NIST , the NSA and CISA have published a joint set of ten voluntary practices aimed at helping organisations prepare for, detect, respond to, recover from, and report rogue or misbehaving AI agents. The guidance, framed around the concept of super intelligence (SI) rather than traditional AI, groups the practices into five stages: prepare, detect, respond, recover and report.
It accompanies terminology definitions for AI agents, AI control incidents and AI control near-misses to improve common understanding across distressed or high-risk scenarios.
In practical terms, preparation covers asset and risk inventories, defence-in-depth, least privilege, zero-trust controls, credential management and supply-chain risk management. Detection focuses on continuous monitoring for correct behaviour and for anomalous activity or indications of compromise. The response stage describes isolating affected systems, revoking credentials, rebuilding environments, assessing blast radius and conducting root-cause analysis that looks beyond the specific vulnerability exploited.
Recovery emphasises testing restoration procedures in advance and documenting remaining risk, while reporting requires informing affected parties as required by law and, where appropriate, making information publicly available. The article notes that the final two practices—Notifying Government and Sharing Information Publicly—extend beyond technical steps and legal obligations toward broader transparency and cooperation.
The piece argues that the value lies in a clear, comprehensive checklist for security professionals to manage complex agentic systems, enabling safer operation and quicker recovery from incidents involving rogue SI agents. The article also anchors the guidance with associated SecurityWeek content and author commentary. October 20 2026.