AZURE DRAGONC Y B E R
Get started

RESOURCES · FREE DOWNLOADS

Resources

Practical guides, reference designs and white papers on cybersecurity, AI governance and compliance. Free to download and use in your own work.

01 / WHITE PAPERS

FREE DOWNLOADS
Cover of the white paper Secure AI Access to Customer Financial Data
PDF9 pagesSeptember 2026

A reference architecture for identity, AI agents and MCP, APIs, and SOC 2 controls in SaaS platforms.

Customers increasingly expect to ask an AI assistant about their own accounts. This paper shows how to let an external user sign in to a SaaS application and reach their financial data through an AI assistant, without giving the agent more access than the customer has and while leaving evidence an auditor can test.

What's inside

  • How AI changes the threat model: prompt injection, confused deputy, token passthrough
  • Five design principles for user-bound, least-privilege AI access
  • Reference architecture with 16 numbered control points
  • Authentication and delegation flow, from OIDC + PKCE to RFC 8693 token exchange
  • Technical and program controls mapped to SOC 2 criteria with audit evidence
  • Crosswalk to NIST SP 800-53 Rev. 5 and the NIST AI RMF, plus a three-phase roadmap
Download the white paper Read in browser

For security architects, GRC and audit professionals, and technology leaders building AI features on regulated data. Reference design for educational purposes; not legal or audit advice.

Cover of the white paper Federation, Access Control Models, and Identity Standards
PDF17 pagesSeptember 2026

Federation, Access Control Models, and Identity Standards

What federation, RBAC, ABAC, SAML, OAuth 2.0, OpenID Connect, SCIM, and LDAP do, the problems they solve, and how they work together.

A practitioner's guide to the identity layer: who exists, who you are, and what you can do. Each standard is explained in plain terms, with how it works, where it fits, and the security controls that matter most.

What's inside

  • The identity fabric: lifecycle, authentication, and authorization layers
  • Federation patterns, from workforce SSO to B2B and workload federation
  • RBAC vs. ABAC, role explosion, and how to use both together
  • SAML 2.0, OAuth 2.0, OpenID Connect, SCIM 2.0, and LDAP, each with use cases and security considerations
  • Where passkeys and phishing-resistant authentication fit
  • Five use cases: medical devices, healthcare, FinTech open finance, B2B SaaS, and AI agents
Download the white paper Read in browser

For identity and security architects, IAM engineers, GRC and audit professionals, and anyone preparing for identity-focused roles. Educational reference; not legal or audit advice.

Cover of the white paper Building Trust Into the Model
PDF23 pagesOctober 2026

Building Trust Into the Model

Cybersecurity, data privacy, and compliance challenges for AI-driven startups.

When AI is central to the product, customer data flows into training sets, vector stores, prompts, model-provider logs, and agent actions. This paper maps the current U.S. and EU regulatory landscape and shows founders how to build privacy and data protection into the architecture early, so security reviews, investor diligence, and regulator questions become an advantage instead of a setback.

What's inside

  • The October 2026 regulatory landscape: FTC, state privacy laws, California ADMT and audit rules, Colorado, GDPR, and the EU AI Act
  • Fourteen core data privacy and protection challenges, each with what good looks like
  • Training-data lawful basis, deletion rights, and the risk of model deletion
  • OWASP Top 10 for LLM Applications mapped to privacy impact and controls
  • A 10-point reference control architecture and framework alignment (NIST CSF 2.0, AI RMF, SOC 2, ISO 27001/42001)
  • A stage-based roadmap from seed to Series B, key compliance dates, and board questions
Download the white paper Read in browser

Short on time? Download the 6-page founder's brief

For startup founders, CTOs, security and privacy leaders, and investors evaluating AI products. Reflects public information as of October 2026; for educational purposes and not legal advice.

02 / IN THE PIPELINE

More resources on the way.

01CHECKLIST

AI access control checklist

A one-page checklist of the 16 control points from the white paper, ready to use in a design review.

COMING SOON
02GUIDE

NIST AI RMF assessment primer

How to scope and run an AI RMF assessment using the Playbook and the Generative AI Profile.

COMING SOON
03CAREER

Security interview prep kit

Architecture and scenario questions with a framework for structuring strong answers.

COMING SOON

NEED HELP APPLYING IT?

Put these ideas to work.

Security assessments, identity governance, AI governance and SOC 2 readiness support are part of our consulting services.

View consulting