Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors

Traditional security frameworks are described as incomplete for AI threats, with the article arguing that AI-specific attack vectors fall outside the controls of the main standards like NIST CSF, ISO 27001 and CIS Controls.

It cites real breaches from 2024–2025, including the December 2024 compromise of the Ultralytics AI library and the August 2025 release of malicious Nx packages that leaked credentials, alongside ChatGPT vulnerabilities disclosed in November 2024 that allowed extraction of user data from AI memory.

The piece notes that 23.77 million secrets were leaked through AI systems in 2024, a 25% rise on the previous year, and that IBM’s Cost of a Data Breach Report 2025 reports an average of 276 days to identify a breach and 73 days to contain it; security teams may have longer detection times for AI-specific attacks, given the expanding AI/ML deployment noted by Sysdig’s research showing a 500% surge in cloud workloads containing AI packages.

It argues that organisations need AI-specific risk assessments, semantic data loss prevention, model integrity verification, adversarial robustness testing, and AI supply chain security beyond what frameworks mandate, plus updated industry standards and AI security expertise within existing teams. According to IBM’s report, and in the face of regulatory pressure such as the EU AI Act, the article urges proactive steps rather than waiting for frameworks to catch up.