Reading Time: 7 minutes

Every great defensive coordinator studies the opponent and adjusts before kickoff. But what happens when the opposing team can analyze every play your team has ever run, identify your weaknesses, and adapt instantly?

According to the World Economic Forum Global Cybersecurity Outlook 2026, 87% of cybersecurity leaders identified AI-related vulnerabilities as the fastest-growing cyber risk.

Speaking at CrowdStrike Fal.Con 2026, NVIDIA CEO Jensen Huang noted that AI offers advantages to both attackers and defenders. “We’re at an inflection point in cybersecurity for obvious reasons,” Huang said. “We have now had agentic AI, the ability to automate attacks, and the attacks on companies are going to grow exponentially. This is the beginning of a new age of cybersecurity. On the one hand, the adversaries are going to be more armed than ever. On the other hand, all of you are going to be more armed than ever.”

The capabilities AI gives adversaries reinforce the value of a defense-in-depth strategy. The NIST Cybersecurity Framework (CSF) 2.0 provides a practical structure for adapting defense in depth to AI.

Applying defense in depth to AI security

Defense in depth began as a military tactic. Trenches, walls, and fallback positions were used to slow an advancing force so no single breach could decide the outcome.

The idea is the same in cybersecurity. Multiple layers of defense help ensure that when one control fails, others can detect, contain, or slow the attack.

Applying defense in depth to AI requires organizations to account for three pillars of AI security.

1. Securing AI systems. Copilots, chatbots, and autonomous agents connect to sensitive data and systems. They can be tricked, misconfigured, or over-permissioned like any other technology. They also introduce new risks, such as prompt injection, data leakage, and unintended actions.
2. Building AI-enabled cyber defense. Triage, correlation, investigation, and reporting are all areas where AI can give overstretched teams meaningful advantages, if it’s deployed with care.
3. Defending against AI-enabled attacks. Phishing emails are now well-written and highly personalized. Voices and faces can be cloned from public recordings, and reconnaissance that once took days can be automated. The attacks themselves are not necessarily new, but they’re faster, cheaper, and more convincing.

Adapting NIST CSF 2.0 to AI

The NIST CSF provides guidelines, best practices, and standards to help organizations manage and reduce cybersecurity risks. NIST CSF 2.0, introduced in 2024, is organized into six high-level functions that can be used to architect a defense-in-depth strategy: Govern, Identify, Protect, Detect, Respond, and Recover.

NIST’s draft Cyber AI Profile (NIST IR 8596), released in December 2025, extends CSF 2.0 to address AI security and focuses on the same three areas.

Together, the profile and six CSF functions help teams secure AI systems, build AI-enabled cyber defense, and defend against AI-enabled attacks.

Govern

Govern is where organizations will need to make the biggest adjustments because AI adoption often happens faster than policy. Employees are already pasting customer data, source code, and contracts into AI tools, often without formal approval or oversight. Shadow AI is the new shadow IT.

Start with a clear AI Acceptable Use Policy that defines which tools are approved, what data may be entered into them, and who reviews new use cases. Name an executive owner for AI risk and make sure it appears in your risk appetite and board reporting. Then anchor your approach to a recognized framework. The NIST AI Risk Management Framework provides a common vocabulary for AI risk, while the Cyber AI Profile shows how to fold those considerations into the CSF functions you already use.

Identify

You can’t defend what you don’t know you have. Extend your asset inventory beyond servers, laptops, and applications to include AI assets such as models, copilots, agents, the data they can access, prompts and system instructions, and the API keys and service accounts that connect them.

Third-party risk management requires the same update. Many SaaS products include AI features that process your data by default. Ask vendors where your data goes, whether it is used to train models, how long it is retained, and what happens if their AI component is compromised. Add those questions to onboarding and renewal reviews, not just new purchases.

Protect

Protection now has two jobs: defending against AI-enabled attacks and securing AI systems.

• Defending against AI-enabled attacks. Assume that phishing, voice cloning, and video impersonation will look convincing. Focus less on spotting fakes and more on building a zero trust architecture where processes don’t inherently depend on trust. Require out-of-band verification for payment changes, credential resets, and other high-risk requests. Deploy phishing-resistant multi-factor authentication such as passkeys or hardware keys. Enforce least privilege so one compromised account can’t do much damage. These are the same fundamentals, applied more strictly.
• Securing AI systems. Treat AI tools like any other system that touches sensitive data. Apply access controls and data loss prevention to what goes in and comes out. Test for prompt injection, where hidden instructions in an email, document, or web page steer an AI tool into doing something its owner never intended. Give agents the narrowest permissions that let them do the job, and require human approval for actions that move money, change access, or delete data.

Detect

When attackers move faster, detection has to keep up. AI can help through behavioral analytics that spot unusual activity, tools that triage and correlate alerts across your stack, and assistants that summarize investigations so analysts can act sooner. For teams buried in alerts, those benefits are real.

Two cautions apply. First, AI requires new telemetry. Log what your AI agents do, which data they access, and which prompts and outputs pass through them. Otherwise, an AI-driven incident will be hard to investigate. Second, guard against false confidence. An AI model that quietly misses a threat, or confidently misclassifies one, is dangerous if the team stops checking its work. Validate detections regularly, and treat AI output as a strong lead rather than a verdict.

Respond

Speed still matters. AI can shorten the time from alert to containment by gathering context, suggesting next steps, and drafting stakeholder updates while responders focus on decision-making. Keep humans in the loop for high-impact actions such as isolating critical systems or disabling accounts, and define in advance which automated actions are safe to run without approval.

Update your incident response plans and playbooks for scenarios that were rare or unheard of a few years ago:

• An AI agent is compromised or begins operating outside its intended scope.
• Sensitive data leaks through a model or third-party AI service.
• A deepfake instructs your finance team to transfer funds.

Each scenario needs a named owner, a decision path, and a tabletop exercise so the first time you run it isn’t during a real event.

Recover

AI-accelerated attacks shrink your window to react, making recovery even more important. Tested, isolated backups and realistic recovery objectives help turn a serious incident into a manageable one. Include AI systems in that scope. Know how you would restore a model, its data, and its configuration, and how you would operate if an AI dependency were unavailable.

Finally, close the loop. After every incident or exercise, feed what you learned back into your Govern policies and Detect rules, and the guardrails around your AI tools. That is how a defense-in-depth strategy keeps improving as threats change.

Putting defense in depth into practice

The fundamentals of defense in depth haven’t changed. What’s changed is how quickly attackers can identify and exploit weaknesses, the growing role AI plays in business operations, and the emergence of AI systems as a new attack surface.

Every organization’s starting point will be different, and you don’t need to do everything at once. The following steps provide a practical starting point:

How SHI can help build defense in depth for AI security

SHI can help you pressure-test your layers. Our security posture reviews, executive briefings, and incident response retainers can be tailored to include AI risk, from governance and inventory to detection and response readiness.

SHI AI and Cyber Labs allow you to evaluate new technologies and validate high-impact use cases. With strategic guidance, implementation expertise, and ongoing optimization, we can help strengthen your defenses while maximizing the value of your AI investments.

NEXT STEPS

Join SHI experts and industry peers at SHI Fall Summit to learn more.

Speak to an SHI expert to evaluate your AI security posture.

Our Security Posture Review provides technical analysis and practical risk-based recommendations.