Protect AI infrastructure with the same controls that protect the rest of your organization—then add clear security ownership across the AI system’s development and operation. The nine blunders below are a practical editorial framework, not an official ranking or list published by CISA. They cover foundational cyber hygiene and the additional responsibility of securing AI-enabled systems.
1. Leaving important accounts protected by passwords alone
A stolen password should not be enough to open an administrator console, remote-access service, email account, or system containing sensitive data. Require multifactor authentication (MFA) on those accounts, and extend it to other infrastructure access wherever your identity systems support it.
As an Amazon Associate I earn from qualifying purchases.
Prefer phishing-resistant MFA where available. CISA’s communications infrastructure guidance identifies FIDO authentication as an example. A compatible hardware security key can be one way to use FIDO, but check compatibility with your identity provider, devices, account-recovery process, and organizational policy. A key is one control, not a substitute for securing the account and its recovery path.
2. Reusing weak passwords
MFA does not make a weak or reused password a good choice. Use a strong, unique password for each account, especially where MFA is unavailable or where credentials could grant access to other systems. A password manager can help people create and maintain distinct credentials instead of reusing one across services. CISA’s Secure Our World guidance recommends strong passwords and password managers.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
3. Treating phishing as only a user-awareness problem
People need to recognize suspicious messages and know how to report them, but training alone cannot carry the burden. Build a straightforward reporting route, make it clear what happens after a report, and use MFA and organizational access controls to reduce the damage a stolen credential can cause. CISA’s Secure Our World guidance highlights phishing awareness; its September 2024 “Stay Safe Online When Using AI” tip sheet applies phishing awareness, MFA, strong unique passwords, and software updates to generative AI use as well.
4. Delaying software and vulnerability updates
Outdated operating systems, applications, firmware, libraries, and infrastructure components can leave known weaknesses exposed. Maintain an inventory of what you operate, assign responsibility for updates, and have a process to assess and deploy fixes based on exposure and risk. CISA identifies software updates as foundational cyber hygiene.
Pay particular attention to vulnerabilities known to be exploited. In an update announced on January 17, 2025, CISA and the FBI clarified their Product Security Bad Practices guidance concerning patching Known Exploited Vulnerabilities. That guidance does not establish a universal patch deadline for every organization; set priorities and response times that reflect your systems and exposure.
5. Leaving cloud and business application settings unchecked
Default or casually configured settings may grant more access than intended, expose data, or leave useful security features unused. Review who can access each service, how access is granted, which integrations and external sharing options are enabled, and whether security events are visible to the people responsible for responding.
Rank #2
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
CISA’s small-business resource hub points organizations to Secure Cloud Business Applications resources for assessment and hardening. Use that as a resource path, not as a guarantee that a tool or checklist will secure your particular environment. Check the actual configuration against your organization’s needs and access policies.
6. Keeping no recoverable copy of important data
Backups matter when data is deleted, corrupted, encrypted by ransomware, or otherwise unavailable. Identify the information and services your organization must recover, then design and test backups around those recovery needs. Confirm that the people responsible can restore data—not merely that a backup job reports success. CISA lists data backups among its business security practices; it does not prescribe one schedule or retention pattern for every organization.
7. Collecting too little security telemetry
Without useful records, it can be difficult to spot suspicious access or reconstruct what happened after an incident. Decide which systems and events your security team needs to monitor, make those records available to the people who investigate alerts, and define how they will be retained and protected. CISA’s business resources point to logging and threat-detection guidance. Logging supports detection and investigation; it does not prevent every intrusion.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
8. Neglecting encryption and data handling
Know what sensitive data your organization stores or sends, which systems and people can reach it, and how long it needs to be retained. Apply encryption in ways suited to the data and system context, and control access to the associated keys. CISA includes encryption of business data among its security practices, but the right implementation depends on the information, where it is handled, and the systems involved.
Rank #3
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
9. Building or procuring AI systems without security ownership
An AI feature does not have a single universal threat model: risks depend on the system, its data, integrations, users, and deployment. Treat security as an ongoing responsibility, not a final review after a model or product is selected. Name who is accountable for security decisions during development and operation, and make sure teams can raise and resolve issues.
Build security into development and operation
Use threat modeling to identify how the particular system could be misused or compromised, then apply layered controls rather than relying on one safeguard. Review the components and services the system depends on, the data it handles, and the access available to users and connected systems. Revisit those decisions as the system changes.
CISA and the UK National Cyber Security Centre announced their joint Guidelines for Secure AI System Development on November 26, 2023. Their announcement emphasizes secure-by-design principles and ownership of security outcomes. CISA and partner agencies describe secure-by-design products as built to reasonably protect devices, data, and connected infrastructure, and recommend threat modeling and defense in depth. Those principles inform the work; they are not a configuration recipe that fits every AI deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
