Evolving Standards for Cybersecurity Defense

The National Institute of Standards and Technology (NIST) has released a draft of its “Cybersecurity Framework Profile for Artificial Intelligence” (open for public comment until Jan 30, 2026) to help organizations think about how to strategically adopt AI while addressing emerging cybersecurity risks that stem from AI’s rapid advance. Building on the #NIST Cybersecurity Framework 2.0, the Cyber AI Profile translates well-established risk management concepts into AI-specific cybersecurity considerations, offering a practical reference point as organizations integrate AI into critical systems and confront AI-enabled threats. The Cyber AI Profile centers on three focus areas: • Securing AI systems: identifying cybersecurity challenges when integrating AI into organizational ecosystems and infrastructure. • Conducting AI-enabled cyber defense: identifying opportunities to use AI to enhance cybersecurity, and understanding challenges when leveraging AI to support defensive operations. • Thwarting AI-enabled cyberattacks: building resilience to protect against new AI-enabled threats. The Profile complements existing NIST frameworks (CSF, AI RMF, RMF) by prioritizing AI-specific cybersecurity outcomes rather than creating a standalone regime.

Today, NIST released the initial preliminary draft of the Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), a community profile built on NIST CSF 2.0 to help organizations manage cybersecurity risk in an AI-driven world. A key section of this draft is Section 2.1, which introduces three Focus Areas that explain how AI and cybersecurity intersect in practice: 1. Securing AI System Components (Secure) AI systems introduce new assets that must be secured; models, training data, prompts, agents, pipelines, and deployment environments. This focus area emphasizes treating AI components as first-class cybersecurity assets, integrating them into governance, risk assessments, protection controls, and monitoring processes. It reinforces that AI risk should not be siloed from enterprise cybersecurity risk management. 2. Conducting AI-Enabled Cyber Defense (Defend) AI is not just something to protect, it is also a powerful defensive capability. This area focuses on using AI to enhance detection, analytics, automation, and response across security operations. At the same time, it recognizes the risks of over-reliance on automation, model integrity concerns, and the need for human oversight when AI supports security decision-making. 3. Thwarting AI-Enabled Cyber Attacks (Thwart) Adversaries are increasingly using AI to scale phishing, evade detection, and automate attacks. This focus area addresses how organizations must anticipate and counter AI-enabled threats by building resilience, improving detection of AI-driven attack patterns, and preparing for a rapidly evolving threat landscape where AI is weaponized. Why This Matters Together, Secure, Defend, and Thwart provide a practical structure for aligning AI initiatives with existing cybersecurity programs. By mapping AI-specific considerations to CSF 2.0 outcomes (Govern, Identify, Protect, Detect, Respond, Recover), the Cyber AI Profile helps organizations integrate AI security into familiar risk management practices. This is a preliminary draft, and NIST is seeking public feedback through January 30, 2026. If your organization is building, deploying, or defending with AI, now is the time to review and contribute. 🔗 https://lnkd.in/e-ETZXH8

Cybersecurity is dead. Prevention alone won’t save us anymore. It sounds bold, but here’s why it’s true: For too long, we’ve relied on traditional methods—firewalls, antivirus, perimeter security. But these outdated approaches are no match for today’s sophisticated cyber threats. The reality? • Outdated Paradigms – Legacy systems can’t keep up with zero-day attacks or advanced social engineering tactics. • Evolving Threats – Attackers are more targeted and innovative, bypassing basic detection-based defenses. • Resource Drain – Maintaining outdated solutions eats up resources that could be invested in forward-thinking strategies. • Focus on Perimeter Only – By concentrating on perimeter defenses, we miss internal threats where real damage can occur. So, what’s next? → Proactive Security – We need strategies that predict and prevent attacks, like UEBA, which uses AI to catch anomalies before they become breaches. → Holistic Defense – True cybersecurity is layered and comprehensive, integrating people, processes, and technology. → Continuous Adaptation – Cybersecurity isn’t “set it and forget it.” It demands regular assessments and adaptability as new threats emerge. The takeaway? Traditional cybersecurity is no longer enough. It’s time to move beyond prevention alone and embrace a more resilient, proactive approach. Cyber threats are evolving—our defenses need to evolve, too. 🔒

Great news for the cybersecurity community! MITRE has just released ATT&CK v16. The October 2024 release brings significant updates to Techniques, Groups, Campaigns, and Software within the Enterprise framework. Key Highlights: 🔄 Cloud Platforms Realigned • New Platforms Introduced: The Azure AD, Office 365, and Google Workspace platforms have been replaced with the new Identity Provider and Office Suite platforms. • Why This Matters: This realignment better reflects real-world adversary activities, providing a more intuitive and actionable framework for defenders across diverse cloud environments. 🛡️ Expanded Detection Engineering • More Analytics Added: Over 85 new analytics under Execution, 120 under Credential Access, and 26 new Cloud analytics have been introduced. • Optimized Pseudocode Format: The analytics now use an optimized pseudocode format, serving as templates for tailored queries to enhance your detection strategies. 🚀 New and Updated Techniques • Familiar Behaviors Now Included: Techniques like Adversary-in-the-Middle: Evil Twin and Data from Information Repositories: Customer Relationship Management Software cover behaviors that were previously uncaptured. • Novel Adversary Behaviors: New techniques such as Resource Hijacking: Cloud Service Hijacking and Modify Cloud Resource Hierarchy highlight sophisticated methods adversaries use to exploit cloud environments. 🔒 Enhanced Mitigations • New Mitigation Added: Out of Band Communication focuses on maintaining secure, alternative communication channels during incidents. • Improved Existing Mitigations: Updates to Active Directory Configuration provide clearer examples and detailed interpretations to help defenders implement them effectively. 🕵️ Cyber Threat Intelligence Updates • Closing Gaps in Cybercrime Representation: New entries for ransomware groups like Inc Ransom and Play provide valuable insights into advanced tactics targeting high-value victims. • State-Attributed Groups Updated: Enhancements to groups linked to state actors offer a more comprehensive understanding of their behaviors and techniques. For a detailed overview of all the updates and additions, check out the release notes and detailed changelog on the MITRE ATT&CK links on the comments section. #MITREATTACK #ATTACKv16 #Cybersecurity #ThreatIntelligence #CyberDefense #CloudSecurity #DetectionEngineering #ThreatHunting #Infosec #SecurityUpdates #CyberThreats #SecurityInnovation #CloudPlatforms #DefensiveStrategies #Ransomware #CTI

Cyber threats are evolving at a staggering pace and there's much to learn from the largest attacks of 2024. Are we truly prepared for what’s next? While we’ve seen tremendous progress in digital security, the sophistication and speed of new threats continue to challenge us. Here's a starter list of what we should expect and how we can prepare. 🔐 AI-Powered Threats AI's role in cybersecurity extends beyond defense, with malicious actors leveraging it to automate and amplify attacks. From deepfake-based social engineering to AI-driven malware, organizations will need to develop defense mechanisms that can detect and neutralize these new forms of threats before they strike. 🤝 The Expanding Role of Ethical Hackers Ethical hackers will continue to collaborate with internal security teams, shaping the landscape of vulnerability management. Bug bounty programs will transition into mainstream tools for preemptive threat mitigation, integrating ethical hackers into organizations' cybersecurity strategies. 💡 Automation and Augmented Security The growing cybersecurity talent gap, estimated at 4-4.8 million workers globally today, makes it clear that automation will play an increasingly pivotal role. From AI-driven threat detection to automated patching systems, organizations will adopt new technologies that augment human expertise, empowering teams to respond faster and more efficiently to emerging risks. 🛡️ Zero Trust Becomes Standard Traditional security paradigms are giving way to Zero Trust architectures as foundational security models. Organizations must swiftly adopt Zero Trust principles, revamping their security frameworks to eliminate default trust for users and devices, irrespective of their location. 🔄 Supply Chain Security As seen in recent high-profile breaches, attacks on the supply chain will continue to be a significant threat. Organizations will be forced to rethink how they assess and manage third-party risks, implementing more rigorous security protocols and vetting processes for vendors, contractors, and partners. These trends will redefine organizational cybersecurity strategies in 2025, emphasizing the importance of staying vigilant and proactive in the face of evolving threats.   Which cybersecurity trends are on your radar for the upcoming year? #CyberSecurityTrends #AIinSecurity #ZeroTrust #EthicalHacking #SupplyChainSecurity #CyberResilience #SecurityCulture

NIST Updates Cyber Incident Response Guidance for First Time in Over Decade ⤵️ National Institute of Standards and Technology (NIST) recently released Revision 3 of SP 800-61, its long-standing guidance on responding to #cyber incidents. Why should lawyers, insurers, and cybersecurity teams take note? Because this update reflects how today’s incidents are more likely to unfold—and how businesses, regulators, and the law increasingly expect them to be responded to. What’s new 🆕 : 📈 An enterprise-wide strategy: #Incidentresponse is now framed as a business-wide function—integrated into broader governance and #riskmanagement. 📚 Continuous learning over static steps: The traditional linear model of incident response steps has been replaced. The new approach emphasizes continuous learning and adaptation throughout the process, so organizations improve in real time—not just after the fact. 🌍 “Real-world” application: NIST includes a practical profile to help organizations of any size or industry implement the guidance in context. For legal teams: it may shift the standard of care in breach litigation and regulatory scrutiny. For insurers: it reframes what constitutes a “reasonable” response. For cybersecurity teams: it’s a more modern resilience playbook. Read the full document by clicking on the link in the comments:

NEW: The Verizon DBIR signals a structural shift in the threat landscape: initial access has pivoted from identity-centric vectors (credential stuffing, phishing) toward unauthenticated exploit chains targeting unpatched perimeter, edge, and 3rd-party assets. This aligns with collapsing time-to-exploit metrics and a 50% increase in critical vulnerabilities. Enterprises averaging 43 days for critical remediation are effectively operating with extended windows of exposure, particularly as AI lowers the barrier for weaponizing both known CVEs and novel zero-days. For cysec leaders, this demands a move beyond scheduled patching to risk-prioritized, continuous vulnerability management integrated w/ real-time threat intelligence. Defense-in-depth remains essential: while initial access favors exploits, lateral movement and data exfiltration still heavily rely on compromised identities. More least-privilege enforcement & identity threat detection, please! Orgs ignoring this shift risk breaches via automated exploit tooling, especially in supply-chain-heavy environments where 48% of incidents now originate. Proactive investment in attack surface management, automated remediation workflows, and breach containment will separate resilient postures from reactive ones in 2026. GM

CPS security is now being treated as a national resilience issue, not a technical one. When an IT system fails, you lose data. When a CPS system fails, you lose operations, revenue, safety, and in some sectors, human life. That distinction is finally shaping policy. Across regions and industries, new rules are converging around a shared reality: A few examples: ↳ NIS2 (EU) Expands cybersecurity obligations to industries that operate physical-world systems: transport, healthcare, energy, manufacturing, water, and more. Boards are now personally accountable for CPS risk. ↳ FDA 21 CFR (Healthcare) Mandates software bill of materials (SBOM), vulnerability management, and lifecycle monitoring for connected medical devices treating them as safety-critical. ↳ TSA Pipeline & Rail Directives (US) Requires operators of physical infrastructure to implement continuous monitoring, segmentation, and incident response for CPS environments. ↳ IEC 62443 (Global Standard) Increasingly required by regulators, insurance providers, and large industrial OEMs. The standard recognizes that CPS risk is a function of configuration, exposure, and physical consequence not IT-style vulnerability counts. ↳ Sector-Specific Rules (Energy, Pharma, Utilities) Each new framework shares the same message: Organizations must prove that they understand their CPS risk and can reduce it. Three structural changes are increasing urgency: 1. CPS Attacks Have Real-World Consequences Power outages, halted manufacturing lines, delayed patient care, and compromised transportation systems. You cannot “restore from backup” when factories or hospitals go offline. 2. Global Supply Chains Depend on CPS Compromised PLC can stall a pharmaceutical plant, and vulnerable sensor can shut down logistics operations. Regulators now see CPS security as an economic stability issue. 3. Air-Gapped Systems No Longer Exist Even industries that believe they are isolated now rely on: Cloud analytics, remote maintenance, IoT sensors, vendor access and wireless mesh networks. The boundaries have dissolved. Regulators are effectively asking: → What CPS assets do you have? → How are they connected? → How do you mitigate without disrupting operations? → Can you demonstrate risk reduction over time? These are safety engineering, operations management, and national resilience questions. And they are now mandatory. CPS protection can no longer sit on the sidelines of cybersecurity strategy. It requires: → unified asset intelligence → vulnerability and risk scoring tailored to CPS → environmental context → governance models that bridge IT, OT, IoT, and safety teams Regulators are responding to a world where the systems we defend are no longer digital abstractions, they are physical dependencies that keep economies running. CPS security is becoming one of the defining resilience challenges of the next decade.

The next cybersecurity challenge may not be securing AI. It may be detecting AI. Sharing a fascinating report from the Institute for AI Policy and Strategy (IAPS) on Detecting Autonomous Cyber Threats, published May 19, 2026. See: https://lnkd.in/gKwfUazG Central argument: As AI agents become capable of conducting complex cyber operations with minimal human involvement, traditional detection approaches may become increasingly ineffective. Autonomous agents can operate at machine speed, scale attacks across thousands of targets, dynamically adapt tactics, and coordinate activities across multiple platforms and models. The result is a fundamentally different threat landscape. The authors argue that while we often focus on prevention, guardrails, and secure development, DETECTION should become the priority. The report proposes a framework called Detection-in-Depth, built around 3 functions: 1 Discovery – generating new signals that make agent activity visible 2 Analysis – interpreting those signals to identify malicious behavior 3 Coordination – sharing intelligence across organizations Proposed architecture: -Agent Identity (Agent IDs) Persistent, cryptographically verifiable identities for AI agents interacting with critical infrastructure, adding provenance, accountability, and telemetry to agent activity. -AI-Powered SOC Operations Using AI to automate alert triage, investigation, and prioritization as attack volumes exceed human capacity. -Agent Honeypots Next-generation deception environments designed specifically to attract, analyze, and fingerprint autonomous attackers. -Agent Security Alert Standards Common reporting formats for AI-enabled attacks, including model information, attack methodologies, behavioral indicators, and tactics. -Agentic Cybersecurity Exchange (ACE) A proposed global information-sharing organization that would aggregate telemetry from AI providers, cloud platforms, and defenders to identify coordinated agentic campaigns. The report's 12 recommendations focus on creating interoperable Agent ID standards, incentivizing adoption across critical infrastructure, accelerating AI-assisted SOC capabilities, funding autonomous-attack honeypot research, standardizing threat reporting, and building an ecosystem-wide intelligence-sharing capability. For those of us working in AI governance, security, and assurance, the broader implication is significant: We're moving beyond securing individual models and applications. The emerging challenge is building an operational trust and detection layer for autonomous systems. Whether we call it an Agent Security Fabric, Agent Trust Infrastructure, AI Governance Control Plane, or Agent Detection Network, the underlying need is the same: We need visibility into what autonomous agents are doing, who is operating them, how they interact across ecosystems, and when they cross the line from automation to adversarial behavior.

🎉 TIC 3.0: Keeping Pace with the Future 🌐 Last week, #CISA —America’s Cyber Defense Agency— released an updated Security Capabilities Catalog (SCC) for OMB's Trusted Internet Connections (TIC) Initiative. This update aligns with the NIST Cybersecurity Framework (CSF) Version 2.0, which was updated earlier this year, ensuring the TIC guidance stays relevant to evolving cybersecurity frameworks. The SCC helps agencies safeguard their IT ecosystems across cloud, mobile, and on-premises environments. It provides guidance to address unique mission requirements while supporting modern technologies like Secure Access Service Edge (SASE). 🔑 Why This TIC Update Matters: 💥Aligning the SCC with NIST CSF v2.0 strengthens interoperability and consistency across frameworks. 💥The SCC now integrates "Govern" as a security objective, complementing the five existing objectives (Identify, Protect, Detect, Respond, Recover). 💥These updates enable agencies to secure their architectures while supporting broader cybersecurity principles. Having been closely associated with the TIC Initiative since its inception in the mid-2000s under Karen S. Evans's leadership, I’ve witnessed the evolution of federal cybersecurity firsthand. What began as an effort to consolidate federal networks—reducing the attack surface, fostering a baseline set of cyber capabilities, and providing panoramic visibility across the federal perimeter for NPPD (now CISA)—has evolved into a cornerstone of modern cybersecurity strategies. Collaborating with so many dedicated professionals over the years was an honor as we redefined the architectural framework for how CIOs and CISOs protect their digital assets. With TIC 3.0, OMB, CISA, GSA, and federal agencies have moved beyond traditional perimeter security, adopting dynamic capabilities that meet the diverse needs of today’s federal cloud and mobile environments and align with Zero Trust principles. Organizations transitioning to SASE platforms are ideally positioned to meet evolving architectural frameworks like TIC while enhancing security and enabling agility. 📄 You can find the updated catalog attached and a link to CISA's TIC website in the comments. #cybersecurity #TIC3 #technology #zscaler #SASE #innovation #informationsecurity