practices posing unacceptable risk have applied since February 2025. The specific obligations for providers of general-purpose AI (GPAI) models, which include risk management, security evaluations and reinforced cybersecurity, have been in force since August 2025. Full obligations for high-risk systems were scheduled for August 2026, although the provisional political agreement on the Digital Omnibus of May 2026 proposes postponing them until December 2027. This postponement is not yet final: until it is published in the Official Journal of the EU, the August 2026 date remains the applicable legal reference.
Alongside the EU AI Act, the GDPR already establishes that the exposure of personal data through AI systems may constitute unlawful processing. The Spanish Data Protection Agency (AEPD) has explicitly warned about the risks of entering customer data into AI platforms without adequate safeguards. Fines can reach 35 million euros or 7 % of worldwide turnover for the most serious infringements.
Turning security into a factor of trust
More than a technical requirement, cybersecurity in AI is a strategic business factor. Companies that demonstrate their systems are robust against attacks inspire more trust in customers and users, reduce legal risks and penalties, protect their intellectual property and strengthen their competitive advantage in a market where trust is the most fragile asset.
At LurNova, AI that is secure by design
At LurNova we believe artificial intelligence only makes sense if it is secure, reliable and transparent. That is why we design solutions with a security-by-design approach, integrating the Model Context Protocol (MCP), the standard for secure communication between AI agents and external tools that keeps data under control and limits the attack surface; RAG architectures (Retrieval-Augmented Generation) that allow models to access up-to-date information without exposing unnecessary data; traceability systems that make it possible to audit every model response and detect anomalous patterns; and active defences against prompt injection, excessive agency and data exfiltration attacks, aligned with the OWASP LLM 2025 framework.
Our aim is for your company to be able to deploy AI with the certainty that it is protected against the threats of the present and the future. Contact us if you would like to have a chat.
Co-founder and CTO of LurNova, with more than 20 years' experience in developing digital technologies. Specialised in designing secure, private and governed artificial intelligence architectures and solutions for organisations.
