Month: April 2026

The Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre, in collaboration with other federal and international partners, released this Joint Cybersecurity Advisory to provide network defenders with vital tools and resources to combat the threat posed by Chinese government-linked threat actors’ use of covert networks of compromised devices.

The advisory outlines tactics, techniques, and procedures associated with Chinese government-linked covert networks built from compromised small-office-home-office routers, Internet of Things, and smart devices. It explains how threat actors leveraging these covert networks, including those previously tied to groups such as Volt Typhoon and Flax Typhoon, use large scale botnet infrastructure to obscure attribution and enable reconnaissance, intrusion, command-and-control, and data exfiltration.

The advisory provides tailored defensive guidance for cyber defenders to identify, baseline, and mitigate activity originating from dynamic, deniable covert networks to reduce the risk of organizational compromise.

CISA and partners recommend the following steps to protect against this threat:

Map and understand network edge devices, developing a clear understanding of organizational assets and what should be connected to them.  Baseline normal connections, especially to corporate VPNs or other similar devices. Maintain log collection and storage solutions to assist with detecting and responding to unauthorized access attempts.  Implement multi-factor authentication for remote connections.

For more information on Chinese government-linked threat actor activity, please visit CISA’s China Threat Overview and Advisories page. CISA also provides helpful resources on the Edge Device Security webpage.

The conversation on the future of national cybersecurity is happening next Thursday. Join Red Hat, NIST, and the Office of Space Commerce for an immersive day of strategy and dialogue.

• When: April 30, 2026 | 8:00 am to 4:30 pm ET
• Where: Commerce Research Library, 1401 Constitution Ave. NW, Washington, DC 20230
• Why: Hear from leaders and industry that are most shaped by this advancement and how the nation is designing approaches to safeguard against current and emerging threats. 

Register Here

Date: May 5, 2026

Time: 2:00 p.m.- 3:00 p.m. EDT

Description:

Celebrate National Small Business Week with NIST! A key component of managing and reducing cybersecurity risks and integrating good cybersecurity practices throughout your business is making sure you have a cybersecurity-ready team. But what does that, or can that, look like? The composition of this team will vary based upon your budget, current staff capabilities, risk level, cybersecurity or privacy requirements, etc., and can vary from a single in-house cybersecurity role (e.g., hiring new staff or upskilling existing), to an entire internal cybersecurity team, to external vendor or community support—or a mix of all the above.

For small businesses who are often confronted with limited resources, knowing how to get started and finding the necessary resources can be particularly challenging. During this webinar, speakers will showcase various options that small businesses may consider as they start building their cybersecurity team, including but not limited to:

• What to consider before building your cybersecurity team
• Options if you do not have the resources to hire a dedicated staff member to focus on cybersecurity, such as apprenticeships, engaging a third-party vendor, etc.
• Community resources small businesses can reach out to for assistance
• Considerations for hiring your first cybersecurity staff member or outsourcing to a third party
• Resources and tips for training all staff to build a culture of cybersecurity throughout the organization

Ample time will be saved for audience questions and discussion.

Main Session Panelists:

• Allison K. Giddens, President, Operations, Win-Tech, Inc.
• Charles Weaver, Co-Founder, MSP Alliance
• Darcy Shaw, Program Manager, Del Mar College Cyber Center
• Tony Bryan, Executive Director, CyberUp
• Moderated by Daniel Eliot, Lead for Small Business Engagement, NIST

Guest Speakers:

• Karen Wetzel, Director and NICE Framework Lead, NIST
• Andrew Rayo, Consumer Education Specialist, Federal Trade Commission (FTC)

Register Here

Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution.

*            Mozilla Firefox is a web browser used to access the Internet.

*            Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations.

*            Mozilla Thunderbird is an email client.

*            Mozilla Thunderbird ESR is a version of the email client intended to be deployed in large organizations.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLIGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

*            Firefox versions prior to 150

*            Firefox ESR versions prior to 140.10

*            Firefox ESR versions prior to 115.35

*            Thunderbird versions prior to 150

*            Thunderbird ESR versions prior to 140.10

RISK:

Government:

*            Large and medium government entities: High

*            Small government: Medium

Businesses:

*            Large and medium business entities: High

*            Small business entities: Medium

Home Users: Low

TECHNICAL SUMMARY:

Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. Details of these vulnerabilities are as follows:

Tactic: Initial Access (TA0001 <https://learn.cisecurity.org/e/799323/tactics-TA0001-/4vw4qt/2676786819/h/_csPu7UJtjBtpMvApU4T-8fyJR2PFGquJFROrR_gyHw> ):

Technique: Drive-by Compromise (T1189 <https://learn.cisecurity.org/e/799323/techniques-T1189-/4vw4qx/2676786819/h/_csPu7UJtjBtpMvApU4T-8fyJR2PFGquJFROrR_gyHw> ):

*            Use-after-free in the DOM. (CVE-2026-6746)

*            Use-after-free in the WebRTC component. (CVE-2026-6747)

*            Uninitialized memory in the Audio/Video. (CVE-2026-6748)

*            Information disclosure due to uninitialized memory in the Graphics. (CVE-2026-6749)

*            Privilege escalation in the Graphics. (CVE-2026-6750)

*            Uninitialized memory in the Audio/Video. (CVE-2026-6751)

*            Incorrect boundary conditions in the WebRTC component. (CVE-2026-6752)

*            Incorrect boundary conditions in the WebRTC component. (CVE-2026-6753)

*            Use-after-free in the JavaScript Engine component. (CVE-2026-6754)

*            Memory safety bugs fixed in Firefox 150 and Thunderbird 150. (CVE-2026-6784)

*            Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150. (CVE-2026-6785)

*            Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150. (CVE-2026-6786)

Additional lower severity vulnerabilities include:

*            Invalid pointer in the JavaScript. (CVE-2026-6757)

*            Use-after-free in the Widget. (CVE-2026-6759)

*            Privilege escalation in the Networking component. (CVE-2026-6761)

*            Spoofing issue in the DOM. (CVE-2026-6762)

*            Mitigation bypass in the File Handling component. (CVE-2026-6763)

*            Incorrect boundary conditions in the DOM. (CVE-2026-6764)

*            Information disclosure in the Form Autofill component. (CVE-2026-6765)

*            Incorrect boundary conditions in the Libraries component in NSS. (CVE-2026-6766, CVE-2026-6772)

*            Other issue in the Libraries component in NSS. (CVE-2026-6767)

*            Privilege escalation in the Debugger component. (CVE-2026-6769)

*            Other issue in the Storage. (CVE-2026-6770)

*            Mitigation bypass in the DOM. (CVE-2026-6771, CVE-2026-6755, CVE-2026-6774)

*            Incorrect boundary conditions in the WebRTC. (CVE-2026-6776)

*            Integer overflow in the Libraries component in NSS. (CVE-2026-2781)

*            Mitigation bypass in Firefox for Android. (CVE-2026-6756)

*            Use-after-free in the JavaScript. (CVE-2026-6758)

*            Mitigation bypass in the Networking. (CVE-2026-6760, CVE-2026-6768)

*            Denial-of-service due to integer overflow in the Graphics. (CVE-2026-6773)

*            Incorrect boundary conditions in the WebRTC component. (CVE-2026-6775)

*            Other issue in the Networking. (CVE-2026-6777)

*            Invalid pointer in the Audio/Video. (CVE-2026-6778)

*            Other issue in the JavaScript Engine component. (CVE-2026-6779)

*            Denial-of-service in the Audio/Video. (CVE-2026-6780, CVE-2026-6781)

*            Information disclosure in the IP Protection component. (CVE-2026-6782)

*            Incorrect boundary conditions, integer overflow in the Audio/Video. (CVE-2026-6783)

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:

We recommend the following actions be taken:

*            Apply appropriate updates provided by Mozilla to vulnerable systems immediately after appropriate testing. (M1051: <https://learn.cisecurity.org/e/799323/mitigations-M1051-/4vw4r1/2676786819/h/_csPu7UJtjBtpMvApU4T-8fyJR2PFGquJFROrR_gyHw>  Update Software)

              *            Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

              *            Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

              *            Safeguard 7.7: Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

              *            Safeguard 9.1: Ensure Use of Only Fully Supported Browsers and Email Clients: Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest version of browsers and email clients provided through the vendor.

*            Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: <https://learn.cisecurity.org/e/799323/mitigations-M1026-/4vw4r4/2676786819/h/_csPu7UJtjBtpMvApU4T-8fyJR2PFGquJFROrR_gyHw>  Privileged Account Management)

              *            Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

              *            Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.

*            Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: <https://learn.cisecurity.org/e/799323/mitigations-M1050-/4vw4r7/2676786819/h/_csPu7UJtjBtpMvApU4T-8fyJR2PFGquJFROrR_gyHw>  Exploit Protection)

              *            Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.

*            Restrict use of certain websites, block downloads/attachments, block JavaScript, restrict browser extensions, etc. (M1021: <https://learn.cisecurity.org/e/799323/mitigations-M1021-/4vw4rb/2676786819/h/_csPu7UJtjBtpMvApU4T-8fyJR2PFGquJFROrR_gyHw>  Restrict Web-Based Content)

              *            Safeguard 9.2: Use DNS Filtering Services: Use DNS filtering services on all enterprise assets to block access to known malicious domains.

              *            Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

              *            Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.

*            Block execution of code on a system through application control, and/or script blocking. (M1038: <https://learn.cisecurity.org/e/799323/mitigations-M1038-/4vw4rf/2676786819/h/_csPu7UJtjBtpMvApU4T-8fyJR2PFGquJFROrR_gyHw>  Execution Prevention)

              *            Safeguard 2.5: Allowlist Authorized Software: Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.

              *            Safeguard 2.6: Allowlist Authorized Libraries: Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files, are allowed to load into a system process. Block unauthorized libraries from loading into a system process. Reassess bi-annually, or more frequently.

              *            Safeguard 2.7: Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.

*            Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. (M1040: <https://learn.cisecurity.org/e/799323/mitigations-M1040-/4vw4rj/2676786819/h/_csPu7UJtjBtpMvApU4T-8fyJR2PFGquJFROrR_gyHw>  Behavior Prevention on Endpoint)

              *            Safeguard 13.2: Deploy a Host-Based Intrusion Detection Solution: Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.

              *            Safeguard 13.7: Deploy a Host-Based Intrusion Prevention Solution: Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.

*            Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources. Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources. (M1017: <https://learn.cisecurity.org/e/799323/mitigations-M1017-/4vw4rm/2676786819/h/_csPu7UJtjBtpMvApU4T-8fyJR2PFGquJFROrR_gyHw>  User Training)

              *            Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.

              *            Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.

REFERENCES:

              CVE:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2781

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6746

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6747

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6748

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6749

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6750

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6751

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6752

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6753

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6754

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6755

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6756

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6757

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6758

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6759

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6760

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6761

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6762

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6763

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6764

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6765

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6766

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6767

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6768

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6769

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6770

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6771

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6772

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6773

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6774

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6775

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6776

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6777

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6778

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6779

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6780

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6781

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6782

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6783

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6784

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6785

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6786

              Mozilla:

https://www.mozilla.org/en-US/security/advisories

https://www.mozilla.org/en-US/security/advisories/mfsa2026-30

https://www.mozilla.org/en-US/security/advisories/mfsa2026-31

https://www.mozilla.org/en-US/security/advisories/mfsa2026-32

Recommendation for Cryptographic Key Generation | NIST Releases Draft SP 800-133 Revision 3 for Comment

The initial public draft (ipd) of NIST Special Publication (SP) 800-133r3 (Revision 3), Recommendation for Cryptographic Key Generation, is available for public comment. This document describes the generation of keys to be managed and used by approved cryptographic algorithms.

Proposed changes in this revision include the following:

• Asymmetric key-pair generation has been expanded to include methods for deriving randomness during key-pair generation.
• Key-pair generation now has options for derivation similar to symmetric keys and new methods for “seed expansion,” which allows for the limited use of SHAKE and deterministic random bit generators (DRBGs).
• Key-encapsulation mechanisms (KEMs) are discussed as a key-establishment option for symmetric key generation, and post-quantum cryptography (PQC) references have been added throughout (e.g., the new PQC signatures).
• Text has been reworded to address random number generation in alignment with SP 800-90C.

Comments are especially requested regarding:

• Hardware security module (HSM) design — How do these requirements align with common practice and existing systems using a root seed/secret value?
• PQC implementations and protocol — How do these requirements fit with storing keys as seeds (e.g., for ML-KEM) and performing hybrid (i.e., combined classical and post-quantum) implementations?

The public comment period will be open through June 16, 2026. See the publication details for a copy of the draft and instructions for submitting comments.

Read More

Security Copilot Skilling Series | Getting started with Security Copilot Thursday April 23, 2026 | 8:00AM (PST, Redmond Time) Description: New to Security Copilot? This session walks through what you actually need to get started, including E5 inclusion requirements and a practical overview of the core experiences and agents you will use on day one.

Register now >

NIST has updated its guidelines for manufacturers developing IoT products to better incorporate cybersecurity activities into the development process. 

Internet of Things (IoT) products often lack product cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving the securability of their IoT products by providing necessary cybersecurity functionality and by providing customers with the cybersecurity-related information they need. This publication describes recommended activities related to cybersecurity that manufacturers should consider performing before their IoT products are sold to customers. These foundational cybersecurity activities can help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce the prevalence and severity of compromises.

NIST IR 8259r1 (Revision 1), Foundational Cybersecurity Activities for IoT Product Manufacturers, describes recommended activities related to cybersecurity for manufacturers, spanning pre-market through post-market activities, to help them develop products that meet their customers’ needs and expectations for cybersecurity. This revision marks a pivotal change in addressing the full IoT product scope and broadening consideration of communications with customers about cybersecurity, maintenance, support, and end-of-life for IoT products.

Read More

The NIST National Cybersecurity Center of Excellence (NCCoE) is seeking your feedback on a newly released live document that demonstrates how organizations can implement the security practices and tasks recommended in the NIST Secure Software Development Framework (SSDF) using modern DevSecOps pipelines and commercially available technology. The live document is open for public comment through this Friday, April 24, 2026.

This release provides several components of the NCCoE DevSecOps demonstration, including:

1. An updated Executive Summary and Introduction, highlighting the purpose and background of this project.
2. A notional reference model for DevSecOps to demonstrate the NIST SSDF.
3. Details on the first example implementation, which demonstrates DevSecOps practices in a Microsoft Azure-based environment.
4. An appendix highlighting industry collaborators in the project and their technologies used in the demonstration environment.

The live document shares the findings from the NCCoE’s collaborative, demonstrative applied research project with 14 technology companies, who contributed technologies, expertise, and operational insights.

Next Steps

Unlike traditional static publications, this live document will be updated on a rolling basis with additional implementations and technical findings as the work with collaborators in the laboratory continues. In the coming months, the NCCoE will publish use case scenarios for the initial example implementation, as well as details on other example implementations showcasing several development platforms and tools. The NCCoE will also release an analysis that decomposes NIST SSDF practices and tasks into more granular and actionable tasks, illustrating their application within the project’s DevSecOps model.

We Want Your Feedback!

You still have one week left to comment! These resources are open for public comment until April 24, 2026, at 11:59 P.M. EDT. To submit comments, use the comment template on the NCCoE project page

Comment Now!

The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this alert to provide guidance in response to the software supply chain compromise of the Axios node package manager (npm). Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments.

On March 31, two npm packages for versions axios[@]1.14.1 and axios[@]0.30.4 of Axios npm injected the malicious dependency plain-crypto-js[@]4.2.1 that downloads multi-stage payloads from cyber threat actor infrastructure, including a remote access trojan.

CISA urges organizations to implement the recommendations listed in the alert to detect and remediate a potential compromise.

Disclaimer The information in this report is being provided as is for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

As a follow-up to our January workshop and in-depth comments from the community, the NIST NCCoE is planning a series of virtual working sessions as targeted discussions to further refine the NIST Cybersecurity Framework (CSF) Cyber Artificial Intelligence (AI) Profile (“Cyber AI Profile”).

We encourage you to register for each of the session topics you’re interested in discussing. Reserve your seat before it’s too late!

Virtual Working Session Schedule

Session	Description	Date/Time
Session #1:  Updates to Profile Elements and Contents	This session will discuss approaches to addressing feedback received regarding Profile content, including clarifying approaches and phrasing for Profile elements such as the priorities and considerations in Section 2 of the Preliminary Draft.	April 28, 2026 / 1:00-4:00 P.M. EDT
Session #2:  Extending the Technical Content	This session will explore how the Profile is being strengthened in critical technical areas including Agentic AI and Zero Trust.	May 5, 2026 / 1:00-4:00 P.M. EDT
Session #3:  Usability of the Profile	This session will explore different delivery formats to ensure the Profile meets the needs of different stakeholders.	May 12, 2026 / 1:00-4:00 P.M. EDT

Background

The NIST Cyber AI Profile is intended to help organizations strategically adopt AI while addressing and prioritizing cybersecurity risks stemming from its advancements. In January 2026, the NIST NCCoE Cyber AI Profile team hosted a workshop to obtain feedback on the Preliminary Draft of the Cyber AI Profile and to identify cybersecurity priorities as AI adoption continues to grow. The takeaways from this workshop have been instrumental in both creating the next draft of the Profile and identifying the community’s areas of priority as AI continues to evolve.

This virtual working session series will cover community feedback on adapting cybersecurity practices to AI, strengthening the Cyber AI Profile in key technical areas, and exploring revised Profile delivery formats to enhance usability for different roles in the AI ecosystem.

Who Should attend?

These events are open to the public. We encourage cybersecurity and AI leaders from industry, academia, and government to share expertise on AI cybersecurity.

Please come ready to share your knowledge and insights for improving the Preliminary Draft Cyber AI Profile during these interactive working sessions! Additional information regarding how to prepare for and participate in these sessions can be found on the event pages.

Register Now

Visit the NCCoE event session pages to learn more. Please register for each of the session topics you’re interested in discussing. Attendance for each event is limited to 500 participants.

Can’t Make It? 

No problem! If you are unable to attend your desired session, you are welcome to share feedback via email at cyberaiprofile@nist.gov.

Register Now