NIST publishes the final Cyber AI Profile for managing AI security risk

The Cyber AI Profile is NIST guidance that helps organizations manage cybersecurity risk tied to artificial intelligence systems and identifies ways to use AI to strengthen cyber defense. NIST published the completed profile on October 6, 2026, after releasing the preliminary draft version on December 16, 2025.

What it is

The profile organizes its guidance into three focus areas covering AI system security, AI-enabled defense and resistance to AI-enabled attacks. It builds on the existing voluntary NIST Cybersecurity Framework rather than creating a separate standard. Its outcomes are organized across the six functions already used by that framework.

What it requires

The profile assigns each subcategory a tier so organizations can decide where to focus first. NIST frames the guidance around chief information security officers, who are meant to use it to find and rank AI-related vulnerabilities. The profile also points to AI tooling that can ease the volume of alerts security teams must review. It flags that generative AI behaves differently from conventional software, which changes how it must be monitored.

What security leaders should do

Security leaders already using the NIST Cybersecurity Framework can map current controls to the Cyber AI Profile's focus areas rather than building a parallel program from scratch. Teams should use the High, Moderate and Foundational priority tiers to sequence which AI-specific outcomes to tackle first instead of treating every recommendation as equally urgent. Because generative AI systems can drift in behavior after deployment, security leaders should extend existing monitoring and incident-response playbooks to cover model performance changes, not just conventional intrusions. Finally, CISOs should evaluate where AI tooling can realistically reduce alert volume for their own teams, while keeping human oversight over any AI-driven triage or response decisions.