Securing an AI app's adoption,end to end.

This is the methodology run end to end on a real app. We take an AI product that is already adopting AI, find where that adoption is exposed, fit one skill to the defense the team already built, and measure the difference. No new vendor tool. We improve what is already there and show the lift.

This demonstrates the method is executable and measurable on one live app. It is not enterprise proof — that needs your pilot.

Diagnose.

The target is binu8/storybond-prod — a Next.js + OpenAI (gpt-4o-mini) children’s-storybook generator. Parents type a child's name, age, and interests; those values are interpolated straight into the model's prompt. That is the injection surface, and the app handles children’s names, ages, interests, family members, so a successful injection is a child-safety and privacy event, not a curiosity.

Crucially, the team is not naive — they already ship layered defenses:

So the real question is never “are they exposed?” It is how well does the defense they already built actually hold — and that is a number, not an opinion.

Before the fit.

We ran a labelled corpus of 15 prompt-injection attacks (the kind a parent could slip into a name or story field) plus 11benign requests through the team's own detectJailbreak. It caught 8 of 15 (53%), with zero false positives. Respectable — and it misses seven whole classes of attack:

And the off-the-shelf skill alone? In its model-free modes it caught 2–0 of 15— worse than the client's own code. The skill is not the value. The fit is.

The fit.

We do not replace detectJailbreak. We extend it — keeping every line the team wrote and adding general techniques that close the seven missed classes without raising false positives. Each move is a method, not a string tuned to the test set:

After the fit.

Same corpus, same harness. The fitted guard catches 15/15 (100%) — all seven gap-classes closed — and still 0/11 false positives, including 5hard-benign stress prompts (“Leo forgets his lunch”, “ignore mean words from bullies”) built to trip it.

The held-out column is the credibility test: 5/5 unseen attack variants caught — so the fit generalizes across the attack classes, it was not taught the test.

From a fix to a governed control.

A one-off guard improvement is a tactic. A Center of Excellence makes it a governed, repeatable control — mapped to a recognised framework, attested, and advanced along a maturity ladder. Here is this one fit threaded down through the control spine. Not a coverage scorecard across eighteen domains — the single control, taken all the way down.

The control-objective ID, the AI Consensus Assessments Initiative Questionnaire (AI-CAIQ) attestation, and the AI Security Maturity Model (AISMM) target level aren't authored for this skill yet — shown as mapping in progress, never invented. Authoring them is the Center of Excellence's next governed step on this control. That loop — diagnose → fit → measure → map → attest → mature, then repeat on the next control objective — is the Center of Excellence. The single fix is just where it starts.

Why this is the whole point.

The deliverable was never a giant skill catalogue or a playground to explore. It was one plain sentence a CISO can act on: your existing guard went from 53% to 100% against real attacks, with no new false positives and no new vendor. That is a capability you now own — fitted to your stack, ready to mature up the AISMM ladder as the first brick of your own AI-Security CoE.

This is the guard-level live scan — the detection runs hosted, server-side, so it works from any browser. One honest qualifier: the 53% → 100% measures the guard specifically — whether an attack is caught before it reaches the model. Firing the same corpus at the staging clone's running model showed the app stacks two more layers the guard never sees: OpenAI content moderation (which blocked the one unsafe prompt) and the model's own framing-resistance (it returned ordinary story responses for the rest rather than leaking its instructions). So the fitted guard is pre-flight defense-in-depth — it stops recognised attacks cheaply and backstops what the model would miss — not the sole barrier. A precise per-mode endpoint breakdown is the deferred measured pass.

Methodology: the corpus, the ported baseline guard, the fitted guard, and the scan harness live in tools/storybond_demo/.

Show your work.

How each repo instrument or skill actually touched the live app, and which rung it moved.

End of case study.