Key takeaways
- Assume Breach plans for an attacker who has already bypassed preventive controls.
- For AI agents, evaluate what a compromised agent can access and do through its connected tools.
- Use evidence of detection, containment and recovery to assess the consequences of a successful attack.
Assume Breach (also called Assume Compromise) is a cybersecurity strategy built around one central principle:
Operate as though an attacker has already gained access to your environment, and design your security controls to prevent them from causing further damage.
Rather than focusing exclusively on keeping attackers out, Assume Breach focuses on detecting, containing, and limiting an attacker who has already bypassed preventive controls.
It is closely associated with Microsoft security practices and Zero Trust architecture, particularly NIST SP 800-207.
1. How the Assume Breach framework works
Initial compromise
Phishing, stolen credentials, exploited API
Restrict attacker movement
Least privilege, segmentation, isolation
Detect suspicious behaviour
Identity, endpoint and network telemetry
Contain, respond and recover
Revoke access, isolate, restore, investigate
2. Core security principles
| Principle | Security objective |
|---|---|
| Least privilege | Minimize permissions available to a compromised account. |
| Microsegmentation | Prevent attackers from moving laterally between systems. |
| Continuous monitoring | Identify suspicious activity using logs, telemetry and behavioural analytics. |
| Identity verification | Continuously evaluate access based on identity, device and context. |
| Threat detection and response | Detect and contain malicious activities before they escalate. |
| Resilience and recovery | Maintain critical operations and restore services after an incident. |
| Adversarial testing | Use red teaming and breach simulations to validate security controls. |
3. How it differs from traditional security
| Traditional perimeter security | Assume Breach |
|---|---|
| Focus on preventing entry | Plan for attackers already inside |
| Trust often increases after authentication | Access remains constrained and evaluated |
| Emphasize firewalls and perimeter defenses | Emphasize identity, telemetry and containment |
| Test whether attackers can enter | Test what attackers can do after entry |
| Success measured by blocked attacks | Success also measured by detection, containment and recovery |
Importantly, Assume Breach does not replace preventive security. It strengthens defense in depth.
4. Applying Assume Breach to AI agents
This is particularly relevant to AI security and the emerging risks associated with agentic AI.
As a hypothetical example, consider an AI agent connected to Microsoft 365, Salesforce, internal databases and external APIs.
Instead of asking only whether the agent can resist prompt injection, an Assume Breach assessment would ask:
- What happens if an attacker successfully manipulates the agent through prompt injection?
- Can the compromised agent access sensitive information beyond what is necessary?
- Can it execute unauthorized actions through its connected tools?
- Can it use credentials or delegated permissions to access additional systems?
- Can security teams detect abnormal tool calls and data transfers?
- Can the agent's access be revoked or its execution stopped without disrupting the entire business?
The fundamental shift is from asking whether an AI agent is secure to asking how much damage a compromised agent could cause.
This approach can become an important part of an AI Agent Security Assurance methodology, combining Zero Trust, Assume Breach, threat modelling and adversarial testing.
5. Relevant frameworks and standards
Assume Breach is a security philosophy and operating approach, not a single formally standardized framework. It can be operationalized through:
- NIST SP 800-207 — Zero Trust Architecture: includes the assumption that an attacker may already be present in the environment.
- MITRE ATT&CK: helps model adversary techniques and evaluate detection and response capabilities.
- NIST Cybersecurity Framework 2.0: provides Govern, Identify, Protect, Detect, Respond and Recover functions.
- OWASP Top 10 for LLM Applications: identifies AI-specific attack paths that can be used in compromise scenarios.
6. Incorporating Assume Breach into an AI risk assessment methodology
An Assume Breach assessment layer can be introduced into AI system reviews.
For example, when assessing an Amazon Bedrock agent, evaluate not only the guardrails and model security, but also the consequences of a successful guardrail bypass.
| Assessment area | Evidence to request |
|---|---|
| Compromise scenarios | Threat model and attack paths |
| Blast radius | IAM permissions, tool scopes and accessible data |
| Lateral movement | Network segmentation and cross-system access restrictions |
| Detection | CloudTrail, CloudWatch and security alerts |
| Containment | Credential revocation, agent shutdown and isolation procedures |
| Validation | Red-team results and documented remediation |
This makes the assessment more practical because it evaluates the effectiveness of security controls under conditions where prevention has already failed.
One important distinction worth exploring further is the difference between Assume Breach, Zero Trust and AI red teaming. They complement one another, but they address different aspects of security assurance.
Related practical guide
Stopping an AI agent safely
Explore the containment exercise, evidence criteria and restart checks in our companion guide.
Open the guide