Understanding security threats to artificial intelligence systems
AI security requires organizations to examine how their systems learn and behave, alongside the technology supporting them. A compromised model or manipulated dataset can affect business decisions even when the surrounding infrastructure appears to be functioning normally.
ISO/IEC 27090:2026 provides guidance for addressing security threats and compromises specific to AI systems. Published on October 14, 2026, it helps organizations understand these threats and consider detection and mitigation throughout the AI life cycle.
What is ISO/IEC 27090?
The standard’s official title is “Cybersecurity – Artificial intelligence (AI) – Addressing security threats and compromises to AI systems.” It applies to organizations of any size that develop or use AI, including businesses, government bodies and not-for-profit organizations.
Its purpose is to support the protection of AI systems. Organizations can use the guidance to inform security decisions about their data, models and operating environments. It complements established cybersecurity practices with attention to the characteristics of AI.
Why ISO/IEC 27090 matters?
Traditional security controls remain essential, but AI creates additional exposure. Poisoned training data can influence a model’s behavior, while seemingly legitimate queries can be used to attempt model theft. Data gathered during operation can also introduce risks when reused for retraining.
For a business, the practical question is where these weaknesses could affect a service, customer or decision. An AI security review should connect technical attack scenarios to business consequences so that teams can prioritize protection and response.
Key areas of AI security
ISO’s explanatory guide groups the subject into applying information security to AI, examining AI-specific compromises and maintaining effective safeguards over time. It discusses threats including data poisoning, model exfiltration, evasion, membership inference, model inversion and prompt injection. The guide also highlights threat modelling, red teaming, supply-chain security and monitoring.
These topics encourage a broader review than checking whether an AI application has authentication and encryption. Teams should examine the data entering the system, changes to the model, access through interfaces and the use of generated outputs.
The examples below illustrate how organizations can translate these concerns into review questions. They are practical suggestions rather than a reproduction of the standard’s clauses or a mandatory control checklist.
- Training data: Who can change a dataset, how is its origin checked, and what prevents unapproved data from entering the training process?
- Model access: Who can download or modify model files, and what would alert the organization to unusual access or extraction attempts?
- Inputs and outputs: Could untrusted content influence the system’s instructions or cause an application to act on unsafe output?
- Updates and retraining: What security checks must pass before a changed model is approved for production?
- Incident response: Who can suspend an AI service, preserve relevant evidence and authorize a return to operation?
Benefits of using the guidance
ISO identifies benefits including better recognition of AI vulnerabilities, more informed mitigation decisions and stronger protection for training data and models. The guidance also supports attention to security during development, operation and updates.
In practice, organizations can use an AI security review to clarify ownership and agree what evidence is needed before deployment. Recording those decisions gives security teams, developers and service owners a common basis for addressing unresolved risks.
How it relates to other ISO standards?
ISO/IEC 27090 adds AI security detail to a wider management and control environment. The standards have different purposes, so organizations should select them according to the outcome they need.
| Standard | Primary purpose |
|---|---|
| ISO/IEC 27001 | Requirements for an information security management system. |
| ISO/IEC 27002 | Guidance on information security controls. |
| ISO/IEC 42001 | Requirements for an AI management system. |
| ISO/IEC 27090 | Guidance addressing security threats and compromises to AI systems. |
Can an organization become certified to ISO IEC 27090?
ISO/IEC 27090 provides security guidance rather than management system requirements. It should therefore not be presented as a standalone management system certification standard equivalent to ISO/IEC 27001 or ISO/IEC 42001.
An organization can review its practices against the guidance and document the scope, criteria and findings. Any resulting assessment statement should explain what was evaluated and avoid implying accredited management system certification to ISO/IEC 27090.
How to get started
The following approach can help organizations plan an initial review. The depth of the work should reflect each AI system’s use, exposure and potential consequences.
- Define the scope. Identify the AI services, models, datasets and supporting environments to be reviewed, including dependencies on external providers.
- Assign responsibility. Bring security, AI development, data owners and procurement into the review, with a named owner for each action.
- Examine realistic attacks. Consider how someone could alter data, misuse model access or influence system behaviour, and assess the business impact.
- Review safeguards. Compare existing protections with the identified scenarios, then record gaps, priorities and risk treatment decisions.
- Test and maintain. Verify selected safeguards, exercise incident handling and revisit the review when models, data sources or integrations change.
How ControlCase can help
For organizations reviewing AI security, the first step is to understand how ISO/IEC 27090 fits their existing information security and AI governance programs. A clear scope helps determine the assessment approach and the expertise needed.
Contact ControlCase to discuss your AI security objectives and how this guidance can inform your broader assurance program, including relevant ISO/IEC 27001 and ISO/IEC 42001 certification needs.
