EY’s Enterprise 360° AI Security Services

EY’s Enterprise 360° AI Security service offering helps organizations identify, assess and manage risks across AI platforms, LLM solutions and supporting infrastructure. Through modular services covering an AI security assessment, technical testing, governance, privacy and regulatory compliance reviews and managed AI security services, EY provides an end-to-end view of AI risks and helps strengthen security, resilience and compliance.

What EY can do for you

From strategic AI security assessments and regulatory compliance reviews to architecture evaluations, technical testing and ongoing managed services, EY’s Enterprise 360° AI Security service provides end-to-end support across the AI lifecycle. By combining experienced practitioners with AI-enabled tooling, we help organizations to strengthen security, enhance resilience and build a mature AI security posture.

EY’s Enterprise 360° AI Security is structured as a set of modular services that can be delivered individually or combined to support clients across the AI security lifecycle:

AI Security Assessment
AI Security Testing and AI Threat Modeling
AI Governance and Regulatory Compliance Review
Managed AI Security Services

A holistic AI Security Assessment helps organizations discover and inventory AI systems across their environment, understand how AI is being used, identify security gaps, and gain a clear understanding of their current AI security posture. The assessment provides a comprehensive view of AI-related risks and delivers actionable recommendations to strengthen security, improve resilience and establish a mature AI security program.
AI inventory and use case identification, AI risk assessments, AI architecture reviews, and evaluation of AI security controls across the AI lifecycle. The assessment helps organizations identify existing risks, security gaps and areas for improvement across their AI environment.

Assess the organization's AI risk and security posture through the evaluation of AI governance, risks, architecture, and security controls across the AI lifecycle. The assessment helps identify security gaps, existing risks, and opportunities for improvement across the AI environment.

Examples of activities include, but are not limited to:

Uncover shadow AI across the organization.
Identify locally installed LLMs, desktop AI applications, MCP servers, and embedded SDKs.
Build a consolidated inventory showing who uses each AI system, how it is used, and where data flows.
Review AI architecture and supporting infrastructure.
Assess identity and access management controls for AI systems.

A clear view of AI-related risks, visibility into AI systems across the organization, and actionable recommendations to strengthen security, support regulatory compliance, improve responsible AI practices and create a trusted foundation for scaling AI with confidence.
Focused technical review using AI enabled security tooling of AI applications, LLM integrations, APIs, authentication mechanisms, access controls, cloud configurations and model-specific exposure points. Leveraging specialized testing tools and AI threat modeling techniques, it identifies vulnerabilities and evaluates resilience against emerging AI attack vectors.

Technical testing of AI applications, LLMs, agents, APIs, authentication mechanisms, access controls, cloud configurations, model endpoints, and supporting infrastructure to identify vulnerabilities and AI-specific attack vectors.

Examples of activities include, but are not limited to:

Perform deep-dive AI security assessments and technical testing to identify vulnerabilities and AI-specific threats, including prompt injection, jailbreaks, and data leakage.
Conduct AI red teaming exercises to simulate real-world adversary behavior and uncover security weaknesses across AI applications, LLMs, agents, and supporting infrastructure.
This review assesses whether your AI program aligns with leading governance practices and regulatory expectations. It evaluates data classification, privacy‑by‑design, handling and retention processes, third‑party model arrangements and responsible AI principles. It highlights compliance gaps and risks related to regulatory, ethical or operational exposure.
Governance frameworks, responsible AI practices, regulatory compliance, data protection, and third-party AI/vendor risk management.

Examples of activities include, but are not limited to:

Assess compliance with AI, cybersecurity, and data protection regulations, including the EU AI Act, GDPR, NIS2, DORA, and ISO/IEC 42001, identifying gaps and remediation opportunities.
Evaluate AI governance and responsible AI practices to strengthen accountability, transparency, oversight, and risk management.
Assess data privacy, protection, and third-party model risks by reviewing how AI systems and external AI services collect, process, store, share, and protect sensitive information.
The service helps organizations maintain secure, compliant and resilient AI operations through ongoing risk management, regular reviews and adaptation to evolving technologies, threats and regulatory requirements.
Continuous monitoring of AI systems and supporting infrastructure, AI security posture monitoring, compliance oversight, governance support, AI inventory maintenance, vulnerability management, and ongoing assessment of emerging AI threats and regulatory requirements.

AI environments evolve rapidly through new models, integrations, business use cases and emerging regulations. Continuous monitoring and governance help organizations identify risks early, maintain compliance and ensure AI systems operate securely and effectively.

Improved visibility into AI risks, ongoing compliance with evolving regulations, regular security and governance reviews, enhanced operational resilience, and support to ensure AI systems remain secure, scalable and adaptable to future business and technology needs.

The team

Our latest thinking

Request for proposal (RFP) - exclusively for Switzerland

Submit your request now!

Submit Request

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Limited, each of which is a separate legal entity. Ernst & Young Limited is a Swiss company with registered seats in Switzerland providing services to clients in Switzerland.

Request for proposal (RFP) - exclusively for Switzerland

Trending topics

Highlights

Services

Spotlight

Industries

Trending

Careers

Spotlight

About us

Spotlight

Events

Upcoming events

EY’s Enterprise 360° AI Security Services

What EY can do for you

The team

Maria Pisà

Adrian Ott

Tom Schmidt

Request for proposal (RFP) - exclusively for Switzerland

Trending topics

Highlights

Services

Spotlight

Industries

Trending

Careers

Spotlight

About us

Spotlight

Events

Upcoming events

EY’s Enterprise 360° AI Security Services

What EY can do for you

AI security assessment

AI Security Testing and AI Threat Modeling

AI Governance and Regulatory Compliance Review

Managed AI Security Services

The team

Maria Pisà

Adrian Ott

Tom Schmidt