The Community Profile Arrives After the Community Has Moved
On August 3, 2026, the National Institute of Standards and Technology published NIST Internal Report 8578, the Workshop Summary Report for the first Cyber AI Profile Hybrid Workshop, by Katerina Megas of NIST with Bronwyn Patrick and Julie Snyder of MITRE. The report documents the discussions from an April 2025 workshop that gathered stakeholder feedback toward what NIST framed as a Community Profile of the Cybersecurity Framework 2.0 applied to artificial intelligence. Sixteen months separate the workshop and the workshop summary. The preliminary draft of the profile itself, NIST Internal Report 8596, appeared in December 2025 for a public comment period that closed on January 30, 2026. The profile organizes its guidance around three focus areas the workshop discussion helped scope: Securing AI System Components, Conducting AI-Enabled Cyber Defense, and Thwarting AI-Enabled Cyber Attacks.
The three focus areas are useful. They name a genuine partition of the risk surface. What the workshop summary does not do, and what the profile draft does not yet do, is close the gap between the shape of the instrument and the tempo of what the instrument is meant to govern. The workshop convened in April 2025. The draft was released in December 2025. The workshop summary itself was released as a final publication in August 2026. Over the same window, OpenAI documented GPT-Red at post-training compute scale, Anthropic disclosed model-derived cryptanalysis against a NIST post-quantum candidate, and an arXiv benchmark measured agent adherence to standing policy documents at rates below what a written specification retained in context is presumed to enforce. The workshop summary is a governance artifact. The systems the workshop was scoping have already moved through a full capability cycle.
The gap is structural, not editorial. A Community Profile is a coordination instrument. Its function is to name outcomes an ecosystem of organizations can converge on. The instrument's cadence is the cadence of consensus. When the underlying capability is drafting cybersecurity guidance for classical enterprise IT, consensus cadence is faster than the capability cadence and the instrument leads. When the underlying capability is a model that can be trained to elicit failure modes at scales that were not possible eighteen months earlier, and that can be deployed into production infrastructure without the profile in hand, the consensus cadence is slower than the capability cadence and the instrument follows. Following is not the same as failing. But an instrument that follows cannot, by construction, be the enforcement mechanism for the risk it names.
The three focus areas illustrate the asymmetry. Under Secure, the profile addresses the expanded threat surface introduced by integrating AI into an organizational ecosystem, including data pipelines, access control, third-party service agreements, and organizational baselines. Under Defend, the profile addresses the risks of adopting AI-enhanced defensive tools, including the growing monitored infrastructure and over-reliance on AI detection. Under Thwart, the profile addresses adversaries using AI to lower the cost of exploitation, scale personalized attacks, and orchestrate multi-phase intrusions. Each focus area names a category of risk the workshop participants agreed exists. None of the three focus areas yet carries an operational floor that an organization can point to when asked what it is required to have in place. The preliminary draft catalogs subcategories under the CSF 2.0 Functions with priority labels of High, Moderate, and Foundational. Priority labels are not enforcement instruments. They are a schedule of what to build if an organization has decided to build.
The workshop summary is honest about what the discussion produced. The abstract states that discussions focused on the governance and operational challenges organizations face when adopting AI. Governance and operational challenges are what a Community Profile is meant to close. The document that closes them is not the workshop summary. It is the profile. The profile is still preliminary draft. Preliminary draft cannot govern what a production system already deployed at capability frontier now does. The absence is not a criticism of the instrument. It is a description of the state of the record.
There is a further asymmetry inside the retained artifact. The workshop summary is a record of a discussion. It is a governance record of a governance discussion about a governance profile. A downstream compliance function asked to demonstrate that an organization is managing AI cybersecurity risk cannot cite the workshop summary as the instrument that manages the risk. The instrument is the profile. The profile is not yet final. The retained artifact and the retained function do not align.
What remains on the table:
- A Community Profile whose consensus cadence is measurable in years is being asked to govern a capability whose cadence is measurable in weeks; what is the operational floor an organization can rest on in the interval when the profile is not yet the profile, and what evidence chain does an auditor accept for that floor.
- The three focus areas each carry priority labels but not enforcement floors; when a regulator, an insurer, or a counterparty asks whether the priority labels have been met, on what artifact does the answering organization rely, and what is retained to prove it.
- The workshop summary documents the challenges the profile is meant to address; the profile documents the outcomes an organization should target; neither document produces the reproducible governance record that names the specific model deployment, the specific defense posture, and the specific adversarial exposure at a specific date; what record type carries that load.
The workshop convened. The profile is drafting. The retained artifact is a summary of a discussion about what to write. The systems the discussion was about have already moved. The governance artifact is retained. The governance function is not.