COMPASS journey map
From first prompt to AI-enabled business, with the data, milestones and measures to prove progress
An expedition guide for organizations starting an AI security program. Five stages and seventeen steps, organized by the seven COMPASS domains, the 18 AI security functions and the 10 questions every leader must answer.
of organizations with an AI breach lacked AI access controls
IBM, 2025of breached organizations had no AI governance policy, or were still writing one
IBM, 2025of breaches now start with vulnerability exploitation, the top initial access vector
Verizon DBIR, 2026of agentic AI projects will be canceled by end of 2027, Gartner predicts
Gartner, June 2025Seven COMPASS domains in orbit around the AI estate they protect
The first year of breach data on AI shows the same pattern everywhere: adoption first, governance and access control later. The gap is where attackers are already working, and where the cost shows up.
Share of organizations studied, IBM Cost of a Data Breach 2025 (600 breached organizations, March 2024 to February 2025)
higher breach costs where shadow AI use was high
IBM, 2025average savings with extensive AI and automation in security operations
IBM, 2025global average cost of a data breach
IBM, 2025“As AI becomes more deeply embedded across business operations, AI security must be treated as foundational.”
The window is closing. Vulnerability exploitation is now the top initial access vector at 31% of breaches (Verizon DBIR 2026), and Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027, in part for inadequate risk controls.
Every stop on the road is tagged with the COMPASS domains it builds, the AI security functions it puts to work and the leadership questions it answers. Hover any domain, function or question in the interactive version to light up its steps.
Black Bay's seven-domain AI security model, aligned to NIST AI RMF and adapted from Black Bay's COMPASS framework. Plan to implement, design to operate.
The top ten client concerns raised in AI security briefings, grouped into four control areas. A program is ready to scale when it can answer all ten with evidence.
Capability areas beneath the seven domains, mapped from the Black Bay AI Security Vendor Catalog v2.0. The color shows each function's primary domain.
Primary domain for each function; a working view aligned to COMPASS topics.
Each stage has a timeframe, a target maturity level, exit criteria and the threats you will meet along the way. Each stop shows the three actions that matter most, how to measure progress and who owns the work.
Exit criteria: Named owners, interim AI policy, AI inventory v1 and an COMPASS baseline.
Put accountable leaders and decision rights in place before AI scales further.
You cannot secure what you cannot see. Discover every model, agent, copilot and MCP server in use.
Score all seven COMPASS domains, map installed tools to them, and quantify the top risks.
“COMPASS gives us a common language and structured approach for managing AI risk.”
Exit criteria: AI data classified, risk tiers live, one control library and a funded roadmap.
Most early AI incidents are data incidents. Control what flows into prompts, retrieval, logs and outputs.
Make the approved path faster than the shadow path, with controls proportional to risk.
Map controls once to NIST AI RMF, ISO/IEC 42001, the EU AI Act, OWASP and MITRE ATLAS.
Exit criteria: Agents have identities, a gateway is in the path, supply chain and release gates enforced.
When AI can act, identity becomes the control point. Treat every agent as a governed non-human identity.
Inspect prompts, outputs and tool calls inline, on paths applications cannot bypass.
Treat models, datasets, embeddings, plug-ins and MCP servers as supply chain dependencies.
Traditional AppSec misses AI-specific attacks. Test for them before anything reaches production.
Protect GPU clusters, registries and pipelines like the production systems they are.
“Identity is the weakest seam in enterprise AI deployment.”
Exit criteria: SOC coverage for every AI system, continuous red teaming and tested playbooks.
AI risk changes after deployment. Give the SOC the signals and playbooks to see it.
Every model swap, prompt change or new tool resets your assurance. Keep testing.
Build and practice playbooks for leakage, poisoning, agent misexecution and deepfake fraud.
“Plan to implement, design to operate.”
Exit criteria: Continuous compliance, a paved road for agents and a post-quantum roadmap.
Move from point-in-time audits to continuous evidence and board reporting in business terms.
Make the secure path the fast path: self-service agents with identity, policy and observability built in.
Build crypto agility and extend COMPASS to physical AI, OT and whatever comes next.
Every AI use case, model and agent is owned, inventoried, protected, monitored and recoverable, and leadership can answer each question below with evidence.
Track progress on the Black Bay five-level AI security maturity model. Programs that follow a framework keep climbing; programs built from point tools tend to stall at level 2, where coverage is fragmented and enforcement uneven.
Illustrative target path by stage, compared with an ad hoc program
Illustrative. Replace with the client's COMPASS assessment scores at each stage exit.
Maturity by COMPASS domain, scale 1 to 5
Illustrative example of a common starting profile. Score the client in step 03.
No single step or product covers COMPASS end to end. The heat map shows where each step builds a domain as the primary owner or as support; the timeline shows how the workstreams overlap from build to run.
Solid cell: primary domain. Faded cell: supporting domain. Click a cell in the interactive version to open that step.
Thick bar: build. Thin bar: run and improve. Background bands mark the five stages.
Timing assumes a large enterprise with an executive sponsor in place; adjust to the client's baseline.
Build the control library once and map it to every framework. The EU Digital Omnibus on AI moved high-risk obligations to December 2027 and August 2028; transparency duties still apply from August 2026. NIST's post-quantum transition plan remains an initial public draft.
Prohibited AI practices and AI literacy duties apply
General-purpose AI model obligations apply
Top 10 for agentic applications published
Article 50 transparency obligations apply
In effect nowAnnex III high-risk obligations apply after the Digital Omnibus deferral
Annex I high-risk obligations for AI in regulated products
Quantum-vulnerable algorithms deprecated
Quantum-vulnerable algorithms disallowed
Controlled autonomy: more AI throughput with a smaller blast radius.
per agent with ad hoc security: manual identity tickets, approvals and no policy-as-code
from idea to a governed production agent on an COMPASS-aligned platform
Black Bay COMPASS Day 2 example: developer sets up an agent with identity, scope, CI/CD scanning, gateway and observability.
Every agent is born with an identity, access controls and a full audit trail.
Self-service provisioning replaces ticket queues and approvals that take weeks.
When the secure path is the fast path, teams stop routing around it.
Gateways, guardrails and prompt-level observability scale from 5 agents to 500.
“Organizations need security that can keep up with the speed, complexity and sensitivity of modern AI pipelines.”
Black Bay combines consulting-grade strategy with the engineering depth to design, validate and deliver each stage, so the roadmap turns into working controls.
AI Security Assessment, COMPASS maturity scoring and the AI Governance Workshop to start stages 1 and 2.
Gateways, guardrails and vendor combinations reviewed against your deployment architecture before production.
Findings become owned remediation tasks with live dashboards, so progress is tracked between assessments across every COMPASS domain.
Facilitated tabletop exercises against AI-augmented adversaries to rehearse stage 4 playbooks.
