Open Cybersecurity AI Frameworks: New Challenges, Opportunities & Impact
Why Old Approaches Fail: How Human Experts Should Shift from Hands-On Work to AI-Orchestration
MAESTRO (Multi-Agent Environment, Security, Threat, Risk, and Outcome), a new threat modeling framework tailored for Agentic AI systems. Traditional frameworks like STRIDE, PASTA, LINDDUN, OCTAVE, Trike, and VAST have limitations in addressing the unique challenges posed by AI agents, such as adversarial attacks, data poisoning, and unpredictable autonomous behaviors. These frameworks often lack specific guidance on AI-related vulnerabilities and fail to account for interactions between multiple AI agents.
MAESTRO addresses these gaps with a layered approach, focusing on seven distinct architectural layers of Agentic AI systems — from foundational models to the agent ecosystem — and identifying threats specific to each layer. It emphasizes security categories extended for AI, multi-agent dynamics, layered defenses, AI-specific threats, risk prioritization, and continuous adaptation. The framework also considers cross-layer threats, such as supply chain attacks or lateral movement across layers, which traditional models often overlook.
Each layer in MAESTRO has its own threat landscape. For example, Foundation Models face risks like adversarial examples and model stealing, while the Agent Ecosystem must contend with compromised agents, identity attacks, and marketplace manipulation. Mitigation strategies include layer-specific controls, defense-in-depth tactics, secure inter-layer communication, and AI-focused techniques like adversarial training and explainable AI (XAI). The framework provides actionable steps for system decomposition, threat identification, risk assessment, mitigation planning, and ongoing monitoring.
Additionally, MAESTRO outlines common agentic architecture patterns — such as Single-Agent, Multi-Agent, Task-Oriented, and Self-Learning Agent systems — and details their associated risks and mitigations. It underscores the need for a holistic, iterative approach to securing Agentic AI, combining traditional cybersecurity practices with AI-specific measures to ensure robust, safe, and trustworthy systems.
The rapid advancement of frontier AI necessitates a targeted transparency framework to ensure public safety and corporate accountability, particularly for the largest AI developers whose systems pose significant risks due to their scale and capabilities. This framework proposes minimum standards such as limiting application to high-threshold developers, requiring publicly disclosed Secure Development Frameworks that outline risk mitigation strategies (including catastrophic harms like bioweapons or autonomous misalignment), publishing system cards summarizing testing and mitigations, protecting whistleblowers by criminalizing false compliance claims, and maintaining flexibility to evolve with emerging best practices. By promoting transparency without stifling innovation, the framework aims to establish baseline accountability, enable informed public and policymaker oversight, and prevent potentially progress-halting AI-related disasters while allowing responsible development and societal benefits to flourish.
The proposed Frontier Model Transparency Framework outlines a targeted regulatory approach focused on the largest AI developers, requiring them to implement and publicly disclose Secure Development Frameworks (SDFs) that detail how they assess and mitigate catastrophic risks — such as chemical, biological, radiological, nuclear (CBRN) threats and autonomous model misalignment — before deploying frontier AI models. The framework applies only to companies exceeding specific thresholds in computing power, cost, performance, and revenue, exempting smaller firms to avoid stifling innovation. Covered companies must publish system cards at deployment, detailing testing results and mitigations, while allowing limited redactions for sensitive information; enforcement includes penalties for false claims, a 30-day cure period for violations, and whistleblower protections to ensure accountability and transparency without impeding AI progress.
The cybersecurity landscape is undergoing a dramatic transformation as AI becomes increasingly integrated into security operations. We predict that by 2028, AI-powered security testing tools will outnumber human pentesters. This shift represents a fundamental change in how we approach cybersecurity challenges. AI is not just another tool — it’s becoming essential for addressing complex security vulnerabilities and staying ahead of sophisticated threats. As organizations face more advanced cyber attacks, AI-enhanced security testing will be crucial for maintaining robust defenses.
AI introduces a powerful new abstraction layer — one that makes autonomous decisions and operates beyond human oversight.
To address its inherent risks, we must shift our security focus upwards: from simply protecting code to securing the business logic and processes AI now controls.
This “Shift Up” approach calls for purpose-built controls specifically designed to safeguard the AI decision-making layer, preventing risks from cascading into critical business impacts.
The SAIL Framework is a process-oriented methodology that systematically adds security to each phase of the AI journey. It provides a practical approach to unite development, MLOps, security, and governance teams around a common language to manage specific risks.
The SAIL Framework, developed by Dor Sarig and Ziv Karliner in collaboration with AI and cybersecurity experts from various industries, offers a comprehensive approach to securing AI systems throughout their lifecycle. It addresses over 70 AI-specific risks across seven interconnected phases — Plan, Code/No Code, Build, Test, Deploy, Operate, and Monitor — ensuring security is embedded from policy creation through runtime monitoring. By aligning with existing standards like NIST AI RMF, ISO 42001, and OWASP Top 10 for LLMs, SAIL provides actionable guidance that bridges gaps between development, operations, and security teams, enabling organizations to accelerate secure AI adoption while managing regulatory compliance and reputational risks.
Six core elements of SAIF
SAIF is designed to address top-of-mind concerns for security professionals, such as AI/ML model risk management, security, and privacy — helping to ensure that when AI models are implemented, they are secure-by-default.
- Expand strong security foundations to the AI ecosystem
- Extend detection and response to bring AI into an organization’s threat universe
- Automate defenses to keep pace with existing and new threats
- Harmonize platform level controls to ensure consistent security across the organization
- Adapt controls to adjust mitigations and create faster feedback loops for AI deployment
- Contextualize AI system risks in surrounding business processes
The Coalition for Secure AI (CoSAI) is a collaborative organization, operating under the OASIS Open consortium, that brings together a diverse ecosystem of stakeholders from industry, academia, and the developer community to address AI security through collective action. It fosters a secure AI ecosystem by having its members jointly invest in research, share best practices, and build open-source solutions and standardized methodologies for the secure development and deployment of AI. Participants benefit by gaining access to this shared expertise and resources, influencing the future of AI security standards, and strengthening the security of their own AI systems, with technical participation open and free to all.
Large language models (LLMs) have evolved from simple chatbots into autonomous agents capable of performing complex tasks such as editing production code, orchestrating workflows, and taking higher-stakes actions based on untrusted inputs like webpages and emails. These capabilities introduce new security risks that existing security measures, such as model fine-tuning or chatbot-focused guardrails, do not fully address. Given the higher stakes and the absence of deterministic solutions to mitigate these risks, there is a critical need for a real-time guardrail monitor to serve as a final layer of defense, and support system level, use case specific safety policy definition and enforcement. We introduce LlamaFirewall, an open-source security focused guardrail framework designed to serve as a final layer of defense against security risks associated with AI Agents. Our framework mitigates risks such as prompt injection, agent misalignment, and insecure code risks through three powerful guardrails: PromptGuard 2, a universal jailbreak detector that demonstrates clear state of the art performance; Agent Alignment Checks, a chain-of-thought auditor that inspects agent reasoning for prompt injection and goal misalignment, which, while still experimental, shows stronger efficacy at preventing indirect injections in general scenarios than previously proposed approaches; and CodeShield, an online static analysis engine that is both fast and extensible, aimed at preventing the generation of insecure or dangerous code by coding agents. Additionally, we include easy-to-use customizable scanners that make it possible for any developer who can write a regular expression or an LLM prompt to quickly update an agent’s security guardrails.
LlamaFirewall is utilized in production at Meta. By releasing LlamaFirewall as open source software, we invite the community to leverage its capabilities and collaborate in addressing the new security risks introduced by Agents.
Adversarial Robustness Toolbox (ART) is a Python library for Machine Learning Security. ART is hosted by the Linux Foundation AI & Data Foundation (LF AI & Data). ART provides tools that enable developers and researchers to defend and evaluate Machine Learning models and applications against the adversarial threats of Evasion, Poisoning, Extraction, and Inference. ART supports all popular machine learning frameworks (TensorFlow, Keras, PyTorch, scikit-learn, XGBoost, LightGBM, CatBoost, GPy, etc.), all data types (images, tables, audio, video, etc.) and machine learning tasks (classification, object detection, speech recognition, generation, certification, etc.).
Top AI Cybersecurity Frameworks 2025: A Comprehensive Research Guide
The artificial intelligence cybersecurity landscape is rapidly evolving, with organizations worldwide developing comprehensive frameworks to address AI-specific threats and vulnerabilities. This research examines the leading AI cybersecurity frameworks of 2025, with special attention to the SAIL Framework and other prominent methodologies that are shaping the future of AI security.
The SAIL Framework: A Comprehensive Lifecycle Approach
The Secure AI Lifecycle (SAIL) Framework emerges as one of the most comprehensive and practical approaches to AI security in 2025
. Developed by Pillar Security in collaboration with cybersecurity experts from Fortune 500 companies including AT&T, Corning, Philip Morris, Microsoft, Google Cloud, SAP, and ServiceNow, SAIL provides a holistic security methodology covering the complete AI journey from development to continuous runtime operation.
Top AI Cybersecurity Frameworks 2025 by Focus Area
SAIL Framework’s Seven-Phase Methodology
The SAIL Framework is structured around seven foundational phases that systematically address AI-specific security concerns:
1. Plan: AI Policy & Safe Experimentation
This foundational phase establishes AI security policy frameworks aligned with business objectives and regulatory requirements. It includes threat modeling, data governance definitions, and secure AI experimentation environments.
2. Code/No Code: AI Asset Discovery
This phase focuses on identifying, cataloging, and vetting all AI assets including models, datasets, no-code platforms, and code components. This comprehensive inventory is crucial for understanding the AI system’s composition and meeting emerging regulatory requirements.
3. Build: AI Security Posture Management (AI-SPM)
The Build phase performs deep risk analysis of identified AI assets, mapping interconnections to establish a clear picture of the system’s security posture and potential attack surfaces.
4. Test: AI Red Teaming
AI systems undergo rigorous security assessments that simulate adversarial behaviors, including stress testing, simulated attacks, and attempts to bypass safeguards.
5. Deploy: Runtime Guardrails
This phase ensures AI systems are released with necessary runtime guardrails and security configurations, providing protection against runtime application security threats.
6. Operate: Safe Execution Environment
AI systems run within secure and controlled execution environments using sandboxing and zero-trust strategies to isolate AI agents from critical infrastructure.
7. Monitor: AI Activity Tracing
Continuous monitoring of system activity and telemetry collection for detecting anomalies, generating audit trails, and triggering automated responses.
SAIL addresses more than 70 AI-specific risks and provides a comprehensive set of mitigations that align with other leading frameworks, making it a valuable resource for business and IT leaders.
NIST AI Risk Management Framework (AI RMF)
The NIST AI Risk Management Framework stands as the most widely adopted governance framework for AI security, released in January 2023. The framework is built around four core functions:
Govern: Establishes a risk management culture and aligns AI risk management with organizational principles.
Map: Establishes context to frame risks related to AI systems and enables negative risk prevention.
Measure: Employs quantitative and qualitative tools to analyze, benchmark, and monitor AI risks.
Manage: Prioritizes and addresses identified risks through technical controls and procedural safeguards.
The framework emphasizes trustworthy AI systems with key principles including reliability, transparency, fairness, accountability, and security. In July 2024, NIST released a specific Generative AI Profile to address unique risks posed by generative AI systems.
MITRE ATLAS: Threat Intelligence for AI Systems
The MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) framework provides a comprehensive knowledge base of adversary tactics and techniques targeting AI systems. Originally launched in 2020 and continuously updated, ATLAS has become the “de facto Rosetta Stone” for security professionals in the AI security space.
ATLAS organizes threats using a tactics and techniques matrix similar to the MITRE ATT&CK framework, covering threats such as:
Data Poisoning: Introducing malicious data into training datasets
Model Inversion: Extracting sensitive information from trained models
Adversarial Examples: Crafting inputs designed to deceive AI models
Model Stealing: Duplicating proprietary models through repeated queries
Prompt Injection: Manipulating inputs to alter language model behavior
The framework includes real-world case studies and has been enhanced with a focus on generative AI vulnerabilities through collaboration with Microsoft.
Microsoft AI Security Framework
Microsoft has developed a comprehensive AI security approach integrated across its Azure AI Foundry, Microsoft Entra, Microsoft Defender, and Microsoft Purview platforms. Key components include:
Microsoft Entra Agent ID: Centralized solution for managing AI agent identities.
AI Security Posture Management (AI-SPM): Discovers AI attack surfaces across Azure OpenAI Service, Azure Machine Learning, and Amazon Bedrock.
Threat Protection for AI Workloads: Runtime protection for enterprise-built AI applications.
Microsoft Purview AI Hub: Data security and compliance insights for AI applications.
Microsoft’s approach emphasizes enterprise-grade controls and zero-trust principles for securing the emerging “agentic workforce”.
Google’s Secure AI Framework (SAIF)
Google’s Secure AI Framework (SAIF) provides a conceptual framework for secure AI systems based on six core elements:
- Expand strong security foundations to the AI ecosystem
- Extend detection and response to bring AI into threat monitoring
- Automate defenses to keep pace with evolving threats
- Harmonize platform level controls for consistent security
- Adapt controls to create faster feedback loops
- Contextualize AI system risks in business processes
SAIF emphasizes leveraging existing security expertise while adapting to AI-specific challenges. Google has also formed the Coalition for Secure AI (CoSAI) with industry partners to advance secure AI implementation.
OWASP Top 10 for Large Language Models (2025)
The OWASP Top 10 for LLMs has been updated for 2025 to reflect the evolving threat landscape. The 2025 top vulnerabilities include:
- Prompt Injection: Manipulation of input prompts to compromise model behavior
- Sensitive Information Disclosure: Unintended exposure of sensitive data
- Supply Chain Vulnerabilities: Compromised model development elements
- Data and Model Poisoning: Malicious data introduction
- Improper Output Handling: Flaws in managing generated content
- Excessive Agency: Overly permissive model behaviors
- System Prompt Leakage: Exposure of internal operational instructions
- Vector and Embedding Weaknesses: Vulnerabilities in RAG implementations
- Misinformation: Inadvertent generation of false information
- Unbounded Consumption: Uncontrolled resource consumption
The 2025 update introduces new categories like System Prompt Leakage and Vector/Embedding Weaknesses, reflecting the maturation of LLM security understanding.
ISO 42001: AI Management Systems
ISO 42001 represents the first international, certifiable standard for AI management systems (AIMS), published in December 2023. The standard provides a structured approach to managing AI systems with requirements for:
- Establishment and implementation of AI management systems
- Risk assessment and impact assessment processes
- Data protection and AI security measures
- Continuous improvement of AI governance
ISO 42001 integrates seamlessly with ISO 27001 and ISO 27701, providing organizations with a comprehensive framework for demonstrating responsible AI usage.
Databricks AI Security Framework (DASF)
The Databricks AI Security Framework identifies 62 technical security risks across 12 canonical AI system components organized into four key stages:
I. Data Operations (Components 1–4): Raw data, data preparation, data cataloging, and data governance.
II. Model Operations (Components 5–8): Model development, training, validation, and management.
III. Model Deployment and Serving (Components 9–10): Prompt/RAG systems and serving infrastructure.
IV. Operations and Platform (Components 11–12): Monitoring and platform management.
DASF 2.0 provides 64 recommended controls and maps to leading industry frameworks including MITRE ATLAS, OWASP LLM Top 10, NIST 800–53, and ISO 42001.
HITRUST AI Security Assessment
The HITRUST AI Security Assessment provides a comprehensive set of up to 44 controls specifically designed for AI platforms and systems. Based on ISO/IEC 23894:2023 and the NIST AI Risk Management Framework, the assessment includes:
- AI-specific threat requirements addressing emerging AI vulnerabilities
- Control inheritance from AI solution providers
- Rigorous assurance mechanisms through independent testing
- Proactive threat adaptation with quarterly updates
Organizations achieving certification can demonstrate the highest level of AI security and risk management.
ENISA Framework for AI Cybersecurity Practices (FAICP)
The European Union Agency for Cybersecurity (ENISA) has developed the FAICP framework as a response to the EU AI Act. The framework consists of three layers:
Layer I: Basic Cybersecurity Foundations: Securing the ICT infrastructure hosting AI systems.
Layer II: AI-Specific Cybersecurity: Addressing AI component specificities throughout their lifecycle.
Layer III: Sector-Specific Cybersecurity: Industry-specific practices for AI security.
FAICP provides a multilayer approach to guide organizations in implementing good cybersecurity practices for AI systems.
EU AI Act: Regulatory Framework
The EU AI Act, officially enacted in August 2024, establishes the world’s first comprehensive legal framework for artificial intelligence. The Act implements a risk-based approach categorizing AI systems from minimal to unacceptable risk, with stringent requirements for high-risk systems including:
- Robustness and cybersecurity appropriate to risk levels
- Data governance ensuring integrity and confidentiality
- Incident reporting for system malfunctions
- Technical documentation including security measures
The Act emphasizes cybersecurity by design and requires compliance with harmonized standards.
Emerging Trends and Future Directions
AI-Powered Cybersecurity Mesh Architecture
Cybersecurity Mesh Architecture (CSMA) represents a paradigm shift toward decentralized, interoperable security approaches. Enhanced with AI capabilities, CSMA provides:
- Centralized intelligence with distributed enforcement
- Real-time risk scoring based on AI analysis
- Automated threat response and orchestration
- Predictive threat detection capabilities
Organizations implementing AI-enhanced mesh architectures report significant improvements in threat detection speed and response times.
Zero Trust AI Architecture
Zero Trust Architecture (ZTA) integrated with AI capabilities is becoming essential for protecting AI workloads. Key principles include:
- Continuous verification of all access requests
- Micro-segmentation of AI workloads
- Identity-based access controls for AI systems
- Behavioral analytics for anomaly detection
Studies show that organizations implementing AI-driven zero trust experience 42% reduction in security costs and 32% improvement in AI workload efficiency.
Implementation Recommendations
Based on this comprehensive analysis, organizations should consider the following strategic approach:
- Start with NIST AI RMF for governance and risk management foundations
- Implement SAIL Framework for comprehensive lifecycle security
- Utilize MITRE ATLAS for threat intelligence and red teaming
- Apply OWASP Top 10 for LLM-specific vulnerability management
- Consider ISO 42001 for formal certification and compliance
- Evaluate vendor-specific frameworks (Microsoft, Google, Databricks) based on technology stack
The rapidly evolving AI security landscape demands a multi-framework approach that combines governance, technical controls, and regulatory compliance. Organizations must adapt their security strategies to address AI-specific threats while maintaining operational efficiency and innovation capabilities.
Conclusion
The AI cybersecurity framework landscape of 2025 demonstrates significant maturation, with comprehensive methodologies addressing everything from governance and risk management to technical implementation and regulatory compliance. The SAIL Framework stands out for its practical, lifecycle-oriented approach, while established frameworks like NIST AI RMF and MITRE ATLAS provide essential foundations for AI security programs.
As AI continues to transform business operations, organizations must implement robust security frameworks that address both traditional cybersecurity concerns and AI-specific risks. The convergence of these frameworks with emerging technologies like cybersecurity mesh architecture and zero trust AI points toward a future where AI security is deeply integrated into organizational security postures.
Success in AI security requires not just selecting the right frameworks, but implementing them in a coordinated manner that addresses the full spectrum of AI risks while enabling innovation and business value creation.
Top 10 AI-Powered Cybersecurity Solutions (by Kitty Wheeler, AI Magazine — July 09, 2025)
As cyber threats become more advanced and widespread, traditional security methods are no longer sufficient. Enterprises are increasingly adopting AI-powered cybersecurity solutions that enable proactive, autonomous threat detection and response .
AI enables a shift from reactive to predictive security strategies, with key trends including:
- Platformisation : Consolidating tools into unified systems.
- Agentic AI : Autonomous systems capable of decision-making.
- Securing AI itself : Protecting AI models from manipulation.
Top 10 AI Cybersecurity Solutions:
- CrowdStrike Falcon
- Uses Charlotte AI , an agentic system that autonomously detects, investigates, and responds to threats.
- Automates complex tasks, reducing analyst workload.
- Recognised by IDC, Forrester, and PeerSpot for innovation.
2. Darktrace
- Leverages self-learning AI to model normal behavior and detect anomalies in real time.
- Operates across networks, cloud, email, and industrial systems.
- Defends over 10,000 organisations globally.
3. Palo Alto Networks (Cortex XDR/XSIAM)
- Combines SIEM, EDR, SOAR, and ASM into one platform.
- Processes trillions of events using Precision AI , automating SOC workflows.
- Eliminates tool sprawl and streamlines threat response.
4. Microsoft (Sentinel/Defender)
- Offers integrated AI-enhanced SIEM/XDR across Microsoft ecosystem.
- Native integration with Azure and Microsoft 365.
- Focuses on automated response and AI application security.
5. Trend Micro Vision One
- Features Cybertron , the first proactive AI for predicting attacks.
- Reduces alerts by 99.6% and dwell time by 65%.
- Longstanding Gartner Magic Quadrant leader.
6. Cisco AI Defense/Secure
- Secures AI infrastructure throughout its lifecycle.
- Includes AI-driven red teaming to test vulnerabilities.
- Addresses AI-specific threats like data poisoning and prompt injection.
7. SentinelOne Singularity Platform
- Autonomous detection and response via behavioural and static AI .
- Covers endpoints, cloud, and identity environments.
- Prioritises privacy by not training on user data.
8. Vectra AI
- Uses Attack Signal Intelligence to detect real threats post-compromise.
- Covers 90%+ MITRE ATT&CK techniques.
- Reduces alert noise by 80%.
9. Exabeam Fusion
- Combines SIEM, UEBA, and SOC automation in the cloud.
- Assigns risk scores to prioritise threats.
- Exabeam Copilot uses GenAI to enhance analyst productivity.
10. Abnormal Security
- Detects advanced email threats using behavioural AI .
- Integrates with cloud email APIs without changing infrastructure.
- Used by over 20% of Fortune 500 companies.
Conclusion:
These top AI-powered cybersecurity platforms represent the future of enterprise defense — moving beyond traditional methods to autonomous, intelligent, and adaptive security operations . As AI becomes more embedded in business functions, securing these systems and leveraging them for threat intelligence will be essential.
