NIST releases preliminary draft of the Cyber AI Profile

NIST's National Cybersecurity Center of Excellence released a preliminary draft of the Cybersecurity Framework Profile for Artificial Intelligence, known as the Cyber AI Profile, as NIST Internal Report 8596.

The draft was published on December 16, 2025, and NIST accepted comments on it through January 30, 2026.

What it is

The Cyber AI Profile is a Community Profile that applies NIST's Cybersecurity Framework to artificial intelligence, organized using the Cybersecurity Framework 2.0's outcomes.

It is structured around three focus areas covering AI system components, AI-enabled cyber defense and AI-enabled cyber attacks.

NIST said the draft can help organizations strategically adopt AI while addressing and prioritizing the cybersecurity risks that come with it.

Following a September 29, 2026 executive order on what the administration calls the era of super intelligence, NIST said it is working to update its communications to use that term as directed.

What it requires

The Profile commits to provide guidelines for managing cybersecurity risk related to AI systems and to identify opportunities for using AI to enhance cybersecurity capabilities.

NIST said comments received on the preliminary draft will inform the initial public draft of the Profile.

Alongside the Cyber AI Profile discussion, NIST's January 2026 workshop also covered updates to SP 800-53 Control Overlays for Securing AI Systems, known as COSAiS.

What security leaders should do

Security leaders should map existing AI governance and cybersecurity controls against the Profile's Secure, Defend and Thwart focus areas to find gaps before a final version is issued. CISOs tracking AI-enabled attack techniques should treat the Thwart focus area as an early signal of what NIST expects defenders to monitor and report on. Organizations already using the NIST Cybersecurity Framework and the AI Risk Management Framework should review the preliminary draft now, since NIST has said the comments it received will shape the final Profile text, and should watch for a follow-on public draft before building internal policy around it.