Artificial intelligence is creating new opportunities for organizations, along with security considerations that traditional cybersecurity practices may not fully address. As AI systems become more integrated into business operations, protecting the data, models, and workflows behind them is becoming an increasingly important part of cybersecurity.

Published in October 2026, ISO/IEC 27090 introduces dedicated guidance for identifying, detecting, and mitigating security threats specific to AI systems. The new international standard gives organizations a structured reference for understanding how AI can be compromised and how to address those risks throughout a system's life cycle.

For organizations already working with established information security standards or exploring AI governance, ISO 27090 raises an important question: how does AI security fit into an existing cybersecurity program, and how does the standard compare with ISO 42001?

What is ISO 27090?

ISO/IEC 27090:2026, officially titled Cybersecurity — Artificial intelligence (AI) — Addressing security threats and compromises to AI systems, is an international standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

Its purpose is to help organizations understand security threats specific to AI systems, assess their potential consequences, and identify approaches to detection and mitigation. It applies to organizations of all sizes that develop or use AI, including private businesses, public-sector entities, and nonprofit organizations.

Unlike standards that establish requirements for an organizational management system, ISO 27090 provides security guidance. It focuses on the technical and operational threats that can affect AI systems, from their underlying training data to their models and behavior in production.

The standard recognizes that established cybersecurity practices remain essential. However, AI introduces additional attack scenarios that may require more specialized safeguards.

For example, an organization might have strong access controls and vulnerability management processes but still need to consider whether its AI training data could be manipulated, its model extracted through repeated queries, or its outputs exploited in unexpected ways.

ISO 27090 provides a reference for examining these risks and determining where additional protection may be needed.

Why does AI need a dedicated security standard?

AI systems rely on a combination of data, models, software, infrastructure, and user interactions. A compromise affecting any of these elements can influence how a system behaves, what information it exposes, or how reliably it performs its intended function.

Some AI-specific threats also differ from conventional software attacks. An attacker may manipulate the data used to train a model or exploit the way a model responds to carefully constructed inputs. In other cases, seemingly legitimate interactions can be used to extract sensitive information or replicate a model.

Several threats illustrate why AI security deserves specific attention.

Data poisoning

Data poisoning occurs when an attacker introduces manipulated or malicious data into a model's training process. This can influence model behavior, undermine the reliability of its outputs, or introduce vulnerabilities that persist after deployment.

Organizations need to consider the integrity and origin of training data, as well as data collected during operation that may later be used for retraining.

Model theft and extraction

AI models can represent significant intellectual property and investment. Through repeated queries or other extraction techniques, an attacker may attempt to reconstruct or obtain information about a model without direct access to its underlying files.

Protecting models therefore involves more than securing the infrastructure on which they run. Organizations may also need to monitor usage patterns, limit exposure, and detect suspicious interactions.

Adversarial inputs and prompt injection

Inputs can be crafted to manipulate an AI system's behavior or circumvent intended safeguards. In generative AI applications, prompt injection can attempt to override instructions or influence how a system interacts with connected data and tools.

These risks become particularly relevant when AI systems can access sensitive information, invoke external tools, or perform actions on behalf of users.

Model and information exposure

AI systems may reveal sensitive information through their outputs or expose details about their training data and behavior. Techniques such as model inversion and membership inference can be used to investigate information encoded in or associated with a model.

The potential impact depends on the system, the information it processes, and the context in which it operates.

ISO 27090 helps organizations examine these threats alongside their potential consequences and the measures available to address them. The goal is to incorporate AI-specific security considerations into the broader process of protecting systems and information.

What does ISO 27090 cover?

ISO 27090 addresses AI security across the system life cycle, bringing together established information security practices and guidance for AI-specific threats.

Its scope can be understood through three key areas.

Applying established security practices to AI

AI systems still depend on software, infrastructure, data, and supply chains. Existing security practices remain relevant, including threat modeling, secure software engineering, supply chain security, and zero-trust principles.

ISO 27090 provides context for applying these practices to AI systems and examining where their particular architecture or behavior may introduce additional exposure.

Threat modeling and red teaming are also relevant to understanding how an AI system could be attacked. By examining potential attack paths and testing system behavior, organizations can identify weaknesses before they lead to a security incident.

Identifying and mitigating AI-specific threats

The standard examines security threats that target AI systems and the potential consequences of successful attacks. These include data poisoning, model extraction, evasion attacks, model inversion, membership inference, and attacks involving inputs and outputs.

Understanding the threat is only part of the process. Organizations also need to consider how an attack could be detected, which safeguards are appropriate, and what happens if a control fails.

No single control addresses every threat. A layered approach can provide multiple opportunities to prevent, detect, or limit the impact of a compromise.

Maintaining security throughout the AI life cycle

AI security requires ongoing attention as systems are deployed, updated, and retrained.

For example, data collected during operation may later become part of a model's training data. If that data has been manipulated, the resulting model update could introduce vulnerabilities that were not present in the original version.

Organizations should therefore consider how changes to models, data, and connected systems affect their security posture. Logging, monitoring, development environment protection, and reassessment of safeguards can all contribute to maintaining security over time.

The appropriate measures will depend on the AI system, its intended use, and the consequences of a potential compromise.

ISO 27090 vs. ISO 42001

ISO 27090 and ISO 42001 both address risks associated with artificial intelligence, but they serve different purposes.

ISO 27090 focuses on security threats to AI systems and approaches to addressing them. ISO 42001 establishes requirements for an Artificial Intelligence Management System (AIMS), giving organizations a structured way to manage the responsible development, provision, and use of AI.

Understanding this distinction helps organizations determine how each standard fits into their broader security and governance strategy.

What is ISO 42001?

ISO/IEC 42001 is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system.

It helps organizations manage their responsibilities and risks associated with AI through defined policies, processes, objectives, and ongoing evaluation. Its scope extends beyond cybersecurity to the broader organizational management of AI, including responsible development and use.

For example, an organization implementing ISO 42001 may establish clear ownership for AI systems, define how AI-related risks are assessed, and create processes for monitoring and improving its AI management practices.

ISO 42001 is a management system standard, so organizations can pursue certification against its requirements. ISO 27090 serves a different purpose: it provides guidance for understanding and addressing security threats to AI systems rather than establishing a separate certifiable management system.

Can organizations use ISO 27090 and ISO 42001 together?

Yes. The standards address complementary aspects of AI risk management.

An organization using ISO 42001 can establish the policies, responsibilities, and processes needed to manage AI across the business. ISO 27090 can inform the more specific security considerations associated with the AI systems it develops or uses.

Consider an organization deploying a generative AI application that processes sensitive customer information. Its AI management system may define who is accountable for the application, how risks are assessed, and how the organization oversees its use.

ISO 27090 can provide additional guidance for examining threats such as prompt injection, information exposure, and model extraction, helping the organization consider appropriate technical safeguards.

Together, the standards can support a more complete approach to AI governance and security. Neither replaces the other, and applying both does not automatically guarantee that an AI system is secure or responsibly managed.

How does ISO 27090 relate to ISO 27001?

Organizations with an established information security management system may also wonder how ISO 27090 fits alongside ISO 27001.

ISO/IEC 27001 specifies requirements for establishing and continually improving an Information Security Management System (ISMS). It provides a structured approach to managing information security risks across an organization. ISO/IEC 27002 complements this by providing guidance on information security controls.

ISO 27090 builds on this established security foundation by addressing threats specific to AI systems. It helps organizations consider where existing practices remain applicable and where AI data, models, or workflows may require additional attention.

For example, an organization with ISO 27001 in place may already have processes for managing access, protecting information, responding to incidents, and assessing suppliers. Those practices remain valuable when the organization introduces AI.

However, AI systems may also require consideration of training data integrity, model behavior, adversarial inputs, and extraction attempts. ISO 27090 offers guidance for examining these additional risks within the broader context of information security.

Organizations do not need to view AI security as an entirely separate program. Instead, they can use their existing security practices as a foundation and assess where AI introduces new considerations.

How should organizations prepare for ISO 27090?

ISO 27090 provides guidance rather than a certification checklist, so preparation should focus on understanding the AI systems an organization uses and the security risks associated with them.

The following steps offer a practical starting point.

1. Identify AI systems and their use cases

Build an inventory of AI systems developed internally, purchased from vendors, or incorporated into existing business applications. Include generative AI tools, machine learning models, and AI-enabled services where relevant.

Understanding how each system is used, what information it processes, and which business activities depend on it helps establish the context for assessing risk.

2. Understand the data and models involved

Review where training and operational data originate, how models are developed or obtained, and how systems are updated.

Consider whether sensitive information could be exposed, whether data integrity is adequately protected, and how third-party AI components affect the overall security picture.

3. Assess AI-specific threats

Review how AI systems could be compromised, including threats that may not be fully addressed by conventional security assessments.

Depending on the system, this may include examining susceptibility to prompt injection, data poisoning, model extraction, and information leakage.

The level of assessment should reflect the system's capabilities, exposure, and potential impact.

4. Review existing controls and identify gaps

Evaluate existing cybersecurity practices alongside the threats identified for each AI system. Consider whether access controls, monitoring, incident response, supplier assessments, and secure development practices adequately address the relevant risks.

Where gaps exist, determine which safeguards, testing activities, or monitoring capabilities warrant attention.

5. Establish ongoing oversight

AI systems can change as models are updated, data is refreshed, and new capabilities are introduced. Security assessments should account for these changes rather than treating an initial review as permanent.

Define ownership for monitoring AI security, evaluating material changes, and responding to potential compromises. Coordinate these responsibilities across cybersecurity, engineering, data, procurement, and AI governance teams as appropriate.

These steps can help organizations begin applying ISO 27090's guidance while integrating AI security into existing risk management practices.

Building a more secure approach to AI

AI security is becoming an increasingly important consideration as organizations integrate intelligent systems into their products, services, and internal operations. Protecting these systems requires attention to established cybersecurity practices alongside threats that target AI data, models, and behavior.

ISO 27090 provides a dedicated reference for understanding these threats and considering how to detect and mitigate them throughout the AI life cycle. For organizations already working with ISO 27001 or establishing AI governance through ISO 42001, it offers another resource for developing a more comprehensive approach to security.

The next step is understanding how AI fits into your existing security program, where additional safeguards may be needed, and how those priorities align with your organization's wider risk management objectives.

Rhymetec helps organizations build and manage cybersecurity programs that support evolving business and technology needs. Connect with our team to discuss your AI security priorities and how they fit into your broader cybersecurity strategy.