Chapter 22 described how an organisation executes its recovery plan: objectives and dependencies in version control, restoration from known-good definitions and immutable backups, verification before return to service and a declared end to recovery. An AI system adds components that conventional recovery does not see: restore the virtual machine and the database, and the system may run while still carrying the poisoned document, the altered prompt or the over-broad token that caused the incident. A recovered AI system is therefore one that has been shown to behave as it did before the incident, not one that is running again.
This chapter covers both the AI the organisation uses in its business and the security AI it depends on, which may be unavailable precisely when it is most needed. In CSF terms the chapter belongs to RC.RP Incident Recovery Plan Execution, in which restoration activities are performed to ensure the operational availability of systems and services affected by cybersecurity incidents (19, NIST, 2024). Four Subcategories carry most of the weight for AI: recovery actions are selected, scoped, prioritised and performed (RC.RP-02); the integrity of restoration assets is verified before use (RC.RP-03); the integrity of restored assets is verified and normal operating status confirmed (RC.RP-05); and the end of recovery is declared on criteria (RC.RP-06). The chapter treats the Category through the three focus areas of the NIST Cyber AI Profile (20, NIST, 2025).
An AI system is a compound of artefacts with different lifecycles, each with its own source of truth, its own way of being corrupted and its own way of being restored. Recovery restores all of them, or it restores none of them reliably.
Primary topics explored
- What an AI system consists of when it must be restored
- Rolling back to known-good versions
- Re-evaluation before return to service
- Recovering agents
- When security AI is unavailable
- Summary
About AI Red Team
AI Red Team is Book 4 of The Transformed Architecture. It shows how large European enterprises and public authorities put artificial intelligence to work as an active part of cyber defence: AI-assisted red teaming and adversary emulation, red teaming of AI systems themselves, the AI-assisted security operations centre, detection engineering, threat intelligence, incident response and purple teaming, all under a lawful mandate and with evidence a supervisor can inspect.
It builds on the conclusions of Architecture as Code, AI Governance and AI Platform and Security.
CISOs, SOC leads, red and blue team practitioners, security architects, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 23: Recovering AI Systems and Security AI in AI Red Team gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Recover” and is one of 32 drawn from the manuscript.