Putting the model behind a firewall is a real control and it is the easiest one to point at. It is also the first of seven layers, and the other six decide most of the outcome.
The environment the system lands in
ENISA's Threat Landscape 2025, published on 1 October 2025, analysed “4875 incidents over a period spanning from 1 July 2024 to 30 June 2025”. It also recorded how quickly the attackers adopted the technology: “By early 2025, AI-supported phishing campaigns reportedly represented more than 80 percent of observed social engineering activity worldwide.”
Juhan Lepassaar, ENISA's executive director, put the structural point in one sentence: “Systems and services that we rely on in our daily lives are intertwined, so a disruption on one end can have a ripple effect across the supply chain.”
An AI assistant is not outside that picture. It is a production system with access to documents and, increasingly, to other systems.
The seven layers
Network. Decide what the system may talk to, in both directions. This is the layer an on-premise deployment genuinely improves, because outbound can be removed rather than filtered.
Identity. Know which human is behind each request. Shared accounts on an assistant destroy every audit trail underneath them.
Authorisation. Know what that human may reach, and enforce it where the documents are retrieved rather than where the answer is written.
Data. Classify what the system is allowed to process, and treat the index and the logs as copies of the source, with the same protection.
Application. Validate what goes in and what comes out. Generated text that becomes a query, a command or an email is untrusted input that happens to read well.
Model. Know which version is running, where it came from and what it is weak at. OWASP's 2025 list puts supply chain at LLM03 and misinformation at LLM09 for this reason.
Operations. Patch it, monitor it, test it and be able to recover it. A system nobody watches is a system nobody defends.
On-premise fixes layer one and helps with part of layer four. It has no opinion at all about layers two, three, five, six and seven.
What local deployment really contributes
It gives the organisation direct control of the inference environment: which model, which version, which network path, which update. That is worth having, and it is worth being precise about, because the alternative is a claim that does not survive the first security review.
It does not replace identity management, endpoint security, application security or governance. The best private AI deployment is not a server with a model on it. It is an ordinary production system that happens to run a model, secured the way production systems are secured.
With Bastion
What Bastion changes
Bastion is a private AI system delivered as one sealed appliance that runs inside your building. One monthly fee covers the hardware, the model, the hardened operating system and support, and nothing your team types leaves the building.
Bastion owns layers one, six and seven for the unit it ships: no outbound connection required, a known model and version, and a signed update path with whole-unit replacement.
Identity, authorisation, data classification and output review belong to the customer's environment. Any supplier who tells you otherwise is selling layer one and calling it seven.
Questions this article answers
- What are the main AI security risks for a company?
- They sit in the application, not the network: prompt injection, disclosure of sensitive information, a compromised supply chain, poisoned data, unvalidated outputs, excessive permissions and a model nobody is monitoring. ENISA also recorded AI-supported phishing at more than 80% of observed social engineering by early 2025.
- Is putting AI behind a firewall enough?
- No. Network control is one of seven layers. Identity, authorisation, data classification, application validation, model provenance and operations decide most of the outcome, and none of them changes because the server moved.
- What does on-premise AI actually improve?
- One layer and part of another: the network, because outbound access can be removed rather than filtered, and the data layer, because the index and logs stay inside. It does not replace identity management, endpoint security or governance.
On the record
- 1
- 2
- 3
Read next
- The OWASP Top 10 for LLM applications, read as a buyer's checklistThe ten risks in plain business language, which of them an on-premise deployment touches, which it does not, and the minimum an organisation of thirty people should actually do about them.Read the article
- Prompt injection: the attack that needs no clickLanguage models do not separate instructions from content, so any text the model reads can behave like a command. What EchoLeak showed, why retrieval makes it worse, and why running the model locally does not fix it.Read the article