The plan
A practical plan to reduce data poisoning risk
Start with what you run and where its data comes from, then add versioning, supplier questions and testing. Each step uses controls the sources name.
Last reviewed against Anthropic, UK AI Security Institute and arXiv. Sources
The steps below are in the order that makes most sense for a team starting from nothing. The cards that follow set out each action in full, so this page gives the reasoning.
Why this order
Visibility first
You cannot protect data you have not listed. OWASP's first control is tracking the origin and transformation of data and verifying its legitimacy at each stage [4]. Versioning, vendor checks and testing all depend on that record existing.
Who owns what
Split the work
Data poisoning sits between teams. Data and engineering teams hold the datasets, procurement holds the suppliers and security holds the testing. Name one owner for the whole, so that a gap between teams does not go unnoticed.
What to ask suppliers
Questions for AI vendors
The NCSC guidelines place supply chain security within secure development [6]. Put that into supplier reviews.
Ask each supplier:
- Where does the training and fine-tuning data come from?
- How is data checked before use, and how are changes recorded?
- What testing apart from benchmarks has been done for backdoors?
- How are downloaded or third-party models checked before use?
What to plan for
Beyond this quarter
The research is moving. The authors of the 2025 study call for further work on defences [3], and NIST says its taxonomy sets out mitigation methods and their limits [5]. Review this plan when new guidance appears, and see the guidance overview for where to look.
What to do
Five steps, in order
-
Step 1
Map where your training and retrieval data comes from[4]
List every dataset, crawl, vendor feed and document store that a model learns from or reads. OWASP advises tracking data origins and transformations and checking the legitimacy of data at every development stage.
Who: Data, development and security teams
-
Step 2
Version datasets and keep a record of changes[4]
Store datasets under version control alongside the models trained on them, so that a manipulation can be spotted and rolled back. OWASP names dataset versioning as a way to detect tampering.
Who: Data and engineering teams
-
Step 3
Vet data vendors and sandbox unverified sources[4]
Ask suppliers how they collect and check data, and keep unverified sources away from production training. OWASP advises careful vendor vetting and sandboxed access to data that has not been verified.
Who: Procurement, security and data teams
-
Step 4
Test for backdoors and do not rely on benchmarks alone[9]
Add adversarial testing and monitoring of training behaviour and outputs. A study reported by Hackaday found that corrupted medical models matched clean ones on routine benchmarks.
Who: AI and security teams
-
Step 5
Put AI supply chain questions into supplier reviews[6]
The NCSC guidelines list supply chain security as part of secure development. Ask suppliers where their training data and models come from and how they protect them.
Who: Risk, procurement and security leads
Keep reading
Read next
Questions
Sourced answers on data poisoning in AI: what it is, how many documents it takes, whether it can be detected and what to do first.
Read the guide
Risks
The specific risks data poisoning creates for organisations that build, fine-tune or buy AI, with the evidence behind each one.
Read the guide
What it is
A plain explanation of data poisoning: how tampered training data changes what an AI system does, and why backdoors are hard to find.
Read the guideHow CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
Defending against data poisoning starts with knowing which AI systems you run, where their data comes from and who owns the risk. CyPro can help set the governance, risk assessment and controls around that.