What are the biggest mistakes with security in AI Model Security?

I have been exploring AI Model Security and wanted to ask people who have tried it in practice.

I am particularly interested in security and prompt design. I would like to compare approaches that people have actually used rather than just theoretical suggestions.

Are there any settings, tools, or workflow changes that made a noticeable difference?