← All Terms

ISO/IEC 27090

An international standard, published in October 2026, giving guidance on understanding, detecting and mitigating security threats to AI systems across their life cycle.

Governance & Risk

ISO/IEC 27090:2026 is the ISO and IEC standard on cybersecurity threats to AI systems. Published in October 2026 by JTC 1/SC 27, the committee behind ISO/IEC 27001 and 27002, it explains how AI-specific vulnerabilities can be exploited, what the consequences can be and which measures help, from training data through operation and model updates.

It is guidance, so organisations are not certified against it. It is designed to complement 27001 and 27002, keeping established security practice in place and adding what is specific to AI, such as poisoning, model theft and prompt injection.

What it does not do is rank findings. It tells a security team what to look for and why it matters, and leaves the organisation to decide what to fix first. For AI agents, that ranking depends on what each agent can do: its autonomy, permissions, tools, memory and the business process it runs.

Read more on this
Security

Agent-Aware Vulnerability Management Ranks Flaws by What the Agent Can Do

A vulnerability score describes a flaw. It says nothing about the AI agent standing behind it: how freely it acts, what it is allowed to touch, which tools it can call, what it remembers and which business process it runs. Agent-aware vulnerability management adds those five things to exploitability before deciding what to fix first. ISO/IEC 27090:2026, published in October, gives the threat side of the same picture. Here is how the two fit together and how to run it.