AI BriefingISO/IEC 27090 published as first international standard for AI-specific security threats
·2026.10.28 06:36
Key point
The new standard covers nine specific AI threats, including data poisoning and prompt injection, but serves as guidance rather than a certification.
Details
- ISO/IEC 27090 was published on 14 October as the first international standard specifically addressing AI security threats not covered by ISO 27001.
- The standard defines nine threats: data poisoning, prompt injection, evasion attacks, membership inference, model exfiltration, model inversion, direct model poisoning, sensitive model output, and output containing injection attacks.
- It is a guidance framework for risk management rather than a certification standard, meaning there is no audit process or compliance badge.
- The scope applies to both classic machine learning and generative AI across sectors such as banking, healthcare, and recruitment, targeting professionals in cybersecurity, AI development, governance, and auditing.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Fake Customer Service Pages Induce ChatGPT and Gemini to Display Scam Numbers
Check Point Finds Jev Decision Model Vulnerable to Prompt Injection for ~$0.50
OWASP Ranks Agent Goal Hijack as Top Vulnerability; Reveals Key Attack Cases and Defense Strategies