ISO/IEC 27090:2026, published on 14 October 2026, is international guidance on how AI systems are attacked and how to detect and reduce those attacks, from prompt injection to data poisoning. It is guidance, not a certifiable standard, and it applies to organizations that use AI as well as those that build it.
ISO/IEC 27090 describes the ways AI systems are compromised and, for each one, what fails, how to detect it, and how to reduce it: data poisoning, direct tampering with a model, evasion of a model with crafted input, membership inference, model inversion, model theft through repeated queries, prompt injection, sensitive model output, and AI output that carries an attack onward. It also covers the security work around AI: governance, zero trust, secure engineering, AI supply chain risk, threat modelling, red teaming, logging and monitoring, and protecting development environments.
It builds on ISO/IEC 27001 and 27002 and sits alongside ISO/IEC 42001, the certifiable AI management system standard. Nobody certifies to ISO/IEC 27090 itself; organizations use it to decide how to handle AI-specific threats inside the security and AI programs they already run.
Official source: https://www.iso.org/standard/27090
ThreeShield's CISSP- and CISA-certified assessors run the ISO/IEC 27090 gap assessment and AI security review, test your AI features the way an attacker would, and use Lavawall® to collect much of the evidence continuously: AI apps and agents connected to Microsoft 365 and Google Workspace, shadow AI, Copilot and Gemini activity, AI tools and browser extensions on computers, and AI services exposed on your network or the Internet.
| Level | What it covers | Builds on the level below |
|---|---|---|
| Using AI services | For organizations that use AI services such as Microsoft 365 Copilot, ChatGPT, Gemini, and AI agents: approved tools, limits on the data people share with AI, permissions held by connected AI apps, prompt injection awareness, and logging and monitoring. | No |
| Building or hosting AI | For organizations that develop, fine-tune, host, or integrate AI models: everything in Using AI services, plus poisoning, evasion, inference attacks, model theft, development environment protection, red teaming, and provenance. | Yes |
| ISO/IEC 27090 area | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Approved AI tools and shadow AI | ✓ Continuously | AI approval process and acceptable use policy |
| AI apps and agents with access to mail and files | ✓ Continuously | Permission review and clean-up plan |
| Copilot and Gemini activity, and Copilot's prompt attack detections | ✓ Continuously | Review routine and response playbook |
| AI tools, local model servers, and AI browser extensions on computers | ✓ Continuously | Risk decisions and allowlisting |
| AI services exposed to the Internet or open on the internal network | ✓ Continuously | Validation and hardening |
| Threat modelling and AI supply chain review | ⚑ Platform data | CISSP/CISA-led |
| Red teaming of AI features (prompt injection, sensitive output, unsafe output) | Not automated | Hands-on testing by ThreeShield |
| Policies, procedures, and evidence package | Not automated | Written by ThreeShield |
No. ISO/IEC 27090 is guidance, so there is no certificate to earn. What we deliver is an independent gap assessment and AI security review you can show clients, insurers, and auditors, and it fits inside an ISO/IEC 27001 or ISO/IEC 42001 program if you have one.
Nothing requires it, but the guidance is written for organizations that use AI as well as those that build it. Hidden instructions in an email or shared file, an assistant surfacing information it should not, and AI apps connected to your mail without review all apply to Copilot users. The Using AI services level is sized for exactly this, and we confirm scope in the first call, at no charge.
ISO/IEC 42001 is the certifiable AI management system: policy, roles, impact assessment, and life cycle. ISO/IEC 27090 goes deeper on the security side, explaining how AI is attacked and how to detect and reduce each threat. Lavawall® maps both to one shared control set, so work done for one counts toward the other.
Yes. For organizations at the Building or hosting AI level, we red team AI features for prompt injection, sensitive output, and output that carries an attack, and review how models and data are sourced and protected. Findings come with a prioritized remediation roadmap.
Start at whatever security maturity you have today. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full AI security program delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so your evidence stays current between reviews.
Book a Scoping CallDIY · Supported · Done-for-You