A security control is any safeguard that reduces cyber risk. Controls can be preventive, like access rules and approval workflows; detective, like logging and monitoring; or corrective, like blocking a session or revoking credentials. In practice, controls are the mechanisms that turn policy into action.
Security controls matter because attackers usually succeed by finding gaps in them: weak permissions, missing review steps, blind spots in logs, or poorly monitored integrations. Defenders use controls to limit who can access data, what actions systems can take, and how quickly suspicious behavior is detected and contained. In AI environments, controls are especially important for governing prompts, outputs, plugins, and autonomous agents, where the boundary between approved use and unsafe behavior can blur.