Cybersecurity - Overview
The security industry cannot govern its own AI. 58% activity, 14% governance -- a 44-point gap, second only to platforms. $6.2B market tripling to $18.8B. 100% of MSSPs plan AI deployment. If a threat detection model hallucinates, the adversary wins.
AI-powered threat detection is now table stakes -- 100% of MSSPs plan deployment, and the $6.2B market is tripling. The problem is that the same models defending networks can hallucinate threats. A false negative is an open door. A false positive at 2 AM triggers automated response against production infrastructure. SEC cybersecurity disclosure rules now require evidence that security controls work as described. Boards are asking for audit trails. Most security organizations can produce logs. Very few can produce a forensic chain that reconstructs which model version, which threat intelligence feed, and which decision threshold produced a specific action at a specific time. The industry that secures everyone else's AI has not yet secured its own.
This industry includes 2 segments in the Ontic governance matrix, spanning risk categories from Category 2 — Regulated Decision-Making through 6_control_plane. AI adoption index: 7/5.
Cybersecurity - Regulatory Landscape
The cybersecurity sector is subject to 13 regulatory frameworks and standards across its segments:
- CISA directives
- DORA (if financial sector)
- EU NIS2 Directive
- FedRAMP (if gov customers)
- HIPAA (if healthcare clients)
- ISO 27001
- NIST CSF 2.0
- NIST Cybersecurity Framework 2.0
- NIST SP 800-53
- PCI DSS (if cardholder data)
- SEC cybersecurity disclosure (2023)
- SOC 2
- State data breach notification laws
The specific frameworks that apply depend on the segment and scale of deployment. Cross-industry frameworks (GDPR, ISO 27001, EU AI Act) may apply in addition to sector-specific regulation.
Cybersecurity - Cybersecurity -- MSSP / SOC Provider
Risk Category: Category 2 — Regulated Decision-Making Scale: Mid-Market Applicable Frameworks: NIST Cybersecurity Framework 2.0, SOC 2, State data breach notification laws, PCI DSS (if cardholder data), HIPAA (if healthcare clients), CISA directives
The breach notification the AI drafted is the MSSP's liability surface, not the client's.
The Governance Challenge
MSSPs and SOC providers deploy AI for threat analysis drafting, incident summary generation, policy templates, customer-facing incident notifications, SLA reporting, and vulnerability disclosure communications. 100% of MSSPs plan AI deployment. The governance gap is 44 points. When an AI-generated incident notification mischaracterizes the severity, scope, or timeline of a breach, the MSSP faces client contract liability and potential regulatory exposure under state data breach notification laws. The AI that was supposed to accelerate response becomes the liability.
Regulatory Application
NIST Cybersecurity Framework 2.0 applies to MSSP governance documentation. SOC 2 applies to MSSP service delivery evidence. State data breach notification laws (50 states, varying requirements) apply to AI-generated incident communications. PCI DSS applies to MSSPs handling cardholder data. HIPAA applies to MSSPs serving healthcare clients. CISA directives apply to MSSPs supporting critical infrastructure clients.
AI Deployment Environments
- Studio: Threat analysis drafting | Incident summary generation | Policy template assist
- Refinery: Customer-facing incident notification governance | SLA reporting compliance | Vulnerability disclosure templates
- Clean Room: Breach investigation evidence packages | Client audit response files
Typical deployment path: Refinery → Refinery → Clean Room
Evidence
- In our research, 100% of MSSPs reported plans to deploy AI; only 14% reported a formal governance framework
- State breach notification penalties vary widely, with some jurisdictions imposing thousands per violation and aggregate caps reaching into the hundreds of thousands per incident
- Client contract SLAs increasingly include AI governance requirements
- SOC 2 auditors examining AI-generated incident documentation
Cybersecurity - Cybersecurity -- Enterprise Security / GRC Platform
Risk Category: 6_control_plane Scale: Enterprise Applicable Frameworks: NIST CSF 2.0, NIST SP 800-53, SEC cybersecurity disclosure (2023), EU NIS2 Directive, DORA (if financial sector), FedRAMP (if gov customers), ISO 27001
SEC cybersecurity disclosure rules apply to AI-generated risk assessments. The board report must be defensible.
The Governance Challenge
Enterprise security and GRC platforms deploy AI for security policy drafting, risk assessment summaries, board reporting, vulnerability management narratives, incident classification, and third-party risk documentation. SEC cybersecurity disclosure rules (2023) require material cybersecurity risk reporting — and AI-generated risk assessments that inform board reporting must be defensible. NIST CSF 2.0, NIST SP 800-53, and ISO 27001 apply to AI-assisted security governance. EU NIS2 Directive and DORA (financial sector) add cross-border requirements. When SEC examines the basis for a cybersecurity disclosure and the risk assessment was AI-generated, the provenance chain must demonstrate that the assessment met the same rigor standard as a human-prepared one.
Regulatory Application
SEC cybersecurity disclosure rules (2023) require material risk reporting including AI-assisted risk assessments. NIST CSF 2.0 provides the cybersecurity governance framework. NIST SP 800-53 specifies the controls. ISO 27001 certification requirements are expanding to include AI governance. EU NIS2 Directive imposes cybersecurity governance for essential entities. DORA applies to financial sector cybersecurity AI. FedRAMP applies to government-facing security platforms.
AI Deployment Environments
- Studio: Security policy drafting | Risk assessment summaries | Board reporting assist
- Refinery: Vulnerability management narrative governance | Incident classification compliance | Third-party risk documentation
- Clean Room: SEC disclosure evidence packages | Board-level risk reporting with audit trail | Regulatory examination readiness files
Typical deployment path: Clean Room → clean_room (primary) | refinery for customer-facing documentation
Evidence
- SEC cybersecurity disclosure rules active since December 2023
- NIST CSF 2.0 AI governance requirements expanding
- Board-level cybersecurity reporting increasingly scrutinized by regulators
- GRC platform customers are asking vendors about their own AI governance