cd /news/artificial-intelligence/on-ai-security · home topics artificial-intelligence article
[ARTICLE · art-3101] src=schneier.com ↗ pub= topic=artificial-intelligence verified=true sentiment=· neutral

On AI Security

AI security cannot be effectively measured through benchmarks alone, as benchmarks fail to accurately assess AI capabilities, particularly complex properties like security. Instead, it suggests that AI security should follow the evolution of software security engineering, moving toward process-driven standards and risk management practices. The author concludes that while a software-like measurement approach may work for AI, there will never be a simple "security meter," requiring constant vigilance.

read1 min views16 publishedMay 20, 2026

Good report: Executive Summary: Let’s say you wanted to make sure that your AI is secure. Can you just maximize the security and privacy benchmark and call it a day? Nope, because benchmarks don’t actually work for measuring AI capabilities (even when they are NOT emergent systemic properties like security). So let’s take a step back: how do you measure security in the first place? Good question. Over the last 30 years, security engineering for software evolved from black box penetration testing, through whitebox code analysis and architectural risk analysis to de facto process-driven standards like the Building Security In Maturity Model (BSIMM). Software had a very deep impact on business operations, and it appears that AI is going to have an even deeper impact. Will a software security-like measurement move work for AI? Probably. In the meantime we can make real progress in AI security by cleaning up our WHAT piles and managing risk by identifying and applying good assurance processes. (Spoiler alert: no matter what we do, we still don’t get a security meter for AI, so we need to be extra vigilant about security.)...

── more in #artificial-intelligence 4 stories · sorted by recency
── more on @bsimm 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
Live at https://your-agent.zahid.host
Get free account → Pricing
from €0/mo · no card required
LIVE [news/on-ai-security] indexed:0 read:1min 2026-05-20 ·