AI security in 2026 is not a separate replacement for cybersecurity. It extends familiar duties—protecting confidentiality, integrity and availability—to AI models, their data, the software and hardware beneath them, and any tools or decisions they can influence. Business leaders should keep core security controls in place while setting AI-specific boundaries for access, autonomy, testing and accountability.
What changes when AI becomes part of the attack surface?
AI brings new components and paths into systems that organizations already need to secure. Depending on the use case, those may include training and test data, model weights, configuration settings, prompts and outputs, connected business tools, and the underlying infrastructure. NIST frames AI security around the familiar goals of confidentiality, integrity and availability, while also recognizing AI-specific attack types and attack surfaces. It also notes AI’s dual-use potential: AI may help defenders address vulnerabilities, while enhancing attackers’ capabilities against information technology and operational technology. NIST’s security and resilience overview does not imply that every incident involving AI is AI-enabled.
As an Amazon Associate I earn from qualifying purchases.
For leaders, the practical question is not simply whether an organization uses AI. It is what each system can access, what could be altered or exposed, and what happens if the system is manipulated, unavailable or wrong. A public-facing assistant, a predictive model embedded in a process, and an agent that can take actions on a user’s behalf have different boundaries and consequences.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which security controls still matter?
AI does not remove the need for ordinary software and information-system security. Asset inventory, identity and access management, secure development, data protection, monitoring, patching and incident response remain the foundation. Apply them to AI components and the systems around them, then add threat modeling that accounts for how AI-specific attacks could affect the organization.
#1 Best Overall
- Confidentiality: Limit access to sensitive input, training and output data, model weights, and configuration. Consider whether information could be exposed through system access or an AI-specific attack such as membership inference or model extraction.
- Integrity: Protect data, model components and settings from unauthorized change. Assess whether evasion or other manipulation could cause an AI system to produce an unreliable result or affect a downstream process.
- Availability: Include the AI service and its dependencies in resilience planning. Consider how an interruption to the model, its data or supporting software and hardware would affect the business.
- Detection and response: Monitor relevant systems and define how staff will investigate suspected AI-related incidents. Test whether existing detection and response processes can identify and handle the cases that matter to the organization.
These are risk questions, not a universal checklist of attacks every business will face. Their priority depends on the system, the data involved, its access and autonomy, and the impact of failure.
How should leaders distinguish AI system risks?
NIST’s COSAiS project spans generative AI assistants and large language models, predictive AI, single- and multi-agent systems, and AI developers. Its framing supports assessing a system by its components and role rather than treating all AI as one category. The table below is an editorial way to apply that framing, not a formal NIST scoring rubric.
Rank #2
| System type | Assets and boundaries to examine | Leadership control question |
|---|---|---|
| LLM assistant | Input and output data, model, configuration, connected software | What information can users provide, and what can the assistant retrieve or reveal? |
| Predictive AI | Training and test data, model weights, configuration, underlying systems | How could altered inputs, data or model behavior affect the decision or process that uses its output? |
| Single agent | Data and tools available to the agent, configuration, actions it can take | Which actions require human approval, and how are permissions limited? |
| Multi-agent system | Shared data, agent interactions, tool access and coordination settings | How are access and accountability controlled across agents and their interactions? |
| AI development pipeline | Training and test data, model weights, configuration, software and hardware | Who can change or access components, and how are changes protected and monitored? |
For assistants and agents in particular, map the full path from user input to data retrieval, tool use and resulting action. Restrict permissions to what the task requires, separate consequential actions from recommendations, and decide where a person must review or approve an action. The more systems and sensitive data an AI can reach—and the more it can do without approval—the more important those boundaries become.
What do 2026 survey findings show—and what do they not show?
The SANS Institute’s July 2026 report draws on responses from 536 security practitioners and 57 senior security leaders globally. Its percentages describe survey responses, not audited population statistics or the experience of every business. Within that context, the findings point to rising use alongside gaps in operational readiness:
- Use is widespread among surveyed security teams: SANS reported that 78% actively used AI in cybersecurity, up from 50% in 2025. Only 27% of practitioners described deployments as mature production.
- Reported attacks and perceived attacker use are different measures: 78% of organizations reported confirmed or suspected AI-enabled attacks, while 95% of respondents believed threat actors were already using AI. The first is a reported organizational experience; the second is respondents’ belief, not verification of specific incidents.
- Detection and response remain a concern: 63% of practitioners reported significant AI shortcomings in threat detection and response.
- Governance is part of security work: 76% of security teams said they held a governance role for enterprise AI. The report also describes a 14-point gap in perceptions of whether a formal AI risk management program exists: 50% of senior leaders versus 36% of practitioners.
- Skills needs are changing: 73% of practitioners said AI changed their team’s training requirements in 2026, and 61% used AI in red-team work.
Together, these findings suggest that adoption alone is a poor proxy for readiness. They do not establish how common any finding is outside the respondents, whether a particular organization has the same gaps, or which product or training provider will address them. The SANS report is useful as a view of practitioner and leader responses, not as a forecast of an individual company’s exposure.
How should governance, training and incident response connect?
AI oversight works best when it connects business ownership with the people responsible for security, technology, data and operations. The SANS governance-role and perception-gap findings make internal clarity especially important: leaders and practitioners should be able to identify which AI uses exist, who approves them, and who owns risk decisions and incident handling.
- Inventory AI uses and assign owners. Record the system type, business purpose, data involved, connected tools, access level and degree of autonomy. Name a business owner and the teams responsible for security and technical operation.
- Set boundaries before expanding access. Define what information a system may handle, which tools it may use, what actions need approval and what uses are out of scope. Match access to the task rather than granting broad permissions by default.
- Threat-model and test the actual workflow. Consider confidentiality, integrity and availability, plus relevant AI-specific concerns such as evasion, model extraction and membership inference. Validate detection and response in the organization’s own environment instead of assuming AI-assisted security will work as intended.
- Train people for the systems they use. Update role-specific training as AI changes workflows. Staff should understand how to handle sensitive data, recognize when outputs or actions need review, and report suspected manipulation or exposure.
- Include AI in response planning. Decide how teams will investigate an incident involving a model, its data, settings or connected tools; who can restrict access or stop actions; and how business operations will continue if an AI service becomes unavailable.
These steps are a leadership approach to applying established security principles and the cited guidance, not a claim that one process fits every organization. Scale oversight to the system’s access, autonomy and potential impact.
Which standards and guidance are established, and which are evolving?
Leaders should distinguish published frameworks from projects, drafts and workshop discussions. The cited NIST material provides useful direction, but the project pages and discussion materials do not turn proposed overlays into finalized requirements.
- NIST AI Risk Management Framework (AI RMF): NIST’s page says AI RMF 1.0 is being revised as part of the White House AI Action Plan. It also records an April 7, 2026 concept note for a trustworthy AI profile in critical infrastructure. The framework is guidance, not itself a law, and this page does not resolve every jurisdiction- or sector-specific legal duty. See NIST’s AI RMF page.
- NIST COSAiS: The project is developing implementation-focused overlays spanning several AI system types. Its materials describe use cases and a predictive-AI discussion draft updated January 8, 2026; the project says the overlays will use SP 800-53 and leverage SP 800-218A, draft AI 800-1 and AI 100-2e2025. These are evolving project materials, not blanket binding requirements. See the COSAiS project page.
- NIST Cyber AI Profile workshop summary: The report, published August 3, 2026, summarizes a January 2026 workshop. Its themes include governance challenges, attack surfaces, consistent AI taxonomy, usable risk guidance and AI-enabled cyber defense. These are participant discussion themes, not measurements of how prevalent a risk is. Read the workshop summary.
NIST describes AI security as an extension of established information-system security concerns, with additional AI-specific considerations. That makes existing security practice a starting point—not a reason to assume the risks are fully covered. For legal obligations, organizations still need to check requirements applicable to their jurisdictions and sectors.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
