AI SaaS Security.

None of these require a sophisticated attacker. A retrieval query that isn't scoped correctly, an evaluation suite that doesn't cover a real failure mode, or cost monitoring that only checks aggregate spend, all create exposure through ordinary gaps, not novel attacks.

The margin erosion risk deserves the same seriousness as the others, even though it doesn't look like a security problem at first glance. A tenant whose usage pattern turns unprofitable isn't a data breach, but left unmonitored for a full billing cycle it can do comparable damage to the business. It's caught by the same discipline: per-tenant instrumentation from day one, rather than a retrofit once the finance team asks why margin slipped.

• Cross-tenant data leakage: retrieval or context construction that isn't strictly scoped per tenant, especially in shared vector stores or caching layers.
• Prompt injection within a tenant: user-supplied or retrieved content manipulating model behavior within that tenant's own session.
• Margin erosion: usage growth eroding gross margin silently because cost isn't attributed and monitored per tenant.
• Provider dependency risk: a single upstream model provider outage or behavior change taking down the product with no fallback.
• Context window bleed: caching or batching optimizations that concatenate multiple tenants' context into a single model call to save cost, a common performance shortcut that reintroduces cross-tenant exposure.
• Silent quality drift: an upstream model version change or a prompt edit degrading output for a specific customer segment without triggering any alert, since nothing failed loudly enough to notice.

• Tenant isolation enforced at the database layer, tested directly with adversarial cross-tenant queries, not assumed from application code alone.
• All retrieved and user-supplied content treated as untrusted input when constructing model context.
• Per-tenant and per-feature cost attribution visible in dashboards from launch, with cost regression testing on every change.
• Model abstraction with fallback routing so a single provider's outage or degradation doesn't take down the whole product.
• Adversarial evaluation cases specifically targeting injection and cross-tenant leakage, run in CI alongside standard quality cases, not treated as a separate one-off security exercise.

• How is tenant isolation tested, and can you show adversarial cross-tenant test results?
• How is cost attributed per tenant, and how quickly would margin erosion be caught?
• What happens if the primary model provider has an outage?
• What happens when a batching or caching optimization is proposed? Is cross-tenant exposure re-tested before it ships?

See our AI SaaS development guide for how these controls fit into the full product architecture.