Bethesda, MD, July 20, 2026 (GLOBE NEWSWIRE) — Every vendor at this year’s security conferences\u00a0claimed to do AI security, and almost none of them meant the same thing. Underneath the noise sits a quieter problem: the security leaders making these decisions have no idea whether they are making them the way everyone else is.\u00a0<\/p>\n
Existing surveys measure AI adoption, incidents, and governance policies. None of them answer the questions a security leader\u00a0actually asks\u00a0at budget time. Which AI assets are we treating as\u00a0attack\u00a0surface?\u00a0Which are we actually protecting?\u00a0Who owns the call? Lenny Zeltser and Sounil Yu built\u00a0a short survey\u00a0to close that gap, and they are asking the community to help turn it into a shared benchmark.\u00a0<\/p>\n
Zeltser, a Faculty Fellow at SANS Institute, and Yu, creator of the widely used Cyber Defense Matrix, designed the survey as a companion to their AI Defense Matrix, a free, vendor-neutral framework that maps the AI-specific assets an enterprise must defend.\u00a0Security leaders are protecting some AI assets and ignoring others, with no view of whether their choices match anyone else’s. The survey is built to reveal exactly that, and to show where the field agrees and where it is exposed.\u00a0<\/p>\n
What does the survey ask?<\/strong>\u00a0<\/strong><\/p>\n Ten questions, about five minutes. It covers which AI-related assets an organization treats as part of its attack surface, which of those it protects with at least one dedicated control, who decides how the organization secures AI, and whether those controls come from existing tools, specialized vendors, AI providers, or in-house builds. It asks how organizations secure AI in practice, not which policies they have written down.\u00a0<\/p>\n What does a respondent get out of it?<\/strong>\u00a0<\/strong><\/p>\n A peer benchmark. Zeltser and Yu will publish the aggregate findings so any participant can compare their own approach against others facing the same decisions.\u00a0Responses\u00a0are anonymous. The survey is open now at survey.aidefensematrix.com\/p\/survey202607<\/a>.\u00a0<\/p>\n Who is it for?<\/strong>\u00a0<\/strong><\/p>\n Anyone whose job includes securing AI, whatever their title. The\u00a0decisions\u00a0the survey maps, what to protect and who owns it, increasingly cut across security leadership, architecture, and governance.\u00a0<\/p>\n How does it connect to the AI Defense Matrix?<\/strong>\u00a0<\/strong><\/p>\n The matrix uses eight AI asset-class rows against the six NIST CSF 2.0 functions, giving security leaders a grid to find gaps, assign ownership, and select controls. The survey tests whether the matrix reflects how practitioners\u00a0actually work, and the responses will shape its next revision. The framework is free and cross-mapped to nine others, including the SANS Critical AI Security Guidelines.\u00a0<\/p>\n \u201cWalking the expo floor, I couldn’t tell which AI security pitches matched controls an enterprise actually needs,\u201d said Zeltser. \u201cSounil\u00a0and I built the AI Defense Matrix to give security leaders a shared map, and the survey turns it into something the whole community can benchmark against.\u201d\u00a0<\/p>\n \u201cAI has made it easy for startups to go from zero to one, which vastly increases the number of AI security products we all have to evaluate,\u201d said Yu. \u201cI hope this helps practitioners cut through the slop and see the real problems that need solving.\u201d\u00a0<\/p>\n Where can people find it?<\/strong>\u00a0<\/strong><\/p>\n The survey is open now at survey.aidefensematrix.com\/p\/survey202607<\/a>. The AI Defense Matrix is free at aidefensematrix.com<\/a>, downloadable in CSV, YAML, and Markdown, with a public change log.\u00a0<\/p>\n Frequently Asked Questions<\/u><\/strong>\u00a0<\/u><\/strong><\/p>\n What is the AI Defense Matrix?<\/strong><\/em>\u00a0<\/strong><\/em><\/p>\n The AI Defense Matrix is a free, vendor-neutral framework for defending AI systems, created by SANS Faculty Fellow Lenny Zeltser and Cyber Defense Matrix author Sounil Yu. It maps the AI-specific assets an organization must protect against the six NIST Cybersecurity Framework functions, giving security leaders a single grid to find gaps, assign ownership, and select controls. It is available at aidefensematrix.com<\/a>.\u00a0<\/p>\n What is the difference between security for AI and AI for security?<\/strong><\/em>\u00a0<\/strong><\/em><\/p>\n Security for AI means protecting AI systems themselves: the models, training data, agent identities, and runtime data. AI for security means using AI to defend traditional systems, such as AI-driven threat detection. The AI Defense Matrix covers security for AI; AI-for-security tools belong\u00a0in\u00a0the original Cyber Defense Matrix. Vendors often use the two phrases interchangeably, which is the confusion the\u00a0AI Defense Matrix\u00a0aims\u00a0to resolve.\u00a0<\/p>\n How do security leaders use the AI Defense Matrix?<\/strong><\/em>\u00a0<\/strong><\/em><\/p>\n Security leaders review each cell and ask whether their program has a control at that intersection. Starting with the Govern function anchors ownership and policy, then a\u00a0gap\u00a0inventory across the remaining cells becomes an AI defense roadmap. Vendors can use the grid in reverse, mapping their coverage to specific cells rather than claiming to secure AI broadly.\u00a0<\/p>\n What is the AI Defense Matrix survey?<\/strong><\/em>\u00a0<\/strong><\/em><\/p>\n It is a ten-question, five-minute survey asking how organizations secure AI in practice: which AI assets they treat as attack surface, which they protect with a dedicated control, who makes the decisions, and where their controls come from. Responses are anonymous, and Zeltser and Yu will publish the aggregate results as a peer benchmark. The survey is open at survey.aidefensematrix.com\/p\/survey202607<\/a>.\u00a0<\/p>\n
![\"\"](\"https:\/\/ml.globenewswire.com\/media\/NTEwZWM2OGMtOWFlNi00NmZjLWEwYmQtNzUzNmJiZmY3NDEzLTUwMDEzMjY5OS0yMDI2LTA3LTIwLWVu\/tiny\/SANS-Institute.png\")
\n <\/div>\n","protected":false},"excerpt":{"rendered":"