Scope before you secure
Lesson 1 of 5 in The GenAI Security Scoping Matrix: Know What You’re Securing.
The cloud-guardrails module handed you a toolbox: content filters, PII redaction, policy enforcement at the API layer. This module teaches the question that comes before any of those tools: what exactly are we securing? Because the honest answer differs wildly between an employee pasting text into a free public chatbot and a team training its own foundation model — and so does everything you should do about it.
AWS answered that question with the Generative AI Security Scoping Matrix, introduced on the AWS Security Blog in October 2023 by Matt Saner and Mike Lapidakis and now maintained as the AI Security Scoping Matrix. Its opening move is deliberately deflationary: a generative AI workload is, at its core, another data-driven computing workload. It inherits the security regimen you already run — identity and access management, data protection, application security, threat modeling, the Well-Architected Security Pillar. If your genAI application reads from a database, you still need to know that database’s classification, who can reach it, and how you monitor it. Nothing about a transformer changes that.
What is new fits in a short list: models that answer anyone who can reach them, training data that fuses into weights, free-form inputs that double as an attack surface. The matrix exists to tell you which of those new problems are yours — and that depends entirely on how much of the model and its data you own.
The matrix is a five-by-five grid. Down one axis run five scopes, numbered 1 to 5 in order of least to greatest ownership of the model and its data. Scopes 1 and 2 are buying generative AI — a public consumer app, or an enterprise product with genAI embedded. Scopes 3 to 5 are building — on a pre-trained foundation model via API, on a model you fine-tuned, or on a model you trained from scratch. Across the other axis run five security disciplines: governance and compliance, legal and privacy, risk management, controls, and resilience.
Using it takes one sentence: find your row, then walk the five disciplines. Each cell tells you what that discipline demands at that level of ownership. Here is the at-a-glance view — the rest of this module fills in the cells.
| Scope | Buy or build | What you own and can change | AWS’s example |
|---|---|---|---|
1 — Consumer app | Buy. A public third-party genAI service, free or paid — often consumer-grade, not made for enterprise use. | Nothing. You never see the training data or the model and cannot modify or augment it. The provider’s terms of service govern you. | An employee uses a public genAI chat app to generate ideas for a marketing campaign. |
2 — Enterprise app | Buy. A third-party enterprise application with genAI features embedded, under a business relationship with the vendor. | Still not the model — but you hold enterprise terms and conditions designed to add protections. | An enterprise scheduling app uses embedded genAI to draft meeting agendas. |
3 — Pre-trained models | Build. Your own application on a third-party foundation model, integrated directly through an API. | The application, its data flows, and everything around the model. The model itself stays the provider’s, unmodified. | A customer-support chatbot using RAG over your data with the Anthropic Claude model through Amazon Bedrock APIs. |
4 — Fine-tuned models | Build. You refine a third-party foundation model with data specific to your business, producing a new, specialized model. | The application plus a new model whose weights now carry your data. | Fine-tuning a model for an electronic-health-record system so patient-record summaries match medical style and terminology. |
5 — Self-trained models | Build. You train a generative model from scratch on data you own or acquire. | Every aspect — data, weights, architecture, and all the obligations that follow. | A custom video-generation model, licensed out to media and entertainment companies. |
Key terms: Generative AI Security Scoping Matrix, foundation model, Shared responsibility model, generative AI, fine-tuning
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.