Insights · Guides
Insights, in plain English.
How AI systems get attacked, how to defend them, and what the rules in India, the Gulf and Europe now ask for. Written by our AI security team for the people who have to make decisions about AI.
Sources linked in every articleDiagrams, not jargonUpdated when the rules change
In plain words
Seven guides, each answering one question buyers ask us: what LLM red teaming is, how prompt injection works, what the OWASP Top 10 for LLM Applications covers, how AI agents get hijacked through MCP, and what CERT-In, India’s DPDP Act and the EU AI Act now require of AI systems. Every article links to its sources.
- Articles
- 7
- Topics
- AI security · Compliance
- Sources
- Linked in every article
- Updated
- November 2026
All guides
Seven guides, one question each.
Start with LLM red teaming if you are new to AI security, or jump to the rules that apply to you.
- What is LLM red teaming, and does your AI need it?LLM red teaming means attacking your own AI chatbot, copilot or agent the way a real attacker would, before customers or criminals do. Here is what it covers, how it differs from a penetration test, and what a good engagement gives you.
- Prompt injection, explained without the jargon.Prompt injection is the number one risk on the OWASP list for AI applications. It happens when text the AI reads is treated as an instruction. Here is how it works, why it is so hard to stop, and what actually reduces the risk.
- The OWASP Top 10 for LLM apps, one risk at a time.The OWASP Top 10 for LLM Applications is the most widely used checklist for AI security. The 2025 edition reflects what went wrong as chatbots became agents. Here is each risk in plain words, with what it looks like in a real product and how to test for it.
- MCP security: how AI agents get hijacked.The Model Context Protocol lets AI agents plug into tools and data, from code repositories to inboxes. It also gives attackers new ways in. Here are the attacks seen in the real world so far, why they work, and how to use MCP safely.
- CERT-In and AI in 2026, what changed and what to do.In May and June 2026, CERT-In published two documents about AI: a blueprint for defending against AI-assisted attacks, and guidelines for technology vendors on flaws that AI can exploit. Here is what each says, what is binding and what is advice, and a plan to act on them.
- The DPDP Act and your AI chatbot, what to do before May 2027.India’s Digital Personal Data Protection Act never mentions AI, but every chatbot and voice agent that handles customer data is covered by it. Here is what it means for notices, consent, chat transcripts, training data, leaks and children, with a checklist to work through before the main duties apply on 13 May 2027.
- EU AI Act Article 50, for chatbots and voice agents.Since 2 August 2026, the EU AI Act has required chatbots and voice agents to say they are AI, and AI-generated content to be marked. These duties can reach Indian companies whose AI serves people in Europe. Here is what Article 50 asks for, who must do it, and how to check that your AI keeps to it under pressure.
Questions
About these guides.
Q01Who writes these guides?
HanulSec’s AI security and compliance team in Bengaluru. Every article links to the laws, standards and research it relies on, so you can check the original.
Q02Is this legal advice?
No. The compliance articles explain the rules in plain words, but rules change and every company is different. Check the official text and ask your lawyer before making decisions.
Q03Can we suggest a topic?
Yes. Write to hello@hanulsec.com with the question you would like answered.
Request a quote
Scope it in two minutes.
Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.
- Reply within one business day
- Free 30-minute scoping call
- Mutual NDA before any detail is shared
- Fixed price, free retest of fixed findings