NIST releases a draft Cybersecurity Framework Profile for AI

NIST released a preliminary draft of NISTIR 8596, the Cybersecurity Framework Profile for Artificial Intelligence. The agency said the draft adapts the NIST Cybersecurity Framework 2.0 to AI adoption and organizes guidance around securing AI systems, using AI for cyber defense, and thwarting AI-enabled attacks. NIST opened a 45-day public comment period and characterized the document as a draft, not a final standard.

Original source date: . Hypler briefing published October 6, 2026.

Topics: NIST, cybersecurity, AI security, draft guidance

NIST Gaithersburg campus entrance sign. Context photograph, not a photograph of the announcement.
NIST Gaithersburg campus entrance sign. Context photograph, not a photograph of the announcement. Credit: R. Eskalis / NIST. NIST public information; credit requested License details.
Generated illustration of evidence records passing through a permission gate; not a compliance certification.
Generated illustration of evidence records passing through a permission gate; not a compliance certification. Credit: Hypler / AI-generated editorial illustration. Hypler editorial asset; not vendor or event photography

Engineering relevance

AI changes both the systems organizations defend and the tools they use for defense. The draft offers a structured way to connect AI security work with an established cybersecurity framework, while preserving the need for local threat modeling. Because it is preliminary guidance, teams should track revisions and avoid presenting it as final requirements or a completed compliance assessment.

Draft profile

NIST described NISTIR 8596 as a preliminary Cybersecurity Framework Profile for Artificial Intelligence built on CSF 2.0. The draft focuses on three overlapping areas: securing AI systems, conducting AI-enabled cyber defense, and thwarting AI-enabled cyberattacks. The agency positioned it as guidance for incorporating AI into cybersecurity work.

Public comment status

The December 2025 announcement said NIST was releasing the preliminary draft for a 45-day public comment period after an earlier concept paper, workshop, and community meetings. That status matters: the profile was not final at publication. Any future use should check the latest NIST version and the scope of the organization's security program.

Original source

This is a historical source briefing, not a statement of current availability or Hypler deployment.