The NIST Cyber AI Profile, published as NIST IR 8596, is a Cybersecurity Framework (CSF) 2.0 Community Profile for artificial intelligence. It takes the CSF 2.0 Functions you already use (Govern, Identify, Protect, Detect, Respond, Recover) and describes what each outcome means when the system in scope is AI, or when AI is the attacker or the defender. If your security program already reports against CSF 2.0, the profile is the shortest path to folding AI agents into that program without inventing a parallel framework. For agent deployments, the work reduces to three things: know which agents and tools exist, constrain what they can do at runtime, and keep evidence that the constraints held.
What NIST IR 8596 is (and what it is not)
NIST released the preliminary draft of the Cyber AI Profile on December 16, 2025, with public comments due January 30, 2026, according to the NIST CSRC publication page. NIST states that comments will inform an initial public draft. Treat the current text as direction, not final guidance: control language, examples and priorities can still move.
The profile is not a new framework. It is organized using the CSF 2.0 outcome structure of Functions, Categories and Subcategories. That matters for two reasons:
- No new taxonomy to learn. Your existing CSF 2.0 current-state and target-state profiles stay valid. The Cyber AI Profile adds AI-specific considerations on top.
- It sits beside, not instead of, the AI RMF. The NIST AI Risk Management Framework covers trustworthiness broadly: fairness, validity, transparency, accountability. The Cyber AI Profile narrows to cybersecurity risk. Most programs will use both, with the AI RMF owning the "should we build this" questions and the Cyber AI Profile owning "is it secured and monitored".
NIST is also developing SP 800-53 Control Overlays for Securing AI Systems (COSAiS), which go one level lower to concrete security controls. We cover that work in the NIST AI agent standards initiative and COSAiS. A useful mental model: the Cyber AI Profile says which outcomes to reach, and COSAiS says which controls get you there.
The three Focus Areas: Secure, Defend, Thwart
The profile groups its guidance into three Focus Areas. Each one answers a different question.
| Focus Area | Question it answers | Typical owner | What it means for AI agents |
|---|---|---|---|
| Secure: Securing AI System Components | Are our AI systems themselves protected? | Security engineering, platform | Inventory of agents, models, MCP servers and tools; least-privilege access; input and output controls; logging |
| Defend: Conducting AI-Enabled Cyber Defense | Are we using AI to improve our own defense, and is that use safe? | SOC, detection engineering | AI-assisted triage and detection agents are themselves agents, so they need the same Secure controls |
| Thwart: Thwarting AI-Enabled Cyber Attacks | Are we resilient when attackers use AI against us? | Threat intelligence, IR | Faster phishing, automated recon and prompt injection aimed at your agents through the content they read |
For most teams shipping agents, Secure is where the work starts. Defend and Thwart still matter, but they rest on the same foundation: you cannot defend an agent you have not inventoried, and you cannot detect an AI-enabled attack on an agent whose actions you never logged.
Mapping CSF 2.0 Functions to agent controls
The table below is our reading of how the six CSF 2.0 Functions translate into concrete controls for AI agents. It is a working map, not a quotation of the draft's Subcategories.
| CSF 2.0 Function | AI-agent interpretation | Evidence an assessor will ask for |
|---|---|---|
| Govern | Named owners for each agent, approved-use policy, risk appetite for autonomous actions | Policy documents, ownership records, approval history |
| Identify | Inventory of agents, models, tools and MCP servers, including unsanctioned ones | Current inventory with owner, data access and risk tier per agent |
| Protect | Scoped credentials, tool allowlists, input and output guardrails, human approval for high-risk actions | Policy configuration, credential scopes, approval logs |
| Detect | Monitoring of prompts, tool calls and outputs; alerts on policy violations and anomalies | Alert records, guardrail decision logs, traces |
| Respond | Ability to suspend an agent or revoke a tool fast; incident playbooks for agent misuse | Kill-switch events, incident tickets, timeline |
| Recover | Restore a known-good agent version and configuration; post-incident review | Version history, change records, lessons learned |
Two Functions deserve extra attention for agents.
Identify is harder for agents than for servers. Agents are created in notebooks, low-code tools and IDE plugins, and they connect to MCP servers that nobody registered. An inventory built from a spreadsheet goes stale in weeks. An inventory built from telemetry, such as OpenTelemetry traces, stays closer to reality. See what shadow AI is for why discovery has to be continuous, and the MCP server governance guide for bringing those servers under policy once found.
Protect has to happen at runtime. Agent behavior depends on the content it reads, so a static review at deploy time does not cover a prompt injection that arrives in a support ticket next month. Protection needs to sit in the request path: bidirectional guardrails on inputs and outputs, scoped tool access, and a human-in-the-loop step for actions with a large blast radius.
A Cyber AI Profile readiness checklist
Use this list to build a target-state profile for your agent estate. Each item maps to one or more CSF 2.0 Functions.
- Govern: Every production agent has a named business owner and technical owner.
- Govern: You have a written policy for which actions agents may take without human approval.
- Identify: You maintain a live inventory of agents, the models they call and the tools or MCP servers they use.
- Identify: You can find agents that were never registered, not only the ones that were.
- Protect: Agent credentials are scoped per agent, not shared service accounts. See non-human identity.
- Protect: Inputs and outputs pass through guardrails that can block, redact or warn.
- Protect: High-risk tool calls require human approval before execution.
- Detect: Guardrail decisions and tool calls are logged with agent identity and timestamp.
- Respond: You can suspend a single agent in minutes without taking down the platform.
- Recover: You can identify the agent version and policy in force at the time of an incident.
- All Functions: Logs are tamper-evident, so you can prove to an assessor that records were not edited after the fact.
If you already run a CSA AI Controls Matrix assessment, many of these items will already have evidence attached. Reuse it; the frameworks overlap heavily on inventory, access control and logging.
How it fits with your other obligations
The Cyber AI Profile is voluntary guidance. It does not impose legal obligations on its own. It is still useful as a common language: a CSF 2.0 profile is something a board, an auditor and a customer security questionnaire can all read.
Where you also face binding rules, such as the EU AI Act, map once and reuse. The evidence for CSF Identify (an AI inventory) and CSF Detect (logs of agent behavior) is the same evidence you need for record-keeping and post-market monitoring duties. Keep in mind that the Digital Omnibus, adopted as Regulation (EU) 2026/1744, moved the AI Act high-risk dates to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), so plan against those dates. Our AI agent compliance checklist for 2026 lists the overlapping evidence items across frameworks.
Common mistakes when adopting the profile
- Treating it as final. It is a preliminary draft. Build your mapping so you can update Subcategory references when the initial public draft lands.
- Mapping models but not agents. A model card does not tell you which tools an agent can call. The risk lives in the tool access and the actions, not only in the model.
- Logging without integrity. Logs that an administrator can edit are weak evidence. Assessors increasingly ask how you know a record is original.
- Skipping Defend. If your SOC uses AI triage agents, those agents are in scope for Secure too. Inventory them like any other agent.
Where Praesidia fits
Praesidia gives you the control plane behind the Secure focus area for AI agents, organized as discover, secure and prove:
- Discover (Identify): an inventory of agents, including OpenTelemetry-based discovery and detection of shadow MCP servers.
- Secure (Protect, Respond): guardrails that block, redact or warn on inputs and outputs, a BYOK gateway, MCP tool scoping, human-in-the-loop approvals and a kill switch per agent.
- Prove (Detect, Govern): a signed, tamper-evident audit log and executive reports you can attach to a CSF 2.0 profile as evidence.
Praesidia does not make you compliant with the Cyber AI Profile on its own. Governance decisions, risk appetite and organizational policies stay with your team. What it does is produce the inventory, enforcement and evidence that the agent-related outcomes depend on.
Key takeaways
The NIST Cyber AI Profile lets you govern AI security in the CSF 2.0 language your program already uses. Start with the Secure focus area, build a live agent inventory, put guardrails and approvals in the request path, and keep tamper-evident evidence. Track the draft as it moves toward an initial public draft, and pair it with the NIST AI RMF for the trustworthiness questions the profile leaves out. For the wider control picture, see our AI agent security guide.