Cisco's AI Security and Safety Framework includes a unified taxonomy that aims to classify a range of AI safety threats, such as content safety failures, agentic risks, and supply chain threats.
Cisco has rolled out an AI Security and Safety Framework it hopes will help customers and the industry get out in front of what is expected to be a potential flood of adversarial threats, content safety failures, model and supply chain compromise, and agentic behavior problems as AI becomes an integral part of the enterprise network.
With AI, humans, organizations, and governments cannot adequately comprehend or respond to the implications of such rapidly evolving technology and the threats that ensue, wrote Amy Chang, leader, threat and security research in Cisco’s AI Software and Platform group, in a blog about the new Integrated AI Security and Safety Framework.
“Organizations are deploying systems whose behavior evolves, whose modes of failure are not fully understood, and whose interactions with their environment are dynamic and sometimes unpredictable,” Chang stated.
[ Related: More Cisco news and insights ]
The framework is Cisco’s bid to define the common language for AI risk before attackers and regulators do, according to the vendor. The framework represents one of the first holistic attempts to classify, integrate, and operationalize the full range of AI risks. This vendor-agnostic framework provides a structure for understanding how modern AI systems fail, how adversaries exploit them, and how organizations can build defenses that evolve alongside capability advancements, Chang wrote.
The AI Security and Safety Framework is built on five elements that comprise an evolving AI threat landscape: the integration of AI threats and content harms, development lifecycle awareness, multi-agent coordination, multimodality, and audience-aware utility.
Further detail includes:
Threats and harms: Adversaries exploit vulnerabilities across both domains, and oftentimes, link content manipulation with technical exploits to achieve their objectives. A security attack, such as injecting malicious instructions or corrupting training data, often culminates in a safety failure, such as generating harmful content, leaking confidential information, or producing unwanted or harmful outputs, Chang stated. The AI Security and Safety Framework’s taxonomy brings these elements into a single structure that organizations can use to understand risk holistically and build defenses that address both the mechanism of attack and the resulting impact.
AI lifecycle: Vulnerabilities that are irrelevant during model development may become critical once the model gains access to tooling or interacts with other agents. The AI Security and Safety Framework follows the model across this entire journey, making it clear where different categories of risk emerge and how they may evolve, and letting organizations implement defense-in-depth strategies that account for how risks evolve as AI systems progress from development to production.
Multi-agent orchestration: The AI Security and Safety Framework can also account for the risks that emerge when AI systems work together, encompassing orchestration patterns, inter-agent communication protocols, shared memory architectures, and collaborative decision-making processes, Chang stated.
Multimodal threats: Threats can emerge from text prompts, audio commands, maliciously constructed images, manipulated video, corrupted code snippets, or even embedded signals in sensor data, Chang stated. As we continue to research how multimodal threats can manifest, treating these pathways consistently is essential, especially as organizations adopt multimodal systems in robotics and autonomous vehicle deployments, customer experience platforms, and real-time monitoring environments, Chang stated.
Audience-aware: Finally, the framework is intentionally designed for multiple audiences. Executives can operate at the level of attacker objectives, security leaders can focus on techniques, while engineers and researchers can dive deeper into sub techniques. Drilling down even further, AI red teams and threat intelligence teams can build, test, and evaluate procedures. All of these groups can share a single conceptual model, creating alignment that has been missing from the industry, Chang stated.
The framework includes the supporting infrastructure, complex supply chains, organizational policies, and human-in-the-loop interactions that collectively determine security outcomes. This enables clearer communication between AI developers, AI end-users, business functions, security practitioners, and governance and compliance entities, Chang stated.
The framework is already integrated into Cisco AI Defense package, Chang stated.
Cisco’s AI Defense package offers protection to enterprise customers developing AI applications across models and cloud services. It includes four key components: AI Access, AI Cloud Visibility, AI Model and Application Validation, and AI Runtime Protection.
There are additional model context protocol (MCP), agentic, and supply chain threat taxonomies embedded within the AI Security Framework. Protocols like MCP and A2A govern how LLMs interpret tools, prompts, metadata, and execution environments, and when these components are tampered with, impersonated, or misused, benign agent operations can be redirected toward malicious goals, Chang stated.
“The MCP taxonomy (which currently covers 14 threat types) and our A2A taxonomy (which currently covers 17 threat types) are both standalone resources that are also integrated into AI Defense and in [Cisco’s] open source tools: MCP Scanner and A2A Scanner. Finally, supply chain risk is also a core dimension of lifecycle-aware AI security. We’ve developed a taxonomy that covers 22 distinct threats and is simple,” Chang said.
Cisco isn’t only vendor to offer an AI security framework. AWS, Microsoft Azure, Palo Alto Networks, and others have frameworks as well, but Cisco says they are missing key coverage areas.
“For years, organizations that attempted to secure AI pieced together guidance from disparate sources. MITRE ATLAS helped define adversarial tactics in machine learning systems. NIST’s Adversarial Machine Learning taxonomy described attack primitives. OWASP published Top 10 lists for LLM and agentic risks. Frontier AI labs like Google, OpenAI, and Anthropic shared internal safety practices and principles. Yet each of these efforts focused on a particular slice of the risk landscape, offering pieces of the puzzle but stop short of providing a unified, end-to-end understanding of AI risk,” Change wrote.
Change stated that no existing framework covers content harms, agentic risks, supply chain threats, multimodal vulnerabilities, and lifecycle-level exposure with the completeness needed for enterprise-grade deployment. The real world does not segment these domains, and adversaries certainly do not either, Chang stated.
