CISA M365
Implements CISA BOD 25-01 security controls for Microsoft 365 (Azure AD/Entra ID).
cloud-infra
0Tools
2Findings
Mar 24, 2026Last Scanned
⚠1 medium · 1 low findings detected
⚡Prompt Injection
Prompt & context manipulation attacks
PI-DIRDirect Input Injection
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
PI-INDIndirect / Gateway Injection
Hidden instructions via external content and tool responses
PI-CTXContext Manipulation
Context window saturation and prior-approval exploitation
PI-ENCEncoding & Obfuscation
Payload hiding via invisible chars, base64, schema fields
PI-TPLTemplate & Output Poisoning
Injection via prompt templates and runtime tool output